Doorman docs

Quickstart #

With a coding agent: paste this, and answer its one question.

Add Doorman spam protection to this project's forms. Follow https://doorman.example/llms.txt. Ask me for the email that should receive real submissions.

By hand: about three minutes, no code beyond one attribute.

1. Sign up at /signup. You get a first form, an API key, and forwarding to your sign-up email. Add a sentence about your business (“We sell invoicing software to dental practices”) so Doorman knows what a real customer looks like for you.
2. Copy the form's action URL from the dashboard into your form:

   <form action="https://doorman.example/f/f_yourFormId" method="POST">

3. Done. Real submissions arrive where you pointed them (email, Slack or webhook). Pitches and bots are kept out of your inbox; if you want to know why, each one has its reason in the dashboard. Optionally add the snippet for timing and honeypot signals.

Which integration?

• The form already posts to your own backend (an API route, Worker, server action): call /v1/check from that handler, with a 3–5 second timeout and a fallback that still delivers the lead. Act on action or deliver, never route.
• Static site or site builder, no backend: point the form's action at the hosted endpoint.
• SPA, no backend: post from the client to the hosted endpoint (snippet?platform=react).

Strict Content-Security-Policy? Add Doorman's origin to script-src for d.js, to form-action for a hosted form action, and to connect-src for AJAX or client-side posts. A backend check needs no change.

Agents & MCP #

Everything in these docs can be done without a browser, so a coding agent can set Doorman up end to end. There are two ways in:

• /llms.txt: the setup guide written for agents. It covers finding the project's forms, signing up, picking an integration, setting destinations and verifying with test submissions. Any agent that can run curl can follow it.
• /mcp: a remote MCP server (Streamable HTTP, JSON-RPC 2.0, plain JSON responses). Protocol versions 2025-06-18, 2025-03-26 and 2024-11-05.

A focused walkthrough for people is at Set up Doorman with your agent.

Install the MCP server

Claude Code, with your key (Settings in the dashboard):

claude mcp add --transport http doorman https://doorman.example/mcp \
  --header "Authorization: Bearer $DOORMAN_KEY"

No account yet? Leave the header off; doorman_signup works without one. A newly added MCP server usually loads only in the agent's next session or after a reconnect, so for setup in the current session plain HTTP (/llms.txt) is faster.

Codex (recent versions), in ~/.codex/config.toml:

[mcp_servers.doorman]
url = "https://doorman.example/mcp"

Cursor (recent versions), in .cursor/mcp.json:

{ "mcpServers": { "doorman": { "url": "https://doorman.example/mcp" } } }

Config formats for these clients change often; check your client's docs if one of these doesn't load. Without an Authorization header only doorman_docs and doorman_signup work; every other tool takes the key from the header or, failing that, an api_key argument. So an agent can sign up and keep going in the same session. If you already have an account, pass a key rather than signing up again.

MCP tools

Every tool except doorman_docs and doorman_signup also accepts api_key. Tool errors come back as an MCP tool result with isError: true and a readable message.

Accounts made by agents

An agent signs up without a password. Doorman sets a random one and emails the owner a “set a password” link, valid for 7 days, to /app#/reset/<token>. Until then the account works fully through the API key. If the email already has an account, sign-up returns 409: create a key under Settings in the dashboard (/app#/settings) and give that to the agent instead.

Hosted forms #

CORS is open, so it works from any page. Doorman accepts application/x-www-form-urlencoded, multipart/form-data (file uploads are ignored) and JSON, up to 1 MB. A GET on the URL shows a short “this is a Doorman endpoint” page.

Field-name detection

Keep your field names. Doorman matches them case-insensitively; the first field that matches each role wins.

• No message field? The longest other field, if it's over 40 characters, is used as the message.
• Lengths are clipped: message 8,000 characters, email 320, name 200.
• Fields whose names start with _ are never stored as data. The ones below have a meaning.
• On a hosted form every other name is an ordinary field, including kind: the form's own kind always applies, so a bot can't choose which questions it's asked.

Special fields

What the visitor gets back

The response never reveals the verdict. A dropped bot and a real customer get the same thing:

• Plain form post: 303 redirect to _next, else the form's redirect URL, else https://doorman.example/thanks.
• JSON: if the request's Accept header contains json, or it sends any X-Requested-With header, the answer is 200 {"ok": true}.

Before judging, a request can be rejected outright: 404 for an unknown form id (JSON error), 413 over 1 MB.

Floods from one address

Past 30 submissions a minute from one IP to one form, Doorman still stores each one, but as hold with reason: "rate_limited": not judged, not counted as a check, and not forwarded. They wait in the dashboard's review queue, and labelling one real forwards it. Past a further 100 such submissions in an hour from that IP, they're no longer stored. The visitor gets the normal response either way, so an office behind one IP never sees an error.

The snippet #

Optional. Forms work without it; with it, Doorman sees how long the visitor spent on the page and whether JavaScript ran, which catches most scripts.

<script src="https://doorman.example/d.js" defer></script>

It finds every form whose action ends in /f/f_… (or that has data-doorman), including forms added later by a single-page app, and adds three hidden inputs: _t, _js and an off-screen _gotcha honeypot (tabindex="-1", aria-hidden, so keyboard and screen-reader users never meet it).

<form action="https://doorman.example/f/f_yourFormId" method="POST"
      data-doorman-ajax data-doorman-success="Got it. We reply within a day.">
  <label>Email <input name="email" type="email" required></label>
  <label>How can we help? <textarea name="message" required></textarea></label>
  <button type="submit">Send</button>
</form>
<script src="https://doorman.example/d.js" defer></script>

// building the request yourself
const body = { ...Object.fromEntries(new FormData(form)), ...window.Doorman.signals() };
await fetch(form.action, {
  method: "POST",
  headers: { "Content-Type": "application/json", Accept: "application/json" },
  body: JSON.stringify(body),
});
// always { "ok": true }

API reference #

Base URL https://doorman.example. JSON in, JSON out, request bodies up to 256 KB. CORS is open, but keep the key on your server.

Authentication

Send your API key as a bearer token. Keys look like dm_live_…. /v1/signup returns one; more live under Settings in the dashboard, where you can create several and revoke any of them.

Authorization: Bearer dm_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Create an account, its first form and an API key in one call. Made for agents and scripts; people can use /signup.

curl -X POST https://doorman.example/v1/signup \
  -H "Content-Type: application/json" \
  -d '{
    "email": "owner@example.com",
    "site_url": "example.com",
    "site_context": "Example sells invoicing software to small businesses in the US.",
    "agent": "claude-code"
  }'

201 with api_key, account (as /v1/me), form (as /v1/forms, with action_url), dashboard_url, claim (a sentence saying where the password link went, or null), next_steps and note. The first form is created for you (kind lead, forwarding to the sign-up email); use its id rather than creating another. Until the owner clicks the link in that email, account.verified is false: 100 checks, and nothing is emailed (Slack and webhooks work). 409 if the email already has an account; 429 after 5 sign-ups an hour from one IP.

Judge one submission and get a route back. Counts as one check.

Without form, the defaults apply: thresholds 0.8 / 0.2, enforce mode, no lists, nothing forwarded. The decision is still stored and shows up in your dashboard.

curl https://doorman.example/v1/check \
  -H "Authorization: Bearer $DOORMAN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "form": "f_yourFormId",
    "email": "sam@growthstudio.example",
    "name": "Sam",
    "message": "Love what you are building. We fill SaaS pipelines with done-for-you outreach. Open to a 15 minute chat?",
    "signals": { "ip": "203.0.113.7", "seconds_on_page": 38, "honeypot_filled": false }
  }'

Response:

{
  "id": "sub_8fKq2LmZ0aVb3c",
  "form": "f_yourFormId",
  "created_at": "2026-09-28T14:03:11.402Z",
  "action": "drop",
  "deliver": false,
  "route": "drop",
  "p_real": 0.06,
  "reason": "pitch",
  "evidence": "We fill SaaS pipelines with done-for-you outreach.",
  "model": "jev-1.13.0",
  "latency_ms": 211,
  "label": null,
  "email": "sam@growthstudio.example",
  "forwarded": false,
  "forwarded_to": [],
  "forward_why": "not_requested",
  "forward_detail": "Pass forward: true (with form) to send it to the form's destinations, or act on it in your own code."
}

In your handler: on drop, show the normal thank-you but don't save or notify; on hold, save it flagged for review; on deliver, the normal path. Never tell the visitor the verdict, and treat a Doorman timeout as hold, not drop (the SDK does this for you). Without the SDK:

let r;
try {
  const res = await fetch("https://doorman.example/v1/check", {
    method: "POST",
    headers: { Authorization: `Bearer ${env.DOORMAN_KEY}`, "Content-Type": "application/json" },
    body: JSON.stringify({ form: "f_yourFormId", email, name, message, signals: { ip } }),
    signal: AbortSignal.timeout(4000),
  });
  if (!res.ok) throw new Error(`Doorman ${res.status}`);
  r = await res.json();
} catch {
  r = { deliver: true, action: "hold", reason: "doorman_unreachable" }; // never lose a lead
}
if (r.deliver) await saveLead({ email, name, message, flagged: r.action === "hold" });

Plain fetch, so it runs on Cloudflare Workers, Node 18+, Next.js, Deno and Bun. GET /v1/forms/:id/snippet?platform=fetch returns it with your form id filled in.

Also at /v1/me. The account: id, email, verified (false until the owner clicks the confirmation link; until then nothing is emailed), plan (free, pro, business), plan_name, effective_plan (pro while a trial runs), trial_ends_at (when the Pro trial ends, or null), usage ({ month, checks, limit }), retention_days and plans (every plan's price and checks).

Forms

All forms, as { "data": [ … ] }, each with submissions (count) and last_at.

Create a form: one per distinct form on the site. Body: any of the settings below (name defaults to “Contact form”). Returns 201 with the form and next_steps. Up to 50 forms per account.

{ "name": "Demo request", "kind": "lead", "site_context": "Invoicing software for dental practices in the UK." }

One form, as saved. Read it back after a change to confirm it took.

Change any settings; omitted ones stay as they are.

curl -X PATCH https://doorman.example/v1/forms/f_yourFormId \
  -H "Authorization: Bearer $DOORMAN_KEY" -H "Content-Type: application/json" \
  -d '{ "slack_url": "https://hooks.slack.com/services/…", "mode": "watch", "allow_list": ["bigcustomer.com"] }'

Deletes the form. Its endpoint stops accepting posts (404).

Form settings

Read-only on the form object: id, action_url, webhook_secret, created_at. The API includes webhook_secret only once a webhook_url is set; treat those responses like the key.

Test & test delivery

Judge a sample message with the form's settings, as if a person spent 40 seconds on the page. Free, not counted, not forwarded, and left out of submission listings. Body: { "message": "…", "email": "…" } (email optional). Returns the same object as /v1/check.

POST /v1/forms/f_…/test  { "message": "Hi, we run a 12-person dental clinic and spend a day a week chasing invoices. Can we see a demo?" }   -> deliver
POST /v1/forms/f_…/test  { "message": "We help SaaS founders fill their pipeline with done-for-you outreach. 15 min chat?" }                 -> drop

Sends a sample submission to every destination the form has and returns { "log": [ { "to": "webhook"|"slack"|"email", "ok": true, "status": 200, "ms": 84 } ] }, with error on failures.

Ready-to-paste integration code for a form: { "platform", "note", "code" }. Platforms: html, ajax, react, nextjs, express, curl, webflow, framer, wordpress. Unknown platform: 422.

Submissions

Recent decisions, newest first, as { "data": [ … ], "next_before": "…" } with the same objects as /v1/check. Test submissions are excluded.

curl "https://doorman.example/v1/submissions?review=true&limit=20" \
  -H "Authorization: Bearer $DOORMAN_KEY"

One submission. 404 if it doesn't exist or isn't yours.

Tell Doorman what a submission really was. Body: { "label": "real" } or { "label": "spam" }. Returns the updated submission.

• real sets action to deliver. If it was never forwarded and it came from a hosted form (or an API check with forward: true) whose form has destinations, it's forwarded now as submission.delivered. This is the “rescue” button in the dashboard.
• spam sets action to drop and cancels any pending delivery retries. Nothing already sent is recalled.

Errors & limits

Errors are JSON with a human-readable message: { "error": "…" }.

A model error is not an HTTP error: you get 200 with route: "hold" and reason: "doorman_error". Hosted forms never return 429; see floods.

Routes & thresholds #

Doorman's models answer typed questions about each submission: real (a probability), pitch, automated (and fraud for checkouts), and evidence, a choice among the message's own sentences. Only real decides the route, using thresholds that live in Doorman, per form:

The reason on a hold or drop is whichever of pitch, automated or fraud scored highest, if it scored at least 0.5; otherwise null.

Set them equal to remove the hold lane; lower drop_below to drop only the obvious.

Kinds #

A form's kind changes what “genuine” means and what Doorman looks for. For sign-ups without a message, the evidence is the field that gave it away, such as Email: ….

Checkout signals

For checkout, send the check from your server with what your payment flow knows in signals, plus order. Missing values are fine. The evidence is one of these facts, e.g. "Payment attempts before success: 6".

{
  "kind": "checkout",
  "email": "buyer@example.com",
  "order": { "items": "10× $50 gift card", "total_usd": 500 },
  "signals": {
    "card_country": "US", "ip_country": "RO",
    "attempts": 6, "device_orders_last_hour": 4,
    "account_age_days": 0, "name_match": false, "card_type": "prepaid"
  }
}

Allow & block lists #

Each form has an allow_list (always delivered) and a block_list (always dropped). A matching submission isn't judged and doesn't use a check; its reason is allow_list or block_list and p_real is null. The allow list is checked first.

Matching is on the sender email Doorman detected and is case-insensitive. Lists apply to hosted posts, /v1/check calls with a form, and tests.

Webhooks #

Set a webhook URL on a form and Doorman POSTs JSON to it for every submission it forwards. Two events:

• submission.delivered: a deliver, a watch-mode drop, or a rescue.
• submission.held: a hold, sent with held: true (only if the form forwards holds).

Drops never reach your webhook unless you rescue them.

POST /your/webhook
Content-Type: application/json
User-Agent: Doorman-Webhook/1
Doorman-Signature: t=1790604191,v1=5f2c0a…e41b

{
  "event": "submission.held",
  "id": "sub_8fKq2LmZ0aVb3c",
  "created_at": "2026-09-28T14:03:11.402Z",
  "form": { "id": "f_yourFormId", "name": "Contact form" },
  "route": "hold",
  "held": true,
  "p_real": 0.46,
  "reason": null,
  "evidence": "Could I resell this to my own clients?",
  "submission": {
    "email": "ana@studio.example",
    "name": "Ana",
    "message": "Hi! Could I resell this to my own clients? We manage books for about 30 small shops.",
    "fields": { "company": "Studio Ana" }
  },
  "dashboard_url": "https://doorman.example/app#/inbox/sub_8fKq2LmZ0aVb3c"
}

Retries

Each attempt has an 8-second timeout; any 2xx counts as delivered. If a destination fails (webhook, Slack or email), only that destination is retried, after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours: six attempts in all. The log of every attempt is on the submission in the dashboard. Labelling a submission spam cancels its pending retries. Make your handler idempotent on id, since a retry can arrive after a slow success.

Verifying the signature

Each form has its own secret (webhook_secret, whsec_…, on the form object; rotate it in the dashboard). The header is t=<unix seconds>,v1=<hex>, where the hex is HMAC-SHA256 with your secret over "<t>.<raw body>". Verify against the raw request body, compare in constant time, and reject timestamps more than 5 minutes old.

With the SDK, verifyWebhook resolves to the parsed payload and rejects if anything is wrong:

import express from "express";
import { verifyWebhook } from "@withdoorman/client";

// keep the body raw on this route
app.post("/hooks/doorman", express.raw({ type: "application/json" }), async (req, res) => {
  let event;
  try {
    event = await verifyWebhook(req.body, req.get("Doorman-Signature"), process.env.DOORMAN_WEBHOOK_SECRET);
  } catch {
    return res.sendStatus(401);
  }
  if (event.held) { /* flag it for a human */ }
  // event.submission.email, event.submission.message, event.evidence …
  res.sendStatus(200);
});

Without the SDK, it's a few lines:

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyDoorman(rawBody, header, secret) {
  const m = /t=(\d+),v1=([a-f0-9]+)/.exec(header || "");
  if (!m || Math.abs(Date.now() / 1000 - Number(m[1])) > 300) throw new Error("bad or old signature");
  const expected = createHmac("sha256", secret).update(`${m[1]}.${rawBody}`).digest();
  const got = Buffer.from(m[2], "hex");
  if (got.length !== expected.length || !timingSafeEqual(got, expected)) throw new Error("signature mismatch");
  return JSON.parse(String(rawBody));
}

Slack & email #

Forwarding goes to every destination a form has, in parallel, with the same rules and retries as webhooks.

• Slack: paste a Slack incoming webhook URL. Each message shows the sender, the message quoted, and an “Open in Doorman” link. Held ones are marked with the chance it’s real and why.
• Email: one or more addresses. New accounts forward to the sign-up address by default. Reply-To is set to the sender, so you can just hit reply. Held ones have a [Held] subject prefix and a banner with the evidence.

Webflow app #

Doorman for Webflow is a panel in the Webflow Designer that protects your site's forms without leaving Webflow.

1. Open it: in the Designer, open the Apps panel and choose Doorman.
2. Connect: press Connect Doorman. A withdoorman.com window opens; sign in or create a free account there and press Connect. You never type a password into the panel.
3. Protect a form: the panel lists the forms on the current page. Press Protect this form: Doorman creates a matching form and sets your Webflow form's action to it, method POST. A form with a message box is screened as an enquiry; one with only short fields (an email, a name) as a sign-up or waitlist.
4. Publish your site, then send a test from the live page. The panel shows Connected and the time of the last submission, and refreshes on its own (or press Check now).

What protecting a form changes

• Doorman takes over the form from Webflow. Protect sets the form's action (Send to → Custom action) to Doorman, so its submissions go to Doorman instead of Webflow. Webflow no longer processes or stores them (they won't appear in your site's Forms list), doesn't send its form notification emails for them, and anything triggered by Webflow form submissions stops firing for that form. Other forms are unchanged.
• Where submissions go: real ones are forwarded to your account's email address. Change this, or add Slack or a webhook, under Forms → your form in the Doorman dashboard. Every submission, with its verdict, is in your Doorman inbox.
• What visitors see: after submitting, visitors go to a short Doorman thank-you page (“Thanks, your message is on its way.”) with a link back to your site. They see the same page whatever the verdict, so nobody is told their message was judged spam. Webflow's own success message and redirect setting aren't used for a protected form. To send visitors to a page on your site instead, set Thank-you page under Forms → your form → More options in the Doorman dashboard.
• How it screens: forms start in enforce mode. Real submissions are delivered, clear pitches and bots are dropped (kept in your inbox, not forwarded), and unsure ones are held for you. By default, held submissions are also forwarded to you, marked “held”; turn off Send me held messages straight away to keep them in your inbox instead. One click delivers anything Doorman got wrong.
• Watch mode (optional): to check Doorman's calls first, set Protection to Watch only under Forms → your form → More options. Submissions Doorman would have dropped are delivered instead, tagged with what it would have done. Unsure ones are still held and follow the form's hold setting above. Watch mode stays on until you set Protection back to On yourself; it never switches on its own.

Limits and how long submissions are kept

• Screened submissions a month: 100 on Free, 5,000 on Pro, 50,000 on Business. Pitches and bots count. Past the limit nothing is dropped: submissions are held unjudged (and forwarded, if the form sends you held messages) until the month resets or you upgrade.
• Email forwards a month are counted separately: 100 on Free, 2,000 on Pro, 10,000 on Business. Past that, Doorman stops emailing until the month resets; submissions are still screened and kept in your inbox, and Slack and webhook forwards aren't limited.
• Retention: submissions are kept in Doorman for 30 days on Free, 180 days on Pro and 365 days on Business, then deleted automatically. What's already been forwarded to your email, Slack or webhook stays there. See Privacy.

What it sends and what it can do

• Once a form is protected, its submissions (what visitors type, such as their name, email and message) go to Doorman at withdoorman.com to be screened, and the real ones are forwarded to you.
• Connecting creates an API key called “Webflow app” on your account. It can only list, create and rename forms. It can't read submissions, change where they're sent, or do anything else. Revoke it any time under Settings → API keys, or press Disconnect in the panel.
• The panel adds no code to your site; it only changes the settings of forms you protect.

Removing it (in this order)

1. In the panel, press Remove on every protected form. This clears the custom action, so Webflow handles the form again.
2. Publish your site. Until you publish, the live forms still send to Doorman.
3. Then uninstall the app, and if you like, delete the Doorman forms or your Doorman account.

If you skip a step: uninstalling the app doesn't change your forms. A protected form keeps sending its submissions to Doorman, which keeps screening and forwarding them while your account exists. If you delete a form's Doorman form (or your account) before restoring and publishing the Webflow form, its submissions can't be delivered anywhere: visitors who submit see a page saying their message wasn't sent, so nobody thinks it arrived, but the message is lost.

HubSpot #

Doorman for HubSpot keeps spam out of your HubSpot contacts without changing your forms. HubSpot takes each submission exactly as before; Doorman reads it within a minute, against what your business sells, and tags the contact.

The free scan

At withdoorman.com/hubspot, connect HubSpot with read-only access to your forms. Doorman reads up to 500 submissions from the last 90 days and reports how many were spam, what they cost you in marketing contacts, and examples with the line that gave each one away. Nothing in HubSpot changes, and the access isn't kept.

Turning on protection

1. Press Turn on protection (on the scan report, the HubSpot page, or Dashboard → HubSpot) and approve HubSpot's consent screen. If you don't have a Doorman account yet, one is created from your HubSpot login, with 14 days of Pro.
2. If HubSpot shows those permissions locked (Doorman is already connected from a scan), an admin enables them first: Settings → Integrations → Connected apps → Doorman.
3. Doorman adds a Doorman group of contact properties and a Doorman: spam list to your HubSpot, and starts reading new submissions to all your forms (new forms included).
4. Doorman then reads the 90 days before you connected (up to 500 submissions) and tags those contacts too, so the spam already in your HubSpot is in the list. It runs once, by itself.

Each submission's contact gets:

Spam contacts also join the Doorman: spam list. Doorman never deletes a contact. Rescue a submission in Doorman (or mark one spam) and the contact and list are updated to match. There's also a Doorman card for the contact record's sidebar: in a contact, choose Customize, add the card from the app card library, and save.

The workflow: notifications for real leads, non-marketing for spam

HubSpot sends a form's notification email the instant someone submits, before anything can judge it, and it counts every new contact as a marketing contact. One contact-based workflow fixes both:

1. Trigger: Form submission on your forms.
2. Delay 5 minutes. Doorman tags the contact within one.
3. If/then branch: Doorman verdict is any of Spam.
4. Yes: Set marketing contact status to non-marketing.
5. No (Real, Not sure, or not checked yet): your internal notification or owner rotation.

Then switch off the form's own notification email (Marketing → Forms → your form → Options). Because the branch holds back only contacts tagged Spam, a real lead, an uncertain one, or one Doorman couldn't check still reaches your team.

For the spam the clean-up tagged, open the Doorman: spam list, select all, and choose Set as non-marketing. HubSpot applies marketing-status changes at your next billing update.

Usage, pausing and disconnecting

Each HubSpot submission Doorman reads is one check, the same as any form. Pause from Dashboard → HubSpot to stop reading new submissions (contacts keep their tags). Disconnect revokes Doorman's access in HubSpot; uninstalling the app in HubSpot (Settings → Integrations → Connected apps) does the same, and Doorman stops within a minute.

Zapier, Make & Google Sheets #

Anything that can receive a webhook can receive Doorman's real submissions, already screened. Put its URL in the form's Webhook URL (Forms → your form → Destinations). Only delivered submissions are sent (and held ones, if the form forwards holds), so pitches never reach your CRM or sheet.

• Zapier: new Zap → trigger Webhooks by Zapier → Catch Hook. Copy the URL Zapier gives you into Doorman, press Send a test delivery, then map submission.email, submission.name, submission.message and submission.fields to the next step (HubSpot, Pipedrive, Notion, Airtable…).
• Make: new scenario → Webhooks → Custom webhook → Add. Copy the address into Doorman and send a test delivery so Make learns the fields.
• Google Sheets: open the sheet → Extensions → Apps Script, replace the code with the script below, then Deploy → New deployment → Web app, with Execute as: Me and Who has access: Anyone. Copy the web app URL (it starts https://script.google.com/macros/) into Doorman. Each real submission becomes a row.

// Doorman → Google Sheets: one row per real submission
function doPost(e) {
  const p = JSON.parse(e.postData.contents), s = p.submission || {};
  SpreadsheetApp.getActiveSheet().appendRow([
    p.created_at, p.held ? "held" : "delivered", s.name || "", s.email || "",
    s.message || "", JSON.stringify(s.fields || {}), p.dashboard_url,
  ]);
  return ContentService.createTextOutput("ok");
}

The payload is the same as any webhook; these tools skip the signature check, which is fine for a sheet or a CRM. If your own server receives it, verify the signature.

File uploads: Doorman doesn't keep files. A submission that had one notes the file's name and size, so you know to ask the sender for it.

Watch mode #

Set a form's mode to watch to try Doorman on real traffic without risk. Everything is judged and stored exactly as in enforce mode, but anything that would have been dropped is forwarded as a normal submission.delivered. Its route still says drop and its action says deliver, so you can see in the dashboard and the API what Doorman would have done.

Holds behave as usual in watch mode. When the drops look right, switch to enforce.

Plans, retention & failure #

Every new account starts with a 14-day Pro trial, no card (30 days from a referral link), then moves to Free unless it upgrades. Until November 30, 2026, the first 100 paying customers get Pro at $19 a month or Business at $59, kept while they stay subscribed. Pricing.

A check is one judged submission, from a hosted form or /v1/check; pitches and bots count. Tests, list matches and flood-limited submissions don't count. Months are calendar months in UTC. You get an email at 80% and 100%. Submissions older than your plan's retention are deleted automatically.

Doorman fails open, into the hold lane, never into drop:

If forwarding holds is turned off on a form, held submissions still wait in the dashboard's review queue; they just aren't pushed to you.

Limits

Live service status and 90-day uptime: /status (JSON at /status.json).

Passwords & your data #

• Set a password for an agent-made account from the link in the welcome email (valid 7 days).
• Forgot it? Use /app#/forgot. Reset links are valid for an hour, and using one signs out every other session.
• API keys are shown once when created, stored only as hashes, and can be revoked in Settings.
• Export everything Doorman holds about your account as JSON, or delete the account and all its submissions, from Settings.

Submissions are sent to our machine-learning provider only to be judged and aren't used for training. See the privacy policy.

Node SDK #

@withdoorman/client is a zero-dependency wrapper for Node 20+, Bun, Deno, Cloudflare Workers and edge runtimes, with TypeScript types.

npm install @withdoorman/client

import { Doorman, verifyWebhook } from "@withdoorman/client";

const doorman = new Doorman(process.env.DOORMAN_KEY, {
  baseUrl: "https://doorman.example",
});

// same body and response as POST /v1/check; never throws on an outage
const r = await doorman.check({ form: "f_yourFormId", email, name, message });
if (r.action !== "drop") await saveLead({ email, message, held: r.action === "hold" });
return res.json({ ok: true }); // same answer for everyone

// a person said it was real after all
await doorman.label(r.id, "real");

Act on r.action rather than r.route: it respects watch mode and labels.

Hosted, or build it yourself #

Doorman is a hosted service: you point a form at it, or call one API, and it's running. There is nothing to deploy, and no model key, server or mail setup of your own.

Rather build it yourself?

The core idea is open source. github.com/0x4rch/doorman (MIT) is the reference implementation: how each submission becomes one request of typed questions to Jev, how the answers route to deliver, hold or drop, and how the evidence sentence is picked. It includes a demo UI, a command-line judge, 312 labelled test submissions, a public benchmark (0.992 precision on 1,956 human-labelled comments) and a Cloudflare Pages Function example. It runs in mock mode without a key.

Building on it, you bring your own TypeSafe API key, hosting, storage, email delivery and monitoring, and keep the questions tuned as spam changes. If that's you, go for it, and tell me what you build: I'm happy to help.