File uploads

Pro and Agency forms can accept files: CVs, screenshots, documents. Files are stored privately, and you download them from the dashboard.

Turn it on

In the dashboard, open the form, go to Settings → File Uploads, switch on Accept file uploads and save. Uploads are off by default; while they’re off, file fields are ignored.

In the same place you can choose a smaller Largest file for this form and narrow the accepted file types.

Limits

	Pro	Agency
Size per file	10 MB	25 MB
Files per submission	5	10
All files in one submission	25 MB	25 MB
Storage	2 GB	10 GB

Storage is shared by every form you own, including your team workspaces. The workspace owner can also give each team workspace its own storage limit (see Limits per workspace). Free has no file uploads.

HTML form

Add enctype="multipart/form-data" and a file input:

<form action="https://app.formkove.com/api/forms/YOUR_FORM_ID/submissions" method="POST" enctype="multipart/form-data">
  <input type="text" name="name" required>
  <input type="email" name="email" required>
  <input type="file" name="resume" accept=".pdf,.docx">
  <!-- Honeypot: hidden from people, filled in by bots. Leave it empty. -->
  <div aria-hidden="true" style="position:absolute; left:-9999px">
    <label>Leave this empty <input type="text" name="_gotcha" tabindex="-1" autocomplete="off"></label>
  </div>
  <button type="submit">Send</button>
</form>

Use multiple on the input, or several inputs, for more than one file.

fetch()

Send the form as FormData and don’t set a Content-Type header: the browser adds it with the boundary.

const form = document.querySelector('form');
form.addEventListener('submit', async (event) => {
  event.preventDefault();
  const res = await fetch(form.action, {
    method: 'POST',
    body: new FormData(form),
    headers: { Accept: 'application/json' },
  });
  const data = await res.json();
  if (!res.ok) alert(data.error); // e.g. "cv.pdf" is larger than 10 MB.
});

JSON bodies can’t carry files.

Accepted file types

PDF, Word (.docx), Excel (.xlsx), PowerPoint (.pptx), plain text (.txt), CSV, PNG, JPEG, WebP, GIF and HEIC.

Formkove checks each file’s contents, and the extension must match them: a program renamed invoice.pdf is refused. SVG, HTML, scripts, programs, zip files, and Office files with macros, ActiveX controls or embedded objects are never accepted. A chart inside a Word or PowerPoint file is fine.

When a file is refused

The whole submission is refused, nothing is stored, and it doesn’t count toward your limit. The visitor sees why:

Status	Example message
413	"cv.pdf" is larger than 10 MB., Too many files. Attach up to 5.
415	"setup.exe" is not an accepted file type., "photo.pdf" doesn't match its file extension.

JSON responses also have a code: file_too_large, too_many_files, submission_too_large, file_type_not_allowed, file_type_mismatch or empty_file. A plain HTML form shows an error page.

Where files go

• Dashboard: open a submission to see its files and download them. Anyone who can see the form’s submissions can download its files.
• Email notifications: list each file’s name and size with a link to the dashboard. Files are never attached to emails.
• Webhooks, Slack, Discord, Google Sheets and Zapier: get a download link for each file. Links work without signing in and expire after 7 days. The webhook payload has a files array:

"files": [{
  "id": "6f1c…",
  "field": "resume",
  "name": "cv.pdf",
  "size": 48213,
  "content_type": "application/pdf",
  "url": "https://app.formkove.com/api/files/6f1c…?expires=…&sig=…",
  "url_expires_at": 1795000000000
}]

• Submission data: the file field holds the file name ("resume": "cv.pdf"), so CSV exports, routing rules and the AI see the name. The AI never reads file contents.

Storage full

When your storage is full, or a workspace reaches its own storage limit, new submissions are still accepted, but their files aren’t stored. The submission shows which files were left out, and webhooks get "not_stored_reason" instead of a link. Delete old submissions to free space.

Security and deletion

• Files are stored privately on Cloudflare R2. There are no public URLs; downloads need a sign-in or a signed link.
• Files are always downloaded, never opened in the browser.
• Files aren’t scanned for viruses. Treat them like any email attachment from a stranger.
• Deleting a submission, a form, a workspace or your account deletes its files.