Custom domains

The public form URL shown on the Share page is canonical. Depending on the account configuration, it can use:

https://oy.fm/FORM_ID
https://YOUR_SUBDOMAIN.oy.fm/FORM_ID
https://forms.example.com/FORM_ID

Iframe embeds

An iframe can use the complete custom-domain URL directly:

<iframe
  src="https://forms.example.com/FORM_ID"
  title="Contact us"
  style="width: 100%; height: 600px; border: 0;"
></iframe>

Hidden fields and UTM values remain query parameters on that URL:

https://forms.example.com/FORM_ID?account_id=acct_123&utm_source=website

JavaScript widgets

Load the widget library from its stable Onlyform asset URL:

<script type="module" src="https://oy.fm/embed.js"></script>

The currently published embed.js bundle constructs its internal form iframe on oy.fm from the configured form ID. Your form still works when the account also has a custom public hostname, but the internal widget request does not switch to that hostname.

If the embedded iframe itself must load through your custom hostname, use the direct iframe method. Do not change the embed.js script hostname unless Onlyform serves the widget bundle from that hostname.

Content Security Policy

Allow every hostname actually used by the selected method:

script-src https://oy.fm;
frame-src https://oy.fm https://forms.example.com;

Merge these sources into the site’s existing policy rather than replacing the complete header.

Widget options Widget troubleshooting

⌘I

Get started

Reference

Iframe embeds

JavaScript widgets

Content Security Policy

​Iframe embeds

​JavaScript widgets

​Content Security Policy

Iframe embeds

JavaScript widgets

Content Security Policy