> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onlyform.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Custom domains

> Embed forms using the default URL, an Onlyform subdomain, or a connected custom hostname.

The public form URL shown on the Share page is canonical. Depending on the account configuration, it can use:

```text theme={null}
https://oy.fm/FORM_ID
https://YOUR_SUBDOMAIN.oy.fm/FORM_ID
https://forms.example.com/FORM_ID
```

## Iframe embeds

An iframe can use the complete custom-domain URL directly:

```html theme={null}
<iframe
  src="https://forms.example.com/FORM_ID"
  title="Contact us"
  style="width: 100%; height: 600px; border: 0;"
></iframe>
```

Hidden fields and UTM values remain query parameters on that URL:

```text theme={null}
https://forms.example.com/FORM_ID?account_id=acct_123&utm_source=website
```

## JavaScript widgets

Load the widget library from its stable Onlyform asset URL:

```html theme={null}
<script type="module" src="https://oy.fm/embed.js"></script>
```

The currently published `embed.js` bundle constructs its internal form iframe on `oy.fm` from the configured form ID. Your form still works when the account also has a custom public hostname, but the internal widget request does not switch to that hostname.

<Warning>
  If the embedded iframe itself must load through your custom hostname, use the direct iframe method. Do not change the `embed.js` script hostname unless Onlyform serves the widget bundle from that hostname.
</Warning>

## Content Security Policy

Allow every hostname actually used by the selected method:

```text theme={null}
script-src https://oy.fm;
frame-src https://oy.fm https://forms.example.com;
```

Merge these sources into the site's existing policy rather than replacing the complete header.