> ## Documentation Index
> Fetch the complete documentation index at: https://docs.formflows.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Access control

> Control who can view, submit, and manage your forms — from public open access to invite-only with role-based permissions.

FormFlows.ai gives you two distinct layers of access control: **submission restrictions** that govern who can fill in a form, and **team access** that governs who in your workspace can edit, view submissions, or delete forms.

## Public vs. restricted forms

By default, every published form is **public** — anyone with the link can open and submit it. You can switch a form to **restricted** to require sign-in or other conditions before a visitor can access the form.

To change a form's visibility:

1. Open the form and click **Settings → Access**.
2. Under **Visibility**, select **Public** or **Restricted**.
3. Click **Save**.

<Warning>
  If you switch a form from public to restricted after it has already been shared, existing links continue to work but visitors will be prompted to sign in (or meet whatever restriction you set) before they can see the form. Let your audience know in advance to avoid confusion during active campaigns.
</Warning>

***

## Submission restrictions

<Tabs>
  <Tab title="Who can submit">
    ### Require sign-in

    When sign-in is required, visitors must authenticate before the form loads. You can allow sign-in via a FormFlows.ai account or via your organization's SSO provider.

    1. Go to **Form settings → Access → Require sign-in**.
    2. Choose **FormFlows.ai account** or **SSO / SAML** (SSO is available on the Business plan and above).
    3. If you choose SSO, select the identity provider configured in **Workspace settings → SSO**.

    Respondents who are not signed in will see your form's branding and a prompt to log in before the form fields appear.

    ***

    ### One submission per person

    Limit each authenticated user to a single response. This is enforced by their FormFlows.ai account identity, so it requires **Require sign-in** to be enabled.

    Toggle on **Limit to one submission per person** under **Form settings → Access**. If someone tries to submit a second time, they will see a message telling them they have already responded, with an option to edit their existing submission if you have enabled editing.

    ***

    ### IP allowlist

    Restrict form access to specific IP addresses or CIDR ranges — useful for internal forms that should only be accessible from your office network or VPN.

    1. Go to **Form settings → Access → IP allowlist**.
    2. Enter one IP address or CIDR range per line (for example, `203.0.113.0/24`).
    3. Click **Save**.

    Visitors whose IP address is not on the list will see a "This form is not available" message and will not be able to view or submit the form.

    <Info>
      IP allowlists apply to the public-facing form URL. They do not affect team members viewing submissions in the dashboard — dashboard access is controlled by workspace roles.
    </Info>

    ***

    ### Password protection

    Require a password to view the form. See [Share links → Password protection](/guides/share-links#password-protection) for setup instructions. Password protection and sign-in requirements can be combined — the visitor must enter the password first, then sign in.
  </Tab>

  <Tab title="Submission limits">
    ### Limit total submissions

    Stop accepting new submissions once a target number is reached — useful for capacity-limited events, giveaways, or research studies with a fixed sample size.

    1. Go to **Form settings → Access → Submission limit**.
    2. Enter the maximum number of submissions you want to accept.
    3. Optionally, enter a custom message to display when the limit is reached.

    Once the limit is hit, the form closes automatically. Existing submissions are not affected.

    ***

    ### Close date

    Set a date and time after which new submissions are no longer accepted. The form page remains accessible so visitors can see that it has closed, but the fields are replaced with your custom closed message.

    See [Share links → Expiring links](/guides/share-links#expiring-links-close-date) for setup instructions.

    ***

    ### Combining limits

    You can use a submission limit and a close date together. The form closes as soon as either condition is met — whichever comes first.

    | Condition        | Behavior when triggered                          |
    | ---------------- | ------------------------------------------------ |
    | Submission limit | Form closes; displays "limit reached" message.   |
    | Close date       | Form closes; displays "form is closed" message.  |
    | Both set         | Form closes on whichever condition is met first. |
  </Tab>
</Tabs>

***

## Team access

<Tabs>
  <Tab title="Workspace roles">
    Every member of your FormFlows.ai workspace is assigned a role that controls what they can do across all forms in the workspace. The available roles are:

    | Role       | Description                                                                                                                                                  |
    | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
    | **Owner**  | Full control over the workspace: billing, SSO, domain settings, member management, and all forms. There is exactly one owner per workspace.                  |
    | **Admin**  | Can manage members and roles, configure workspace settings, and perform all form operations including deletion. Cannot change billing or transfer ownership. |
    | **Editor** | Can create, edit, and publish forms. Can view and export submissions for forms they have access to. Cannot delete forms or manage members.                   |
    | **Viewer** | Read-only access. Can view forms and submissions but cannot make any changes or export data.                                                                 |

    To change a member's role, go to **Settings → Members**, find the member, and select a new role from the dropdown. Changes take effect immediately.

    <Note>
      Workspace roles apply to all forms in the workspace by default. You can narrow access further using form-level overrides (see the next tab).
    </Note>
  </Tab>

  <Tab title="Form-level overrides">
    If you need finer control — for example, letting a contractor edit one specific form without seeing others — you can set per-form access that overrides the workspace default.

    ### Grant access to a specific form

    1. Open the form and click **Settings → Team access**.
    2. Click **Add member**.
    3. Search for the workspace member by name or email.
    4. Choose their role for this form: **Editor** or **Viewer**.
    5. Click **Save**.

    Members added at the form level only see that form in their forms list. They cannot see other forms in the workspace unless they have a workspace role that grants broader access.

    ### Restrict a higher-level role

    You can also use form-level overrides to restrict a member who has an Admin or Editor workspace role from accessing a specific sensitive form:

    1. Open the form and click **Settings → Team access**.
    2. Toggle on **Restrict access to listed members only**.
    3. Add the members who should retain access and assign their roles.

    Anyone not on the list — regardless of their workspace role — will not be able to open the form.

    <Warning>
      Workspace Owners and Admins can always remove form-level restrictions. If you are managing sensitive data, ensure your admin group is limited to trusted team members.
    </Warning>

    ### Permission summary

    The table below shows the effective permissions for each role at both workspace and form levels. Form-level roles take precedence where set.

    | Permission                   | Owner | Admin | Editor | Viewer |
    | ---------------------------- | :---: | :---: | :----: | :----: |
    | View forms                   |   ✓   |   ✓   |    ✓   |    ✓   |
    | Create forms                 |   ✓   |   ✓   |    ✓   |    —   |
    | Edit and publish forms       |   ✓   |   ✓   |    ✓   |    —   |
    | Delete forms                 |   ✓   |   ✓   |    —   |    —   |
    | View submissions             |   ✓   |   ✓   |    ✓   |    ✓   |
    | Export submissions           |   ✓   |   ✓   |    ✓   |    —   |
    | Delete submissions           |   ✓   |   ✓   |    —   |    —   |
    | Manage form-level access     |   ✓   |   ✓   |    —   |    —   |
    | Manage workspace members     |   ✓   |   ✓   |    —   |    —   |
    | Configure workspace settings |   ✓   |   ✓   |    —   |    —   |
    | Manage billing               |   ✓   |   —   |    —   |    —   |
    | Transfer ownership           |   ✓   |   —   |    —   |    —   |
  </Tab>
</Tabs>

***

## Workspace defaults vs. form-level overrides

FormFlows.ai applies access settings in the following order — more specific settings always win:

1. **Workspace role** — applies to all forms unless overridden.
2. **Form-level override** — applies to a specific form, overrides the workspace role for that form.
3. **Submission restrictions** — applies to external respondents (not workspace members).

<Accordion title="Example: restricting a contractor to one form">
  Your workspace has 10 forms. You hire a contractor to help with one specific registration form. You want them to be able to edit that form but not see anything else.

  1. Invite the contractor to your workspace. Assign them the **Viewer** workspace role so they have minimal default access.
  2. Open the registration form → **Settings → Team access → Add member**.
  3. Add the contractor and set their form-level role to **Editor**.

  The contractor can now edit and publish the registration form. They will see other forms listed but cannot open or modify them, because their workspace role is Viewer and no form-level override grants them access elsewhere.
</Accordion>

<Accordion title="Example: internal-only form for HR">
  You want an employee survey to be accessible only to HR team members, not the broader company.

  1. Create the form and go to **Form settings → Team access**.
  2. Toggle on **Restrict access to listed members only**.
  3. Add each HR team member with the **Viewer** or **Editor** role as appropriate.
  4. Under **Form settings → Access → Submission restrictions**, enable **Require sign-in** and **One submission per person**.

  Now only signed-in HR members can see submissions in the dashboard, and only authenticated employees can fill in the form.
</Accordion>

***

## What's next

<CardGroup cols={2}>
  <Card title="Share links" icon="link" href="/guides/share-links">
    Share your form via a direct URL, QR code, or email with optional password protection.
  </Card>

  <Card title="Embed a form" icon="window-restore" href="/guides/embed">
    Add your form to any webpage using an iframe or JavaScript snippet.
  </Card>
</CardGroup>