Double opt-in

Forms has two kinds of double opt-in, which you can combine.

Contacts

When a form adds submitters to your contacts, contacts.double_opt_in decides whether a new (or unsubscribed) contact must confirm before they are subscribed. null (the default) follows the environment's marketing settings (double_opt_in_default). A confirming contact is pending and gets your confirmation email, the same as contacts you add with the API: so the marketing settings need a confirmation_from sender first (saving the form checks). Without double opt-in, a new contact is subscribed and an existing one keeps their status.

The submission itself is delivered at once (webhooks, notifications); only the contact waits.

The whole submission

submitter.verify holds every submission until the submitter clicks the link coss.com emails them. Until then it is pending_confirmation: no webhook, no notification, no contact.

await coss.forms.create({
  name: "Beta access",
  submitter: { verify: true, confirmation_from: "beta@example.com" },
  redirect_url: "https://www.example.com/beta/confirmed",
});

• The form needs the submitter's address (submitter.email_field): a submission without one is refused.
• The email comes from submitter.confirmation_from, which in live environments must be on one of your verified domains: never from coss.com's address.
• The link (…/f/c/<token>) works for 7 days. Opening it shows a button; confirming sends the submission on (form.submission.received) and redirects to redirect_url if the form has one.
• Each address gets at most 3 verification emails a day across all of coss.com, and each organization 1,000. A submission never confirmed is deleted after 14 days.

The submitter is told "Check your email" whatever happens to their submission, spam included.