# Svelte and SvelteKit

> A Svelte 5 component that posts from the browser, and a SvelteKit form action that posts with a secret key.

## Svelte component

Install the SDK with `npm install @ikiform/sdk`, then post the form from the browser:

`ContactForm.svelte`:

```svelte
<script>
  import { submit } from "@ikiform/sdk";

  let status = $state("idle");
  let errors = $state({});
  let message = $state("");

  async function onsubmit(event) {
    event.preventDefault();
    status = "sending";
    const result = await submit("frm_xxxxxxxxxxxxxxxx", new FormData(event.currentTarget));
    if (result.ok) {
      status = "sent";
      return;
    }
    errors = result.error.fields ?? {};
    message = result.error.message;
    status = "error";
  }
</script>

{#if status === "sent"}
  <p>Thanks, we got it.</p>
{:else}
  <form {onsubmit}>
    <label>
      Email
      <input name="email" type="email" required />
    </label>
    {#if errors.email}<p>{errors.email[0]}</p>{/if}
    <label>
      Message
      <textarea name="message"></textarea>
    </label>
    <input name="_gotcha" type="text" tabindex="-1" autocomplete="off" hidden />
    {#if status === "error" && !errors.email}<p role="alert">{message}</p>{/if}
    <button disabled={status === "sending"}>Send</button>
  </form>
{/if}
```

## SvelteKit form action

A form action works without JavaScript and is enhanced when it loads. The action posts to Ikiform with a secret key stored as `IKIFORM_SECRET_KEY`.

`src/routes/contact/+page.server.js`:

```js
import { env } from "$env/dynamic/private";
import { fail } from "@sveltejs/kit";

export const actions = {
  default: async ({ request }) => {
    const data = await request.formData();
    const body = new URLSearchParams();
    for (const [name, value] of data) if (typeof value === "string") body.append(name, value);
    const response = await fetch("https://ikiform.com/f/frm_xxxxxxxxxxxxxxxx", {
      method: "POST",
      headers: { Accept: "application/json", Authorization: `Bearer ${env.IKIFORM_SECRET_KEY}` },
      body,
    });
    const result = await response.json();
    if (!result.ok) return fail(response.status, { message: result.error.message, fields: result.error.fields ?? {} });
    return { sent: true };
  },
};
```

`src/routes/contact/+page.svelte`:

```svelte
<script>
  import { enhance } from "$app/forms";

  let { form } = $props();
</script>

{#if form?.sent}
  <p>Thanks, we got it.</p>
{:else}
  <form method="POST" use:enhance>
    <label>
      Email
      <input name="email" type="email" required />
    </label>
    {#if form?.fields?.email}<p>{form.fields.email[0]}</p>{/if}
    <label>
      Message
      <textarea name="message"></textarea>
    </label>
    {#if form?.message && !form?.fields?.email}<p role="alert">{form.message}</p>{/if}
    <button>Send</button>
  </form>
{/if}
```

> Posts sent from your server all come from your server's IP address, so Ikiform's per-visitor rate limits count every visitor together. The Standard preset allows 5 posts a minute per IP and form, which a busy site can hit. Post from the browser when you can, or choose the Relaxed or Custom [rate limit](https://ikiform.com/docs/rate-limits.md) for forms you proxy through a server.