Claiming and the sandbox

kibble init needs no account, so an agent can go from a prompt to a tested form on localhost without a human. The trade-off is that anonymous projects must not collect real people's data. Unclaimed projects therefore run in a sandbox.

#Sandbox rules

• Submissions are accepted only from localhost origins (localhost, 127.0.0.1, *.localhost, any port). A public origin gets HTTP 403 with code project_unclaimed and the claim link in the hint.
• Requests made with the project's secret key (the CLI, server code) are accepted without an origin check, because they are the owner's own test traffic.
• Sandbox data expires after 72 hours. Read it with kibble submissions.
• No emails or webhooks are sent from a sandbox project.
• kibble status and kibble push warn; kibble check fails a production build.

#Claiming

The claim link looks like https://kibbleforms.com/claim/<token>. A human opens it, signs in with Google, GitHub or a code sent to their email, picks or creates a workspace, accepts the terms, and enters the production domains (one per line; example.com, https://app.example.com, or *.example.com). The project becomes live and starts accepting submissions from those origins. The secret key does not change.

Claiming gives every live form an identified owner who has accepted the terms, which matters under GDPR and for abuse response.

#Content Security Policy

Sites with a CSP must list the API in connect-src: https://api.kibbleforms.com in production and your local API URL in development. Without it the browser refuses the request before it reaches Kibble.

#Connecting a site created in the dashboard

A site can also start in the dashboard (sign up at kibbleforms.com/signup): New form creates the site (already yours, no claim step) and a draft form. The draft's page has Copy prompt: it holds a one-time setup command for the coding agent,

npx kibbleforms init --link kbl_XXXXX-XXXXX-XXXXX-XXXXX

which writes kibble.json and .kibble/secret for that site and lists the drafts waiting for their files. The agent then writes kibble/forms/<slug>.ts; the first registration turns the draft into a live form and keeps the notifications and triage settings you already set up. Codes work once and expire after 24 hours; copy the prompt again for a new one. To move a site to another repo, open the site under Sites and use Reconnect with a new key (the old repo's key stops working).

#After claiming

• Add more domains any time: npx kibble domains add acme.com (or the site's page under Sites in the dashboard); acme.com also covers www.acme.com, and the other way round. Domains belong to the site, not to a form. Localhost keeps working on a live site; those responses are stored as test.
• The person who claims the site (or creates it in the dashboard) gets email notifications on every form, including forms added later, unless a form already has a destination. Add teammates to the workspace to notify them too (email goes to members only), or use Slack for shared channels.
• kibble status shows live and kibble check passes.