Embedded Lead Forms
Drop a Journeybee lead-capture form onto any website — your marketing site, a partner microsite, a landing page — with one<script> tag. The form renders in
a sandboxed iframe, auto-resizes to its content, and posts submissions straight
into Journeybee.
Prefer to learn from running code? The
Journeybee Embed Examples
repo is a live playground + copy-paste snippets for both lead forms and the
partner portal — clone it,
pnpm install, pnpm dev.Quick start
Add a container element, load the embed script, and initialize your form:window.journeybee(...)
function; calls you make before the SDK finishes downloading are queued and
replayed automatically, so the snippet above works as-is.
Your form UUID comes from the form’s embed settings in Journeybee. It’s a
public value — safe to ship in client-side HTML. The form is resolved by its
UUID alone.
The init call
Options
Styling the form
Pass acustomization object to theme the form. Every value is validated
server-side before it can drive any CSS, so only safe values are accepted:
- Colours must be hex (
#RRGGBB/#RGB),rgb(...), orrgba(...). - Sizes must include units (
px,rem,em,%,vh,vw). - Font families are letters, spaces, commas, and quotes only.
Supported customization
Prefilling fields
Pass aprefill object to pre-populate fields. Standard fields are keyed by
name; custom fields are keyed by their field UUID:
Prefill is applied to standard fields and to text / number custom fields.
Empty values are ignored.
Handling submissions
Use the callbacks to react to submissions — close a modal, redirect, fire analytics, etc.React
Load the loader once, initialize on mount, and tear down on unmount so you never leak a duplicate iframe:Modal pattern
The form mounts into whatever container you give it, so a modal is just a container that appears on demand:Tearing down
Remove a mounted form (e.g. when closing a modal or unmounting a component):destroy then
init again.
Security
- Public by design. Form UUID and company slug are safe in client HTML — the form is a public, unauthenticated landing surface and can be embedded on any origin.
- Customization is sandboxed. Colours, sizes, and fonts are regex-validated server-side; arbitrary CSS cannot be injected.
- Spam protection is built in: a hidden honeypot field and a minimum time-to-submit silently drop automated submissions.