How to check form input against a FormSync allow list

What can I do with an allow list?

When you set "Allow list matching" on a form field, submissions are rejected if the entered value is not in the registered list. Values in the list go on to be saved.

• Value types are email, phone, name, and text (member ID, invitation code, and so on).
• You can match on a combination of columns (a composite key), such as name and phone number. Composite keys are available on Premium.
• You can create multiple lists and choose which list each field is matched against.

How do I create a list and set it on a form?

1. Create an allow listIn "Allow lists" in the app, choose "Create list". Set the list name, the key setup (single column or composite key), and for each column the column key, display name, and value type. Changing column settings later means you have to import the values again, so decide on them first.
2. Register valuesAdd values one by one with "Add entry", or import them in bulk with a CSV import. Duplicates, including values already registered, are removed automatically.
3. Set matching on the form fieldFor a single-column list, select the field in the "Builder" tab and choose the list under "Allow list matching". For a composite key list, go to "Composite key matching" in the "Data storage" tab and choose the matching field for each column.
4. Check the error messageYou can change the message shown when matching fails for each field. The default message tells the customer that the information they entered is not allowed to register.

What are the rules for importing a CSV?

• The first row is the header. Use column keys or display names.
• You can optionally add columns for expiration date, maximum uses (max_uses), memo, and active flag (active).
• Each file can be up to 20 MB.
• The number of entries you can register is a total across all lists: up to 10,000 on Standard and 100,000 on Premium. A CSV that would go over the limit is rejected before import.
• After import, you see the number of entries imported, the number of duplicates, and any rows that couldn't be imported.

What settings do registered values have?

Active flag

Inactive values don't pass matching.

Expiration date

Values past their expiration date don't pass matching.

Maximum uses

Set how many times a value can be used, for example to make an invitation code single-use.

Memo

Leave a note for your own reference.

You can turn on "Ignore upper and lower case" for each column. Email columns also have "Allow domain matching", which lets email addresses from the same domain pass when you register a value like @example.co.jp. Differences in formatting, such as hyphens or country codes in phone numbers, full-width and half-width characters, and spaces in names, are treated as the same value.

How does matching on multiple fields work?

When you register multiple columns, such as name and phone number, a submission passes only if all values in the same row match. If only one of them matches, it is rejected. When there is no match, the same error is shown on all the fields involved, so no one can guess which field was wrong.

Can I match without showing an input field?

For forms shown after login, you can set "Match the signed-in customer's email against an allow list in the background" in the "Display timing" tab. If you choose a single-column list that has an email column, the app matches without showing an input field to the customer, and customers who aren't in the list don't see the form at all. Each time the form is shown, it uses 1 match.

Where can I see match results?

In "Recent match log" on the allow list details screen, you can see the date and time, the input value (hashed), mode, result, and details. The entered values themselves are not stored, and the match log is deleted automatically after 90 days. The number of rejected matches and the number of matches run are also shown on the dashboard.

After 5 failed matches on the same form, input is blocked for 15 minutes.

FAQ