Choose Private or Public Access for a Workflow Form

What the access setting controls

A workflow with a Manual Start node can be exposed as a form in Applications. RAPTIX creates an opaque, tenant-relative share link in this format:

/f/:token

You choose one of two access modes:

• Private — signed-in members only: only a signed-in member of the same RAPTIX organization can view and submit the form.
• Public — anyone with the link: a visitor can view and submit without a RAPTIX account, subject to anti-bot checks, rate limits, and workflow safety rules.

Private is the default and is the right choice for internal requests, employee operations, and forms containing sensitive business data.

Before you start

• Confirm whether every submitter belongs to your RAPTIX organization.
• Use Private for internal or sensitive intake unless anonymous access is an explicit requirement.
• For a Public form, confirm that the workflow does not contain high-risk anonymous behavior and that Turnstile is configured.
• Prepare a test account in the correct organization and a signed-out browser session.

Configure the form

1. Open the workflow in Flow Builder.
2. Open its Start node and select Trigger Manually.
3. Under Manual form fields, add the values the workflow needs.
4. Give every field a stable Variable name and a clear user-facing label.
5. Configure visibility, required status, options, entity mapping, and document mapping as needed.
6. Enable Expose as app.
7. Under Who can open this form?, choose Private or Public.
8. Optionally configure the app name, logo URL, accent color, success message, redirect URL, and consent checkbox.
9. Select Save Start Properties.

Saving persists the latest Start settings and creates or refreshes the share link. Copy or open the link from the same dialog. Changes to fields or access mode take effect the next time you save.

Private forms

When an unauthenticated visitor opens a private link, RAPTIX sends them to sign in before revealing the form. After a successful sign-in, the visitor returns to the same /f/:token link.

The server also checks organization membership. A signed-in user from another organization cannot use the link.

Test a private form in a signed-out browser session:

1. Open the share link.
2. Confirm that RAPTIX requests sign-in before showing any form fields.
3. Sign in with a member of the correct organization.
4. Submit the form and verify the resulting workflow run.

Public forms

Public links are intended for controlled external intake. A public submission is accepted only when the environment is configured for public forms and the workflow passes the anonymous-use safety checks.

RAPTIX protects public forms with:

• an opaque share token;
• Cloudflare Turnstile verification;
• bot traps and per-IP rate limiting;
• daily submission caps;
• server-side field allowlisting and type coercion; and
• restrictions on high-risk workflow behavior.

A workflow containing a database-query or Python-script node cannot be published publicly. RAPTIX can also reject unsafe email-recipient patterns that let a visitor direct messages to arbitrary addresses. Use a Private form when the workflow requires these capabilities.

Public submissions are disabled if the required anti-bot configuration is unavailable. Do not work around that protection by using an older unauthenticated integration.

Change or revoke access

To switch between Private and Public, change the access mode and select Save Start Properties again. The existing link is refreshed with the new server-side access rule.

To remove access completely, select Revoke link. The old /f/:token URL then becomes unavailable and the workflow no longer appears as a runnable form in Applications.

Important distinction for App Builder pages

The Require Authentication switch used by an Enterprise App Builder integration is separate from the Private/Public setting described here. App Builder integration uses a generated page connector; native workflow forms use /f/:token and fields rendered by the native form UI from a server-provided schema.

For App Builder pages, follow Connect an App Builder Page to a Workflow. For the complete native form flow, see Publish and Run a Workflow Form from Applications.

Troubleshooting

A Private form keeps returning to sign-in.

Confirm that the account belongs to the same RAPTIX organization and that its session is active, then open the current share link again.

A Public form cannot be enabled.

Review the Flow Builder message for a prohibited node or unsafe recipient pattern. If the workflow is eligible, ask the platform operator to verify the public-form and Turnstile configuration.

A revoked link still appears in a bookmark.

Bookmarks are not removed automatically. The server rejects the revoked token; remove the old bookmark and copy a newly generated link only after republishing.