Pre-redirection form reference: fields, plans, and cookies
Plans per capability, UI labels and API fields, visitor cookies, field types and limits, validation messages, and what is not supported.
Use this page to look up a plan, a field, a cookie or a limit of the Pre-redirection form. Steps are in the how-to guides; the reasoning behind a lead's route is in Where your leads go.
Availability by plan
| Capability | Plan |
|---|---|
Pre-redirection form (toggle, API fields) | Business and above. Below that the toggle is disabled and turning it on through the API is refused (403). A form saved on Business keeps working after a downgrade; it can be turned off, but not back on |
Where it can be enabled | any short link; dynamic QR codes of every type; not static QR codes |
Form responses in Responses, CSV export, email notification | any plan that has the form |
Customers records | Business and above |
Lead events in Events and Analytics, lead.created webhooks | page Conversion tracking on (Pro and above); webhooks Pro and above |
CRM connectors (RD Station, Kommo, HubSpot, Google Sheets) | Starter and above |
Pages per workspace | Free 1 · Starter 5 · Pro 20 · Business 100 · Scale 500 · Enterprise unlimited |
"Powered by CodeQR" on the form | Free workspaces only |
UI label to API field
| In the app | API field | Values |
|---|---|---|
Pre-redirection form toggle | preRedirection | true / false (default) |
Use platform form → Select Page | pageId + pageUrl | page id + https://<page domain>/<page key> |
Use external form field | pageUrl (with pageId: null) | any http(s) URL |
Mandatory Forms? | isFormMandatory | true / false (default); needs pageId |
The four fields exist on links and QR codes and appear in every API response and webhook payload for them. Details and errors: Set up pre-redirection forms with the API and automations.
What the visitor gets
| Situation | Response |
|---|---|
Person, no skipForm cookie | 200, the form page (x-pathname: /<domain>/pre-redirection/<key>/link or /qrcode); the click or scan is recorded now |
Person with skipForm cookie, or ?skipForm= in the URL | 302 to the destination (Smart Rules and targeting applied) |
Bot, crawler, link preview (WhatsApp, Slack, Facebook, Google) | 302 to the destination, no form |
WhatsApp QR code after the form | 302 to https://wa.me/<number>?text=<message> |
The modal shows the destination's title, description and image (from its Open Graph tags) in the header, and the destination page blurred behind, so the destination is loaded in the visitor's browser before the form is submitted.
Visitor cookies
| Cookie | Set when | Value | Path | Lifetime |
|---|---|---|---|---|
cq_id | first visit to the link or QR code | click id | /<key> | 1 hour; 30 days when the link has Conversion tracking on |
skipForm | after submit or skip | FORM_FILLED or CONTINUED_WITHOUT_FORM | /<key> | 1 hour |
Both cookies are set by the server (Set-Cookie), so Safari's 7-day cap on script-written cookies does not shorten them. A private window has no cookies, so the form shows again. The UTM values saved with a response are read from the address bar of the form page at submit time, not from a cookie.
Form (CodeQR Page)
Page types with a form | Contact Form, Feedback, Newsletter Subscription, Survey/Questionnaire, Digital Business Card (and the types marked Coming Soon when released) |
Field types | Text, Email, Number, Phone, Date, Time, Dropdown, Multiple choice, Checkboxes, Long text, Rating, Scale, Hidden |
Per-field options | label, placeholder, description, required, default value, prefill parameter, step (1 to 4), validation (min/max length, min/max, preset pattern email · phone · URL · digits · CPF, custom pattern, error message) |
Limits per submission | 100 fields · 5,000 characters per value · 100 KB in total · UTM values cut at 500 characters · 4 steps |
Consent | consent text (default or yours) + optional Privacy policy URL. Require a consent checkbox is on by default; Survey/Questionnaire pages start with it off. On: the button stays disabled until ticked, and consentAt and the consent text are stored with the response. Off: the text and the policy link show as a notice next to the button, the consent text is stored and consentAt stays empty |
Anti-spam | hidden honeypot field; 10 submissions per minute per IP and page (Too many submissions. Please try again in a moment.); server-side re-validation of every field |
Notification | Email me new leads → workspace owners; subject New lead on <page title> |
Language | your own texts appear as you wrote them; the texts CodeQR supplies (default consent text, I have read and agree, warnings, default error messages, the last line of the modal) follow the visitor's language, with a language menu on the form |
Where the response is stored
FormResponse: page, click id, name, email, message, rating, consentAt (empty when the page shows a notice instead of the checkbox), consentText, one row per custom field (by field id), duration, utm_* of the short link. No IP address is stored. Export: Responses → Export CSV (createdAt, name, email, message, rating, completed, duration, consentAt, <custom labels>, utm_*).
Validation messages
App: Note: For external forms, mandatory forms cannot be guaranteed, as the user can close the modal at any time. (under the external URL field) · You can only enable pre-redirection forms on Business plans and above. (tooltip of the disabled toggle below Business, next to the Business badge) · Pre-redirection pages are only available for dynamic QR codes (tooltip of the disabled toggle on a static QR code).
Visitor: This page is not published, so it cannot receive submissions right now. (submission on a page unpublished after the form opened).
API (400 unprocessable_entity): Pre-redirection page URL missing · Invalid pre-redirection page URL · CodeQR page required for form submission · Pre-redirection forms only work on dynamic QR codes. Send "preRedirection": false or "static": false. 404 not_found: Page not found. 403 forbidden: You can only use pre-redirection on a Business plan and above. Upgrade to Business to use this feature.
Order of operations on a visit
- Banned link, password, expiration and preview handling.
- Pre-redirection form: shown when
preRedirectionis on,pageUrlis set, the page (for a CodeQR Page form) is published, the visitor is not a bot and has noskipFormcookie. The click or scan is recorded here. - After the form (or on the second pass): Link Cloaking, Smart Rules, iOS/Android/Geographic Targeting, then the Destination URL. The query string of the first visit is added to the destination URL; a WhatsApp QR code opens
wa.mewithout it.
Not supported today
- MCP server tools and the Zapier, Make and Pluga modules have no form fields. Use the API.
- Mandatory external forms; receiving external form answers in CodeQR.
- Static QR codes (the API refuses the combination).
- A per-plan limit on the number of leads. The limit on pages per plan still applies.