Handlers, forms & webhooks

A page can do more than render — it can run logic. A page handler is server-side code attached to a page that runs when the page is requested or submitted to. This is how a site processes forms, exposes JSON endpoints, receives webhooks, and talks to external services — with no separate backend to stand up.

What handlers are for

• Load data for a page — fetch records, compute values, and pass them to the template before it renders.
• Handle form submissions — validate input, store it, send an email, and show a result.
• Expose JSON endpoints — return data for a front-end app or an integration to consume.
• Receive webhooks — accept inbound calls from third-party services and verify their signatures.
• Call external APIs — reach out to other services and use the response.

A handler decides what the response is: render the page, redirect, return JSON, set a status code, or send custom headers.

Forms

Forms are first-class. A handler receives the submitted fields, and the platform protects form endpoints from spam and abuse automatically, so you don't wire that up yourself. Handlers can also accept file uploads (up to 100 MB), which flow into your logic and can be stored as database attachments.

Webhooks and integrations

Handlers can receive inbound webhooks and make outbound requests, so a site can integrate with payment processors, CRMs, automation tools, and anything else with an API. Standard cryptographic primitives are available for verifying webhook signatures and signing outbound requests.

Built-in protections

Handlers run with sensible guardrails so a busy or misbehaving page can't take a site down:

• Rate limiting per visitor, so endpoints can't be hammered.
• Caching for pages whose output doesn't change on every request, with automatic invalidation when the underlying data changes.
• Logs you can read from the app or with acira logs to debug what happened.

Secrets

Handlers read configuration and secrets (API keys, tokens) from the site's environment rather than hard-coding them, so credentials stay out of your templates and out of version control.