Handlers, forms & webhooks

A page can do more than render — it can run logic. A page handler is server-side code attached to a page that runs when the page is requested or submitted to. This is how a site processes forms, exposes JSON endpoints, receives webhooks, and talks to external services — with no separate backend to stand up.

What handlers are for

• Load data for a page — fetch records, compute values, and pass them to the template before it renders.
• Handle form submissions — validate input, store it, send an email, and show a result.
• Expose JSON endpoints — return data for a front-end app or an integration to consume.
• Receive webhooks — accept inbound calls from third-party services and verify their signatures.
• Call external APIs — reach out to other services and use the response.

A handler decides what the response is: render the page, redirect, return JSON, set a status code, or send custom headers.

Forms

Forms are first-class. A handler receives the submitted fields, and the platform protects form endpoints from spam and abuse automatically, so you don't wire that up yourself. That protection includes an AI check on submissions from visitors who aren't logged in; you can turn it off in the website's settings in the app, or with acira settings set aispam off, and a basic robot blocker still applies. Handlers can also accept file uploads (up to 100 MB), which flow into your logic and can be stored as database attachments.

Webhooks and integrations

Handlers can receive inbound webhooks and make outbound requests, so a site can integrate with payment processors, CRMs, automation tools, and anything else with an API. Standard cryptographic primitives are available for verifying webhook signatures and signing outbound requests.

Site search

A handler can search everything you publish and use what it finds — to power a search box for visitors, or to give an AI chatbot the passages it answers from. The search covers the site's public pages in the visitor's language, matching each page's own content rather than the header, navigation and footer every page shares, so content records you author in your database that appear on a page are found through that page. Results come back ranked, each with a highlighted excerpt, a plain-text passage and a link.

Pages behind a login, pages whose content changes per visitor, and pages that show data visitors create — form submissions, reviews, sign-ups, orders — or data loaded from another service aren't included. To search that data, query the records in its table directly with the database search instead. Results reflect your latest publish within seconds, and search is available on every plan.

Built-in protections

Handlers run with sensible guardrails so a busy or misbehaving page can't take a site down:

• Rate limiting per visitor, so endpoints can't be hammered.
• Caching for pages whose output doesn't change on every request, with automatic invalidation when the underlying data changes. A page whose logic varies per visitor — reading the session, the visitor's address, or the requested path — is rendered fresh each time instead.
• Logs you can read from the app or with acira logs to debug what happened — including mistakes your own code caught, which are still recorded and can be repaired automatically.

Secrets

Handlers read configuration and secrets (API keys, tokens) from the site's environment rather than hard-coding them, so credentials stay out of your templates and out of version control.

Visitor data

A handler can read the visitor's IP address (request.ip) — useful for geo-aware logic, fraud checks, or an audit trail. The platform itself never stores it: form submissions record a visitor's origin at country and region level only, and analytics use a pseudonymous identifier that rotates daily. So if you write request.ip into a database record, that is your site collecting personal data — disclose it in your privacy policy and decide how long you keep it. You don't need it for abuse control: per-visitor rate limiting is built in and requires no address of your own.