Anticode Open builder

Google Sheets form integration: a row per submission, run by your own script

Anticode doesn't ask for access to your Google account. Instead, its Google Sheets connector posts each submission to a small Apps Script that you deploy from the sheet as a web app, and that script adds the row. You keep full control of the code, the columns and who can open the file.

Updated · By the Anticode team

Why a script instead of signing in with Google

Most Google Sheets form integration tools ask you to approve broad access to your Drive, then hold a token that can read every spreadsheet you own. Anticode takes the narrower route. The script lives inside the one spreadsheet, runs under your account, and can only do what its few lines say. Anticode holds just the web app's address. If you ever want to cut it off, delete the deployment and the address stops working.

The script

The connector shows this script with a Copy the script button. It's short enough to read in full:

  • function doPost(e) {
  • const d = JSON.parse(e.postData.contents);
  • const sheet = SpreadsheetApp.getActiveSpreadsheet().getSheets()[0];
  • sheet.appendRow([d.submittedAt, d.site, d.form, JSON.stringify(d.data)]);
  • return ContentService.createTextOutput("ok");
  • }

doPost runs whenever something sends a POST to the web app, and e.postData.contents is the raw body, as Google's web apps guide describes. The script reads the four values Anticode sends and appends them to the first tab: the time in UTC, the project's name, the form (booking, contact, subscribe, signin, or fn: and the name for a custom form) and the visitor's fields as one JSON string.

Deploy and connect

  1. Open the spreadsheet, then Extensions › Apps Script. Replace the sample code with the copied script and save.
  2. Choose Deploy › New deployment, pick Web app, execute it as yourself and allow anyone to access it. Approve the permission prompt for your account.
  3. Copy the URL ending in /exec.
  4. In Anticode's dashboard open Connectors › Google Sheets, paste it into Web app URL and press Save and turn on.
  5. Press Send a test. A row for a sample contact message from "Anticode test" should appear.

Anticode only accepts addresses of the form https://script.google.com/macros/s/…/exec. The /dev test URL is refused because Google only lets people with edit access use it, so it would never work from a server.

Why the redirect is treated as success

When an Apps Script web app receives a POST, it runs doPost and then answers with a 302 redirect to a separate address where the script's output can be fetched. Many tools treat any redirect as a failure, or follow it and lose the request body. Anticode does neither: it doesn't follow the redirect and counts a 302 from script.google.com as delivered, because by the time that answer arrives the row has already been written. Any other status is reported as a failure, with the code Google returned, which usually points to a deployment that isn't open to anyone or a script error.

Changing what gets written

Because the script is yours, you can change it freely: write to a named tab, add a column per field, or skip test rows. Our guide to sending form submissions to Google Sheets walks through per-field columns and sharing settings. After editing, update the existing deployment with a new version rather than creating a new one, so the URL saved in Anticode keeps working.

Security

  • The URL is a write key. Anyone with it can add rows. Anticode stores it encrypted, bound to your account, and never shows it again or puts it in your pages.
  • The sheet is personal data. Names, emails and phone numbers end up in it. Share the file with named people only, and mention Google Sheets in your privacy policy.
  • No Google credentials at Anticode. Your Google password and tokens never pass through Anticode.

Limits

  • Rows are added, never updated or deleted, and nothing is read back.
  • One sheet connector per account; every published site writes to the same script. Use the site column to tell them apart, or branch inside the script.
  • Each submission is sent once without retries, about a minute after it arrives. If Google is briefly unavailable, that row is missing; the submission is still in your Anticode dashboard.
  • Apps Script has its own daily quotas on Google's side; a busy site should check them.

Questions people ask

Do I need Zapier for Google Sheets?

No. The script receives submissions directly from Anticode.

Can two forms share one sheet?

Yes. Every row records its form, so you can filter or sort by that column.

Can I see the saved web app URL again?

No. It's write-only once saved. Paste it again to replace it.

Sources

  1. Google Apps Script: Web Apps, checked