Prefill from your app session

When someone's already signed in, don't make them retype values you know. initialData handles that — it's editable convenience. A signed respondent object is the separate path for identity you can actually trust.

Sign identity on the server

// server-only helper
import { createHmac } from "node:crypto";

export function filloRespondent(user: { id: string; email: string; name: string }) {
  const hash = createHmac("sha256", process.env.FILLO_IDENTITY_SECRET!)
    .update(user.id)
    .digest("hex");

  return { ...user, hash };
}

Pass identity and initial values

"use client";

import { FilloForm } from "@usefillo/react";

export function AccountFeedback({ user, respondent }) {
  return (
    <FilloForm
      formId="account-feedback"
      respondent={respondent}
      initialData={{ email: user.email, account_name: user.accountName }}
    />
  );
}

Generate respondent in a server route or Server Component and pass only the result into the client. The identity secret must never reach browser code.

Know what wins

Explicit initialData and anything the person has already typed win over URL parameters. Saved-progress restore and verified update-in-place can bring back a later snapshot. Treat prefilled visible fields as editable unless your custom UI shows a separate, server-owned account label.

Use the signed respondent ID for identify-based response limits, cross-device draft restore, and trustworthy account attribution. Don't infer identity from a prefilled email field.

Try it

Start with a prompt and your coding agent builds the first form, staged for your review — or open the editor.

Related

• Custom layout example: Compare a default form with an application-owned account surface.
• Respondents and identity: Configure the full server-signed identity contract.
• Save and resume: Restore a verified person's draft across devices.
• Response limits: Keep or update one standing response per account.