logo
PagesLinks•

Pre-redirection form reference: fields, plans, and cookies

Plans per capability, UI labels and API fields, visitor cookies, what the modal shows, field types and limits, validation messages, and what is.

Avatar for undefined
CodeQR Team
Content Team

Use this page to look up a plan, a field, a cookie or a limit of the Pre-redirection form. Steps are in the how-to guides; the reasoning behind a lead's route is in Where your leads go.

Availability by plan

  • Pre-redirection form (toggle, API fields) — Plan: Business and above; switching it on from Free, Starter or Pro is refused (403)
  • Where it can be enabled — Plan: any short link; dynamic QR codes of every type; not static QR codes
  • Form responses in Responses, CSV export, email notification — Plan: any plan that has the form
  • Customers records** — Plan: Business and above
  • Lead events in Events and Analytics, lead.created webhooks — Plan: page Conversion tracking on (Pro and above); webhooks Pro and above
  • CRM connectors (RD Station, Kommo, HubSpot, Google Sheets) — Plan: Starter and above
  • Pages per workspace — Plan: Free 1 · Starter 5 · Pro 20 · Business 100 · Scale 500 · Enterprise unlimited
  • "Powered by CodeQR" on the form — Plan: Free workspaces only

UI label to API field

  • Pre-redirection form toggle** — API field: preRedirection · Values: true / false (default)
  • Use platform form → Select Page — API field: pageId + pageUrl · Values: page id + https://<page domain>/<page key>
  • Use external form field** — API field: pageUrl (with pageId: null) · Values: any http(s) URL
  • Mandatory Forms? — API field: isFormMandatory · Values: true / false (default); needs pageId

The four fields exist on links and QR codes and appear in every API response and webhook payload for them. Details and errors: Set up pre-redirection forms with the API and automations.

What the visitor gets

  • Person, no skipForm cookie — Response: 200, the form page (x-pathname: /<domain>/pre-redirection/<key>/link or /qrcode); the click or scan is recorded now
  • Person with skipForm cookie, or ?skipForm= in the URL — Response: 302 to the destination (Smart Rules and targeting applied)
  • Bot, crawler, link preview (WhatsApp, Slack, Facebook, Google) — Response: 302 to the destination, no form
  • WhatsApp QR code after the form — Response: 302 to https://wa.me/<number>?text=<message>

The modal shows the destination's title, description and image (from its Open Graph tags) in the header, and the destination page blurred behind — so the destination is loaded in the visitor's browser before the form is submitted.

Visitor cookies

  • cq_id — Set when: first visit to the link or QR code · Value: click id · Path: /<key> · Lifetime: 1 hour; 30 days when the link has Conversion tracking on
  • skipForm — Set when: after submit or skip · Value: FORM_FILLED or CONTINUED_WITHOUT_FORM · Path: /<key> · Lifetime: 1 hour

Both cookies are set by the server (Set-Cookie), so Safari's 7-day cap on script-written cookies does not shorten them. A private window has no cookies — the form shows again. The UTM values saved with a response are read from the address bar of the form page at submit time, not from a cookie.

Form (CodeQR Page)

  • Page types with a form — Contact Form, Feedback, Newsletter Subscription, Digital Business Card (and the types marked Coming Soon when released)
  • Field types — Text, Email, Number, Phone, Date, Time, Selection, Multiple choice, Checkboxes, Textarea, Rating, Hidden
  • Per-field options — label, placeholder, description, required, default value, prefill parameter, step (1–4), validation (min/max length, min/max, preset pattern email · phone · URL · digits · CPF, custom pattern, error message)
  • Limits per submission — 100 fields · 5,000 characters per value · 100 KB in total · UTM values cut at 500 characters · 4 steps
  • Consent — always required: consent text (default or yours) + optional Privacy policy URL; the button stays disabled until ticked; consentAt and the consent text are stored with the response
  • Anti-spam — hidden honeypot field; 10 submissions per minute per IP and page (Too many submissions. Please try again in a moment.); server-side re-validation of every field
  • Notification — Email me new leads → workspace owners; subject New lead on <page title>
  • Language — the form renders in the page's language; the modal frame (report abuse, terms) is in Portuguese today

Where the response is stored

FormResponse: page, click id, name, email, message, rating, consentAt, consentText, one row per custom field (by field id), duration, utm_* of the short link. No IP address is stored. Export: Responses → Export CSV (createdAt, name, email, message, rating, completed, duration, consentAt, <custom labels>, utm_*).

Validation messages

App: Note: For external forms, mandatory forms cannot be guaranteed, as the user can close the modal at any time. (under the external URL field) · Pre-redirection pages are only available for dynamic QR codes (disabled toggle on a static QR code) · Business badge on the toggle below the Business plan.

API (400 unprocessable_entity): Pre-redirection page URL missing · Invalid pre-redirection page URL · CodeQR page required for form submission. 404 not_found: Page not found. 403 forbidden: You can only use pre-redirection on a Business plan and above. Upgrade to Business to use this feature.

Order of operations on a visit

  1. Banned link, password, expiration and preview handling.
  2. Pre-redirection form: shown when preRedirection is on, pageUrl is set, the visitor is not a bot and has no skipForm cookie. The click or scan is recorded here.
  3. After the form (or on the second pass): Link Cloaking, Smart Rules, iOS/Android/Geographic Targeting, then the Destination URL. Query parameters of the first visit are not forwarded.

Not supported today

  • MCP server tools (no form fields); Zapier, Make and Pluga modules (no form fields) — use the API.
  • Mandatory external forms; receiving external form answers in CodeQR.
  • Forwarding the short link's query parameters to the destination after the form.
  • Static QR codes (the API accepts the fields but the form never shows).
  • A per-plan limit on the number of leads: none — but the page limit per plan applies.

Related articles