Astro

For a signup form anyone can fill in, use a Wakio subscribe form. It works on a fully static site with no server, it emails each new subscriber to confirm their address before they join your list, and it limits how many signups one visitor can send. Add it with one script tag.

Adding contacts from your own server code

When your Astro site has a server adapter and its own accounts, you can add a contact from server code, for example when someone signs up for an account and ticks a box to get your newsletter.

npm install wakio

Declare the key in astro.config.mjs, so it is read on the server at request time and never written into your build:

import { defineConfig, envField } from "astro/config"

export default defineConfig({
  env: { schema: { WAKIO_API_KEY: envField.string({ context: "server", access: "secret" }) } },
})

// src/pages/api/account.ts
import type { APIRoute } from "astro"
import { getSecret } from "astro:env/server"
import { Wakio } from "wakio"

export const prerender = false

export const POST: APIRoute = async ({ locals, request, clientAddress }) => {
  const user = locals.user
  if (!user) return new Response(null, { status: 401 })

  const wakio = new Wakio({ apiKey: getSecret("WAKIO_API_KEY") })
  const form = await request.formData()
  const agreed = form.get("newsletter") === "on"
  await wakio.contacts.create({
    email: user.email,
    source: "account-signup",
    ...(agreed && { subscribed: true, consentedAt: new Date(), consentIp: clientAddress }),
  })
  return new Response(null, { status: 303, headers: { Location: "/account" } })
}

The client is created inside the handler, so the key is read for each request; some adapters, such as Cloudflare's, only provide secrets while a request is running. consentedAt and consentIp go only with subscribed: true; sent without it, the request is refused. subscribed: true records that this person agreed to your emails, with when and where they agreed. Here that is safe because the address is the signed-in user's own, and the box is one they ticked. Do not post subscribed: true from a public form: anyone could add someone else's address to your list, with a consent record saying they agreed.

For the full client, see Node.js.

Astro

A newsletter signup

Adding contacts from your own server code