Hosting on Sliick Edge

Sliick Edge is our hosted option for public forms: connect your org once, and you get a public address of your own to serve forms from, with no Experience Cloud site required.

It sits alongside Experience Cloud rather than replacing it, and a form behind portal login still needs Experience Cloud, because Sliick Edge does not authenticate anyone.

A submission on a Sliick Edge address is verified and relayed through hosting infrastructure we operate on Cloudflare, then written to your org as a staged submission, the same as any other placement. Nothing about how a submission is processed once it reaches Salesforce changes: it still stages first, and you still review and process it from the responses console.

Connect your org

Connecting is a one-time job for a Salesforce admin, and three of its four steps happen in Setup before you touch the dashboard. Each one is a place connections go wrong.

1. Create a dedicated integration user. Setup, Users, New User, on the Minimum Access - Salesforce profile. Give it a mailbox nobody reads and a name that says what it is, such as forms-integration@yourcompany.com.

Sliick Edge signs in as this user to receive your credentials and to rotate them later. Point it at a person’s login and the connection dies when that person leaves, changes their password, or is deactivated, and everything that person can see becomes part of what the connection can reach.

2. Assign the Sliick Forms Integration permission set to that user. Setup, Permission Sets, Sliick Forms Integration, Manage Assignments. Assign the packaged set itself and do not clone it: an upgrade updates the packaged set in place and can never add a new grant to a copy you own, so a clone quietly falls behind and fails months later. The set grants no access to responses.

3. Pre-authorise that user on the packaged integration app. In Setup, open the packaged app named Sliick Forms Integration, open its Policies, and click Edit:

• Set Permitted Users to Admin approved users are pre-authorized.
• Pre-authorise the integration user’s own profile, or a permission set that user holds. Pre-authorise the profile the integration user actually holds, which for a properly set up user is Minimum Access, not an admin profile.
• Enable the sign-in flow the connection uses, and name the integration user as its subject.

This step cannot ship inside the package, because the policy names a user that exists only in your org. Every org starts with the policy set to let users authorise themselves, which refuses the sign-in, so connecting fails until you change it. If the connection is refused, the message names this screen.

4. Connect. Open the Admin Dashboard’s Delivery panel, open the Sliick Edge tab, and click Connect.

• Integration username: the user from step 1. If you have not made one yet, the panel offers your own login as a one-click shortcut so you can finish connecting now. Swap in a dedicated user afterwards, because the shortcut stops working the day your own account is deactivated.
• Preferred address: already filled in with your Salesforce My Domain name, which is globally unique and so always available. Leave it as it is unless you want a different one: a name you type can be refused, the default cannot. If the address you asked for is not available you get a short message and two or three alternatives. Nothing is created on a refused request, so picking another and connecting again is clean.

Your address appears in the panel once it arrives. It can take a moment longer than the click, and Check again re-reads it.

Disconnecting, and sandboxes

Disconnecting releases your address and clears the stored credentials. Your address is not given to anyone else afterwards, because links and printed QR codes pointing at it must never resolve to another company’s forms.

A refreshed sandbox has to connect again. A refreshed sandbox is a new org, and a copy can bring production’s credentials with it. Sliick Forms notices that the stored credentials belong to a different org, refuses to use them, clears them, and offers Connect again, so a sandbox can never serve forms as though it were production. There is nothing to remember: you will simply be asked.

Turn a form on, one form at a time

Connecting the org does not make anything public by itself. Each form needs Allow on your public Sliick Edge address ticked, either in Form settings, Availability, or right in the Before you publish dialog on an org that has connected Sliick Edge. The line under the tick names the exact address it would produce, so you can see what you are agreeing to before you agree to it.

• Off is the default, and stays the default. A new form is off. A duplicated form is off, even if the source was on. A form created by blueprint import is off, and re-importing over an existing form never changes its setting either way: this tick is about your org’s address, not something a blueprint carries.
• Turning it off works immediately. Untick it and the public address stops serving that form; any link or printed QR code aimed at it stops resolving. With the tick off, the public address answers “no such form” rather than closed, empty, or anything that would confirm the form exists.
• Publishing tells you whether the update actually landed. The Delivery panel’s Edge cache refresh row reports whether your public forms picked up your last publish, so a failed refresh is visible rather than silent.

Bot protection is automatic

Every submission through your Sliick Edge address is checked with Cloudflare Turnstile before it is accepted, on top of the hidden-field trap that already protects public forms everywhere.

There is nothing to configure: the check runs fleet-wide, and it fails closed, meaning a submission is refused rather than let through if the check itself cannot be completed.

Embed a form on your own site

Once a form is eligible, its Share tab offers a ready-made <iframe> embed snippet, and tells you exactly what is missing when it is not eligible yet, whether that is being off the edge address, having nobody on the embed allowlist, or a Stripe payment field, which does not work embedded. See Embedding a form on your own site.

Experiments take effect immediately

Starting or stopping an A/B experiment reaches an edge-served form straight away, rather than waiting for your next publish. See Versions and A/B experiments.

Checking a form is being served

The builder’s Share panel can ask your public address directly whether a form is warmed and ready, on demand. It also tells you when a form is deliberately not being served because Allow on your public Sliick Edge address is unticked.