Gravity Forms Access Codes & Allowed Lists Setup Guide

The Gravity Forms Access Codes & Allowed Lists add-on checks a form field against a list you keep on your own site. Use it for invitation codes that work once, vouchers and early-bird codes, class or exam access codes, membership or staff numbers, e-mail lists and the postcodes your service covers. The value is checked on your server when the page or the form is sent; a code is used up with one database write when the form is submitted, so a single-use code admits one entry. This guide covers installing the add-on, creating lists, generating and importing codes, the form settings, filling fields from your list, merge tags, managing codes and the most common questions.

What you need

You need Gravity Forms 2.8 or newer (tested with 2.8, 2.9 and 3.1), WordPress 6.5 or newer and PHP 7.4 or newer. The add-on keeps your lists in your WordPress database (two tables of its own) and calls no outside service. The only outside requests are the usual GravityExtra licence checks and updates.

Install and activate

• Upload the add-on zip in Plugins → Add New → Upload Plugin and activate it.
• Go to Forms → Settings → Access Codes, enter your GravityExtra licence key and press Activate License.
• A new Forms → Access Codes page and an Access Codes tab in every form’s settings appear once the licence is active.

Without an active licence the add-on does nothing on your forms: no field is checked and the Access Codes page and the form tab are hidden. Your lists and codes stay saved and are used again as soon as the licence is active.

Two kinds of lists

Open Forms → Access Codes and create a list. Choose the type that fits:

• Access codes: each code lets in a set number of submissions. Use it for invitation codes, single-use vouchers, early-bird or partner codes and access codes for a class or an exam. The default is 1 use per code; you can change it for the list and for each code (for example 25 for a school class), and 0 means no limit.
• Allowed values: the answer must be on the list, as often as people like. Use it for membership or student numbers, staff IDs, e-mail addresses and postcodes. A value that ends with * is a prefix: SW1* allows every postcode that starts with SW1, and 902* allows every ZIP code that starts with 902. When two prefixes match, the longest one is used (for example SW1A* before SW1*).

Each list also has these settings, which you can change later under List settings:

• Ignore spaces, dashes and dots (on by default): gala isla 7kq2 matches GALA-ISLA-7KQ2. Upper and lower case never matter.
• Same message for every refused code (on by default for access codes): unknown, used, expired, blocked and other people’s codes all show the same message, so nobody can find out which codes exist by trying. Switch it off if you prefer clear messages such as “This code has already been used.”
• Message for a refused value: your own wording, for example “Please check the code on your invitation card.”

Add codes and values

The Add / import tab of a list offers three ways:

• Generate codes (access-code lists): up to 10,000 at a time. Choose the number of random characters (4 to 20), an optional prefix such as GALA-, a dash every 4 characters, the uses per code and an optional “valid until” date. Generated codes never use 0/O or 1/I/L, so they are easy to read out and type. New codes appear under the Unused filter, ready to export.
• Add one: type a code or value, and optionally its uses, its expiry date and the only e-mail address that may use it.
• Import CSV: upload a .csv or .txt file (up to 2 MB) or paste the lines. Commas, semicolons and tabs all work.

For an import, the first line holds the column names. code is required; uses, expires (written as 2027-03-31) and email are optional; any other column, such as name, table, zone or group, is kept with the code. Without a header line, every line is one code. A code that is already in the list is updated (uses limit, expiry, e-mail and columns) and keeps its use count. Lines with an invalid date or e-mail address are skipped and listed after the import. For example:

code,name,table,email,expires
GALA-ISLA-7KQ2,Isla Bennett,Oak 3,,
GALA-MARC-M9XD,Marcus Reid,Elm 1,marcus.reid@mail.example,
GALA-TOMO-8RZE,Tom Okafor,Ash 2,,2026-10-31

Check a form field

Open your form and go to Settings → Access Codes. A form can have up to three checks, each with:

• Field to check: a Single Line Text, Number, Email, Phone, Hidden, Drop Down or Radio Buttons field, or one part of an Address field such as the ZIP / postcode.
• List: the list the value must be on.
• E-mail field (optional): codes that have an e-mail address in the list only work when that address is typed in this field.
• Error message (optional): replaces the list’s message for this form.
• Fill fields from the list columns (optional): see below.

Make the field Required in the form editor if it must always be filled in; an empty field is not checked. A field hidden by conditional logic is not checked either, and its code is not used.

What happens when the form is sent

• When a page or the form is sent, the value is looked up in the list. It must exist, be active (not blocked), not be past its expiry date, have uses left and, for personal codes, match the e-mail field. Otherwise the message appears under the field and the form is not sent. On multi-page forms the visitor cannot move past the page with the code.
• When the whole form is submitted, each code is used with one conditional database write. If two people send the same single-use code at the same moment, only one of them gets in; the other sees the message under the field.
• Allowed values are counted too (the list shows how many submissions each value let in), but they are never used up.
• Wrong tries are counted per visitor connection and form. After 10 wrong values in 10 minutes (you can choose 3 to 100 under Forms → Settings → Access Codes) every value is refused for a while with “Too many tries”, so codes cannot be guessed one after the other.

The entry stores the code and the list name (you can add Access code and Code list columns to the entries list, filter by them and export them), gets a note such as “Checked and used: Autumn gala 2026: GALA-ISLA-7KQ2” and shows an Access code box on the entry screen with the uses of that code.

Fill fields from your list

The extra columns of a list can fill other fields of the form. In the check’s Fill fields from the list columns map, choose a column and a form field, for example the name column into a Member name field, or the table column into a Hidden field. When the form is submitted, the value from the list is saved, whatever was typed, so nobody can change it in the browser. On multi-page forms, the next pages already show the value as soon as the page with the code was accepted: a member types the membership number on page 1 and sees their name on page 2.

Merge tags

Use these in confirmations, notifications and anywhere Gravity Forms replaces merge tags:

• {access_code:code}: the code or value from the list (for prefixes, the pattern such as SW1*).
• {access_code:list}: the list name.
• {access_code:uses}, {access_code:max_uses} and {access_code:uses_left}: the use count, the limit and what is left (or “unlimited”).
• {access_code:expires} and {access_code:email}: the expiry date and the e-mail address of the code.
• {access_code:name}, {access_code:table} or any other column name of your list.
• {access_code_2:...} and {access_code_3:...}: the same for the second and third check of the form.

For example: “Thank you {access_code:name}, see you at table {access_code:table}.” The merge tags also appear in the merge tag drop-downs of the form editor once the form has a check.

Send codes by link

To put the code in a link, open the field in the form editor, go to Advanced, tick Allow field to be populated dynamically and enter a parameter name such as code. A link like https://your-site/rsvp/?code=GALA-ISLA-7KQ2 then opens the form with the code filled in; it is still checked on your server when the form is sent.

Manage codes

Open a list under Forms → Access Codes to see how many codes are unused, used and used up and how many submissions the list has let in, and which forms check it. The table can be filtered (all, unused, used, used up, expired, blocked) and searched by code, e-mail address or column value. Each row shows the uses, expiry, e-mail, the first extra columns, the status, the last use and links to the entries that used the code.

• Block / Unblock: a blocked code is refused on every form until you unblock it.
• Reset: sets the use count back to 0 (the entries stay).
• Delete: removes the code and its use history (the entries stay).
• Export CSV: the codes of the current filter and search with uses, limit, expiry, e-mail, status, last use, the entry IDs and every column. Values that a spreadsheet could run as a formula are written with a leading apostrophe.

When an entry is deleted or marked as spam, its code use is given back, so the code can be used again (you can switch this off under Forms → Settings → Access Codes). A submission that was checked but never became an entry gives its use back within an hour.

Who can do what

• Staff with the Gravity Forms edit entries capability can open Forms → Access Codes, export and block or unblock codes.
• Creating lists, generating, importing, resetting and deleting codes and the list settings need the edit forms capability.
• Administrators can do everything. The add-on settings need the Gravity Forms settings capability.

Privacy and uninstalling

The lists stay on your server. Uninstalling the add-on removes its settings, its hourly clean-up job and the try counters. The lists, codes and use history are kept unless you switch on Delete all lists, codes and use history when the add-on is uninstalled in the settings. Entries and their notes are never changed.

Frequently asked questions

Can one code be used by a group?

Yes. Give the code more uses (for example 25 for a class) or 0 for no limit. The list shows how many uses are left, and {access_code:uses_left} shows it in the confirmation.

Can I check two different fields on the same form?

Yes, up to three checks per form, each with its own list. For example a membership number on page 1 and the postcode of the Address field on page 2.

What happens when a payment fails after the form was sent?

The code use belongs to the entry. Delete the entry or mark it as spam and the use comes back (if “Give the code use back” is on).

Does it work with multi-page forms and Save and Continue?

Yes. The page with the code cannot be left with a wrong code, and the code is only used when the whole form is submitted.

Can a visitor see the list?

No. The list is only read on your server; the form only learns whether the value it sent is accepted. Filled fields only show values of a code the visitor already typed correctly.

How do I give each guest a personal link?

Export the unused codes, add them to your mailing tool next to each guest, and send a link with ?code=… as described in “Send codes by link”.