Job Board API - Applications - Unclear/unsafe instructions for uploading resume file

[agonsalves]

The docs indicate that the file should be submitted via direct upload from the client/browser, but submitting a file in this way would expose the API token to the client. To handle this properly, you have to obfuscate the API call by submitting the form to a service that then makes the call to the Greenhouse API. However, this requires the resume file to be encoded differently so that it can be passed from the client, to the service, to the Greenhouse API. For example, other HR systems would have you encode the file to base64 first.

Storing the resume file in a secondary location is not always practical.