Integrating CVMesh Resume Sharing

Enable candidates to share their verified, ATS-compliant resume data with your platform in seconds. Use our official agnostic and React packages, or integrate directly with the open protocol.

Why Open Resume Share?

With Open Resume Share, third-party platforms and job applications connect directly without registering client secrets or managing backend token vaults. The user authenticates in a secure popup and selects which resume sections to share, and your application receives a single-use, 3-minute signed token to fetch the user's standardized JSON Resume.

Official Client Libraries

Recommended

We provide ready-to-use, fully typed TypeScript libraries that handle popup management, security validations, cross-origin communication, and token redemption out of the box.

@cvmesh/fetcherFramework Agnostic

Lightweight, zero-dependency client for Vanilla JS, Vue, Angular, Svelte, or Node.js.

bash

npm install @cvmesh/fetcher
# or
pnpm add @cvmesh/fetcher
# or
yarn add @cvmesh/fetcher

@cvmesh/reactReact 17+ / 18 / 19

React hook (useFetchResume) and Provider for seamless UI button and form integrations.

bash

npm install @cvmesh/react @cvmesh/fetcher
# or
pnpm add @cvmesh/react @cvmesh/fetcher
# or
yarn add @cvmesh/react @cvmesh/fetcher

How It Works in 3 Steps

Step 1

Open Consent Popup

Your application opens a popup pointing to /share/pick passing your site's origin and a unique nonce.

Step 2

User Authenticates & Picks

The candidate signs in to CVMesh, selects which resume to share, and chooses specific sections (work, skills, etc.).

Step 3

Redeem One-Time Token

A single-use JWT is returned via postMessage. Your site calls /api/share/resume?token=... to receive the JSON Resume schema.

Integration Code Examples

@cvmesh/fetcher (Agnostic)

@cvmesh/react (React Hook)

Manual: Browser JS

Manual: Node.js

Manual: Python

The @cvmesh/fetcher package provides both a simple one-function helper requestResume() and a complete CVMeshClient class for full lifecycle control.

Option 1: Quick start with requestResume()

Quickstart (Vanilla JS / TS)typescript

1import { requestResume } from '@cvmesh/fetcher';
2
3async function handleCandidateImport() {
4  try {
5    // 1. Triggers CVMesh consent popup, listens for token, & automatically redeems it
6    const { resume, token } = await requestResume({
7      sections: ['basics', 'work', 'education', 'skills'],
8    });
9
10    console.log('Candidate Name:', resume.basics?.name);
11    console.log('Candidate Email:', resume.basics?.email);
12    console.log('Work Experience:', resume.work);
13
14    // Autofill your application form fields:
15    document.getElementById('full-name').value = resume.basics?.name || '';
16    document.getElementById('email').value = resume.basics?.email || '';
17  } catch (err: any) {
18    if (err.name === 'UserCancelledError') {
19      console.log('Candidate closed the popup without sharing.');
20    } else {
21      console.error('Failed to import resume:', err);
22    }
23  }
24}

Option 2: Advanced control with CVMeshClient

Advanced Lifecycle & Custom Error Handlingtypescript

1import { CVMeshClient, PopupBlockedError, UserCancelledError, TimeoutError } from '@cvmesh/fetcher';
2
3// Initialize a client instance with custom settings
4const client = new CVMeshClient({
5  baseUrl: 'https://cvmesh.app', // Custom domain or localhost for testing
6  timeout: 180000,              // 3 minutes timeout
7});
8
9async function initiateFlow() {
10  try {
11    // Open consent popup and resolve when user approves
12    const { resume, token } = await client.requestResume({
13      sections: ['basics', 'work', 'education', 'skills', 'projects'],
14      format: 'json', // 'json' (default) or 'xml'
15    });
16
17    return resume;
18  } catch (error) {
19    if (error instanceof PopupBlockedError) {
20      alert('Please enable popups for this website.');
21    } else if (error instanceof UserCancelledError) {
22      console.info('User cancelled resume selection');
23    } else if (error instanceof TimeoutError) {
24      console.warn('Resume request timed out');
25    } else {
26      console.error('Unexpected error:', error);
27    }
28  } finally {
29    // Cleanup listeners when finished
30    client.destroy();
31  }
32}

Security Architecture & Protocols

Single-Use Ephemeral Tokens & 3-Minute TTL

Each share token is prefixed with cvs_ and contains a cryptographically signed HMAC-SHA256 JWT. Tokens are valid for exactly 3 minutes (180 seconds) and can only be redeemed once. Any subsequent attempts to redeem the same token immediately return HTTP 410 Gone.

Strict Origin & Nonce Validation

The popup enforces HTTPS production origins (with localhost permitted for local testing). The token claims embed your exact caller origin as the audience (aud). During redemption, the server verifies the incoming Origin/Referer matches the token, preventing token interception or misuse across different sites.

Standard JSON Resume Output

API Reference

GET /api/share/resume

Redeem a single-use token for candidate resume data.

Query Parameters:

token (string, required): The cvs_... token received via postMessage.
format (string, optional): Set to xml for XML output; defaults to json.

HTTP Status Codes:

200 OK: Success, returns standardized JSON Resume object.
400 Bad Request: Missing token parameter.
401 Unauthorized: Invalid signature or token expired (> 3 minutes).
403 Forbidden: Origin mismatch.
410 Gone: Token has already been redeemed (replay protection).
429 Too Many Requests: Rate limit exceeded.