Keep your form. Add the phone.
Most forms don’t need a rewrite. CrossUpload writes accepted file IDs into a hidden input of your choice, and your backend verifies them with a server-side API call before saving. In companion mode, your existing file input keeps working exactly as before.
The problem
- Rebuilding a working form just to add an upload feature is expensive and risky.
- Trusting IDs or URLs posted from hidden fields lets attackers attach someone else’s files.
How CrossUpload helps
Hidden JSON field
resultInput receives a JSON array of accepted file IDs and metadata; input and change events fire so your validation can react.
Server-side validation
Your backend calls GET /v1/files/{id} and checks the project, session and externalReference before attaching the file.
Companion mode
Add “Upload from your phone” next to an existing input. Local files still post as multipart; phone files arrive as IDs.
Never auto-submits
The visitor stays in control of your form.
Questions
What does my server receive?
A list of file IDs. Fetch metadata and temporary URLs from the API using your secret key.