Start Here
Choose your integration path
The recommended production path is server-backed: use `useTcmOAuth` in the browser, render `TcmOAuthCallbackPage` on your callback route, and exchange codes on your server with `createTcmOAuthExchangeRoute`.
New integrations should start with installation, then move through React or Next.js setup.
Starting a new integration
Begin with installation, then move into the recommended route-backed React and Next.js flow.
Building a React or Next.js app
Use @crimsoncorp/oauth-react and default to useTcmOAuth with interactionMode: "auto".
Need the server exchange route
Use createTcmOAuthExchangeRoute with the SDK session adapter and logout route to keep client_secret private and normalize auth behavior.
Adding platform admin or tester access
Request the roles scope, persist userInfo.roles server-side, and guard privileged APIs with code-level permissions.
Building external-club sync
Use the dedicated partner provisioning guide for payload requirements, bcrypt hashes, and webhook enrichment.
Building a Discord community site
Use the Discord Bot API to embed active giveaways, guild summaries, and public server leaderboards without exposing Discord bot secrets.
Embedding or automating wheels
Use the wheel guide for iframe params, result events, service.wheel credentials, entry import, and persisted spins.
Hosting the catalog in your own app
Use the embedded catalog guide for iframe handshake, bridge-token exchange, and cross-domain auth behavior.
Validating a token for a hosted widget
Use the widget auth guide when your backend already has a TCM token and needs to validate it before loading an embedded app.
Accepting relic currency in checkout
Use Relic Payment Authorizations to authorize, capture, or reverse relic value without exposing client secrets.
Showing live streamer status
Use the streamer strip endpoint to decide when to show a live strip or replace an ad/image with a Twitch embed.
Mix embedded and standalone auth
Resolve auth per request with sdk_session and parent_auth_token instead of adding a global auth mode.
Already using the older popup-only flow
Keep popup compatibility APIs only when you need custom control or a legacy callback path.
Current platform constraints
- Server-backed integrations are the supported path for production apps.
- `Portal.Service` still requires `client_secret` during token exchange.
- Redirect URI matching is exact. Register the full callback URL in the Developers app.
- `interactionMode: "auto"` is the recommended default for mobile and popup-blocked reliability.
Installation
Install the package, optional styles, and the minimum prerequisites before wiring a callback route.
Open sectionReact Quickstart
Start with the recommended browser hook for route-backed integrations.
Open sectionNext.js Server Flow
Set up callback, SDK-managed session, auth resolution, and logout routes without exposing client secrets.
Open sectionAPI Reference
Review exported hooks, components, browser clients, and server helpers.
Open sectionScopes and Fields
Confirm which user fields each scope unlocks before requesting consent.
Open sectionRoles RBAC Integration
Use the roles scope for trusted platform RBAC and map role names to service-local permissions.
Open sectionExternal Club Integration
Provision partner users, pass bcrypt password hashes, and understand webhook enrichment behavior.
Open sectionEmbedded Catalog Integration
Embed a TCM catalog in your own site and authenticate the iframe through a server-backed token bridge.
Open sectionEmbedded Widget Auth
Validate an existing TCM auth token from your backend before trusting a hosted widget user.
Open sectionRelic Payment Authorizations
Accept configurable relic currencies for instant customer payment, account credit, B2B settlement, and escrow-backed order flows.
Open sectionDiscord Bot API
Read bot status, public giveaways, server summaries, and Discord XP/credit leaderboards from a backend service client.
Open sectionWheel Embed and API
Embed branded wheels, receive iframe spin results, and create or spin wheels from a service.wheel client.
Open sectionStreamer Strip Endpoint
Read live streamer strip data for banners, live strips, and Twitch embed replacement.
Open sectionRegister an App
Create a portal client, register exact callback URLs, and manage credentials.
Open sectionService Clients (M2M)
Create a client_credentials service client, mint a userless token with the right audience, and delegate with X-User-Sub.
Open section