Welcome to The Crimson Market Developers Portal

Build powerful integrations with The Crimson Market API. Create OAuth applications, manage your credentials, and access our comprehensive documentation to bring trading functionality to your platform.

ApplicationsDiscord Bot APIAPI Documentation

Developers Documentation

TCM OAuth Integration Docs

SDK-backed guidance for @crimsoncorp/oauth-react, plus portal-specific setup details for apps, scopes, and redirect registration.

Registering OAuth Applications

How to create clients, configure redirect URIs, and align portal settings with the SDK flow.

Local portal docs

Create the OAuth client first, then align your callback route and server configuration with the SDK.

Workflow

  1. Create a client in Create Application.
  2. Register the exact callback URI your app will use, including protocol, hostname, and path.
  3. Keep the generated client secret on your server only.
  4. Select the minimum scopes needed for your integration.
  5. Match the configured callback route with the SDK callback component and exchange route.

Recommended callback registration

For the current recommended SDK flow, register the same callback route you render with TcmOAuthCallbackPage. The default recommended path is /auth/tcm/callback.

OAuth endpoints are relative to your Mana API base URL.

Development: https://dev.portal.raum.au/mana
Production: https://www.thecrimsonmarket.com/mana
NEXT_PUBLIC_TCM_CLIENT_ID=tcm_xxx
TCM_OAUTH_CLIENT_SECRET=your-secret
TCM_OAUTH_API_URL=https://www.thecrimsonmarket.com/mana
NEXT_PUBLIC_TCM_OAUTH_WEB_URL=https://www.thecrimsonmarket.com

Use NEXT_PUBLIC_TCM_CLIENT_ID in both the browser hook and server exchange route. Keep only TCM_OAUTH_CLIENT_SECRET server-side.

Operational notes

  • Redirect URI matching is exact, so local, staging, and production callbacks must each be registered correctly.
  • If you rotate the client secret, update the server route immediately before testing logins again.
  • If your app uses the external_club scope, the same client secret is also used to sign optional webhook enrichment calls.
  • Manage existing clients from My Applications.
  • For server-to-server calls with no user login (a worker, cron, or webhook acting on its own or a user's behalf), use a machine-to-machine service client instead — it uses client_credentials, has no redirect URIs, and is admin-created. See Machine-to-Machine Service Clients.

External-club integrations

If your client needs partner provisioning or webhook enrichment, follow the dedicated External Club Integration guide.

If you also plan to host the TCM catalog in your own app, continue with Embedded Catalog Integration.