Turn community buying power into your next customer.

You are integrating TCM OAuth and Charades Coin payments into my website using the existing framework and architecture of my application.

Use these credentials and URLs:
- TCM OAuth client ID: <CLIENT_ID>
- TCM OAuth client secret: <CLIENT_SECRET>
- TCM OAuth API URL: https://www.thecrimsonmarket.com/mana
- TCM OAuth web URL: https://www.thecrimsonmarket.com
- Relics API base URL: https://www.thecrimsonmarket.com/relics
- OAuth callback URL in my app: <CALLBACK_URL>
- Relic currency key: charades-coin

OAuth endpoints:
- Authorization URL: https://www.thecrimsonmarket.com/oauth/authorize
- Token URL: https://www.thecrimsonmarket.com/mana/oauth/token
- Userinfo URL: https://www.thecrimsonmarket.com/mana/oauth/userinfo
- Currency discovery URL: https://www.thecrimsonmarket.com/relics/api/relics/currencies

Required server environment variables:
NEXT_PUBLIC_TCM_CLIENT_ID="<CLIENT_ID>"
TCM_OAUTH_CLIENT_SECRET="<CLIENT_SECRET>"
TCM_OAUTH_API_URL="https://www.thecrimsonmarket.com/mana"
NEXT_PUBLIC_TCM_OAUTH_WEB_URL="https://www.thecrimsonmarket.com"

Requirements:
1. Keep the OAuth client secret on the server only. Never expose it in browser code, logs, source control, or public environment variables.
2. Add TCM OAuth login using @crimsoncorp/oauth-react and register <CALLBACK_URL> exactly in the Developers portal.
3. Persist the signed-in TCM account ID from userInfo._id or userInfo.userId as accountId. Store email and display name when those claims are granted.
4. Fetch GET https://www.thecrimsonmarket.com/relics/api/relics/currencies and confirm data.currencies contains the key charades-coin before displaying Charades Coin at checkout.
5. Add Charades Coin as a partial or full payment option at checkout. Show the amount of Charades Coin applied and the remaining fiat total clearly before confirmation.
6. From a server route or server action, authorize the customer's balance with POST https://www.thecrimsonmarket.com/relics/api/relics/payment-authorizations using:
{
  "clientId": "<CLIENT_ID>",
  "clientSecret": process.env.TCM_OAUTH_CLIENT_SECRET,
  "accountId": "<SIGNED_IN_TCM_ACCOUNT_ID>",
  "amount": <CHARADES_COIN_AMOUNT>,
  "relicType": "charades-coin",
  "merchantReference": "<UNIQUE_ORDER_AUTH_REFERENCE>",
  "orderId": "<ORDER_ID>",
  "statementDescriptor": "<ORDER_DESCRIPTION>",
  "notes": "Charades Coin authorization for <ORDER_ID>",
  "expiresAt": "<OPTIONAL_ISO_DATE>"
}
7. Treat merchantReference as idempotent per OAuth client and persist data.authorizationId on the order.
8. Capture only after the order is accepted or paid by calling POST https://www.thecrimsonmarket.com/relics/api/relics/payment-authorizations/{authorizationId}/capture from the server with clientId, clientSecret, a unique settlementReference, and notes.
9. If the order fails, is cancelled, or is abandoned after authorization, call POST https://www.thecrimsonmarket.com/relics/api/relics/payment-authorizations/{authorizationId}/reversal from the server with clientId, clientSecret, a unique reversalReference, and notes.
10. Persist the capture response's settlement, settlementUserId, relic amount, order reference, and authorization ID for merchant reporting. Do not recalculate payout values later; the Relics ledger locks the settlement value at capture time.
11. Show captured Charades Coin in the merchant reporting view as withdrawable through Stripe or eligible for batched monthly settlement. Keep withdrawal and settlement actions server-side, and never represent unsettled funds as already paid out.
12. Handle retries safely and surface insufficient balance, expired authorization, disabled client, and unsupported currency errors without marking the order as paid.
13. Add automated tests for successful authorization/capture, reversal, duplicate idempotent requests, insufficient balance, and secret-bearing endpoints being inaccessible from the browser.
14. Return a concise list of files changed and any TCM-side configuration still required after implementation.

Implement the integration now using server-side routes/actions for every request containing clientSecret.