Getting Started

A super admin creates an Admin API Key through the dashboard or API:

Create API key via dashboard or API with name, description, and scopes (clients:write, clients:read).

Your service registers as an OAuth2 client using the Admin API Key:

Use the Admin API Key to POST to /api/clients with: name, organization_id, client_type, redirect_uris, grant_types, and scopes. See Integration Guide for complete examples.

Save these credentials in your environment variables:

OAUTH2_CLIENT_ID=client_abc123...
OAUTH2_CLIENT_SECRET=secret_xyz789...
OAUTH2_REDIRECT_URI=https://myapp.com/auth/callback
OAUTH2_AUTHORIZE_URL=https://thalamus.example.com/oauth/authorize
OAUTH2_TOKEN_URL=https://thalamus.example.com/oauth/token

Implement the OAuth2 Authorization Code flow in your application:

1. Redirect user to /oauth/authorize with client_id, redirect_uri, scope, and state
2. Handle callback at your redirect_uri with the authorization code
3. Exchange code for tokens at /oauth/token
4. Store tokens securely (httpOnly cookies recommended)

See the Integration Guide for complete code examples in Node.js, Python, PHP, and more.

Your users can now authenticate through Thalamus! The flow works like this:

1. User clicks "Login" in your app
2. They're redirected to Thalamus login page
3. User enters credentials (with optional MFA)
4. Thalamus redirects back with authorization code
5. Your app exchanges code for access token
6. User is now authenticated!