> For the complete documentation index, see [llms.txt](https://docs.openalgo.in/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openalgo.in/developers/design-documentation.md). # Design Documentation This directory describes the implemented architecture of OpenAlgo `2.0.1.4`. OpenAlgo is a self-hosted, single-user trading application with a Flask/Flask-RESTX backend, React 19 frontend, broker plugins, a separate WebSocket proxy, sandbox execution, hosted strategies, Flow automation, analytics tools, and optional local or remote MCP access. The current plugin inventory contains 34 broker directories with `plugin.json`. Broker capabilities are metadata-driven; a plugin's presence does not imply every optional broker operation is supported. ## Documentation Policy * Code and registered routes are authoritative when a design document conflicts with an example. * The public REST contract lives in the [API documentation](/api-documentation/v1.md). * Flask-RESTX Swagger/OpenAPI UI is intentionally disabled with `doc=False` in `restx_api/__init__.py`. Do not advertise or re-enable `/api/docs` as part of documentation maintenance. * These pages describe implemented behavior verified against the application code and registered routes. ## Runtime And Core Architecture | Module | Description | | ------------------------------------------------------------------------------------ | -------------------------------------------------------- | | [00 Directory Structure](/developers/design-documentation/00-directory-structure.md) | Current repository boundaries and ownership | | [01 Frontend](/developers/design-documentation/architecture.md) | React 19, Vite 8, routing, state, data access | | [02 Backend](/developers/design-documentation/02-backend-architecture.md) | Flask factory, route layers, services, background work | | [04 Cache Architecture](/developers/design-documentation/broker-integerations.md) | In-process caches and invalidation behavior | | [17 Connection Pooling](/developers/design-documentation/17-connection-pooling.md) | HTTP and market-data connection reuse | | [18 Database Structure](/developers/design-documentation/18-database-structure.md) | SQLite and DuckDB stores, `NullPool`, teardown | | [20 Design Principles](/developers/design-documentation/20-design-principles.md) | Local conventions and architectural constraints | | [27 Service Layer](/developers/design-documentation/27-service-layer.md) | Route-to-service-to-broker boundaries | | [31 Utilities](/developers/design-documentation/31-utils-functionalities.md) | Shared auth, config, logging, networking helpers | | [34 App Startup](/developers/design-documentation/34-app-startup.md) | Validation, registration, initialization, server startup | | [53 Event Bus](/developers/design-documentation/53-event-bus.md) | Per-process async side-effect dispatch | ## Authentication And Security | Module | Description | | --------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | | [03 Login And Broker Flow](/developers/design-documentation/api-layer.md) | App auth, TOTP, broker selection, session resume | | [05 Security Architecture](/developers/design-documentation/database-layer.md) | Keys, encryption, CSRF, CORS, CSP, middleware | | [23 IP Security](/developers/design-documentation/23-ip-security.md) | IP extraction, bans, proxy trust | | [24 Browser Security](/developers/design-documentation/24-browser-security.md) | Cookies, CSRF, CSP, hardening headers | | [40 Logout And Session Lifecycle](/developers/design-documentation/40-logout-and-session-expiry.md) | Daily expiry, heartbeat, reconnect, multi-session behavior | | [47 SMTP Configuration](/developers/design-documentation/47-smtp-configuration.md) | Mail configuration and diagnostics | | [48 Password Reset](/developers/design-documentation/48-password-reset.md) | Reset flow and password change revocation | | [50 TOTP Configuration](/developers/design-documentation/50-totp-configuration.md) | Per-purpose two-factor policy | ## Trading, Data, And Automation | Module | Description | | -------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | | [06 WebSockets](/developers/design-documentation/authentication-platforms.md) | Proxy protocol, ZMQ fan-in, adapters, subscriptions | | [07 Sandbox](/developers/design-documentation/configuration.md) | Analyzer execution engine and isolated state | | [08 Historify](/developers/design-documentation/utilities.md) | DuckDB historical-data subsystem | | [09 REST API](/developers/design-documentation/broker-integration-checklist.md) | Registered v1 architecture; Swagger intentionally disabled | | [10 Flow](/developers/design-documentation/10-flow-architecture.md) | Visual workflow storage and execution | | [13 Chartink](/developers/design-documentation/13-chartink-architecture.md) | Scanner automation | | [14 TradingView And GoCharting](/developers/design-documentation/14-tradingview-and-gocharting.md) | JSON integration surfaces | | [19 PlaceOrder Flow](/developers/design-documentation/19-placeorder-call-flow.md) | Validation, mode routing, Action Center, broker calls | | [32 Master Contract](/developers/design-documentation/32-master-contract-download.md) | Broker instrument downloads and cache policy | | [33 Broker Folder](/developers/design-documentation/33-broker-folder-explanations.md) | Plugin module convention | | [38 Python Strategies](/developers/design-documentation/38-python-strategies-hosting.md) | Hosted-process model and logs | | [39 Strategy Module](/developers/design-documentation/39-strategy-module.md) | Webhook strategy management | | [42 Action Center](/developers/design-documentation/42-action-center.md) | Semi-auto order approval | | [54 Scalping Terminal](/developers/design-documentation/54-scalping-terminal.md) | Keyboard trading, charts, persisted stops, risk monitor | ## UI, Tools, And Integrations | Module | Description | | ---------------------------------------------------------------------------------------------- | ------------------------------------------------------ | | [15 Basic UI And Analytics](/developers/design-documentation/15-basic-ui-elements.md) | Current React pages and analytics tools | | [37 API Key And Playground](/developers/design-documentation/37-api-key-and-playground.md) | API key management and WebSocket tester | | [41 MCP Architecture](/developers/design-documentation/41-mcp-architecture.md) | Local stdio and opt-in remote OAuth transport | | [43 Telegram Bot](/developers/design-documentation/43-telegram-bot-configuration.md) | Bot lifecycle, commands, automatic and explicit alerts | | [43 Toast Notifications](/developers/design-documentation/44-toast-notifications-system.md) | Browser notification categories | | [44 PnL Tracker](/developers/design-documentation/44-pnl-tracker.md) | Live P\&L charting | | [46 Search](/developers/design-documentation/46-search.md) | Contract and underlying search | | [49 Themes](/developers/design-documentation/49-themes.md) | Theme and accent persistence | | [51 Broker And System Config](/developers/design-documentation/51-broker-and-system-config.md) | Environment and broker configuration boundaries | | [52 Broker Factory](/developers/design-documentation/52-broker-factory-implementation.md) | WebSocket adapter construction | ## Operations And Deployment | Module | Description | | -------------------------------------------------------------------------------------------------- | ------------------------------------------ | | [11 Docker](/developers/design-documentation/11-docker-configuration.md) | Container build and compose runtime | | [12 Ubuntu Server](/developers/design-documentation/12-ubuntu-server-installation.md) | Host deployment | | [16 Centralized Logging](/developers/design-documentation/16-centralized-logging.md) | Python logs and file retention | | [21 Admin Section](/developers/design-documentation/21-admin-section.md) | Runtime and Remote MCP administration | | [22 Log Section](/developers/design-documentation/22-log-section.md) | Order and analyzer log views | | [25 Latency Monitor](/developers/design-documentation/25-latency-monitor.md) | API timing data | | [26 Traffic Logs](/developers/design-documentation/26-traffic-logs.md) | Request telemetry and ban support | | [28 Environment Configuration](/developers/design-documentation/28-environment-configuration.md) | `.env` contract | | [29 Ngrok Configuration](/developers/design-documentation/29-ngrok-configuration.md) | Tunnel management | | [30 Upgrade Procedure](/developers/design-documentation/30-upgrade-procedure.md) | Upgrade and backup flow | | [35 Development And Testing](/developers/design-documentation/35-development-and-testing-guide.md) | Local checks and CI coverage | | [36 Rate Limiting](/developers/design-documentation/36-rate-limiting-guide.md) | Limiter configuration and endpoint classes |