Environmental Variables
Rename the .sample.env
file located in openalgo
folder to .env
Update the .env
with your specific configurations as shown in the provided template.
Sample Environmental File
# Broker Configuration
BROKER_API_KEY = 'YOUR_BROKER_API_KEY'
BROKER_API_SECRET = 'YOUR_BROKER_API_SECRET'
# Market Data Configuration (Optional and Required only for XTS API Supported Brokers)
BROKER_API_KEY_MARKET = 'YOUR_BROKER_MARKET_API_KEY'
BROKER_API_SECRET_MARKET = 'YOUR_BROKER_MARKET_API_SECRET'
REDIRECT_URL = 'http://127.0.0.1:5000/<broker>/callback' # Change if different
# Valid Brokers Configuration
VALID_BROKERS = 'fivepaisa,fivepaisaxts,aliceblue,angel,compositedge,dhan,firstock,flattrade,fyers,groww,iifl,kotak,jainam,jainampro,paytm,pocketful,shoonya,upstox,wisdom,zebu,zerodha'
# Security Configuration
# IMPORTANT: Generate new random values for both keys during setup!
# OpenAlgo Application Key
APP_KEY = '3daa0403ce2501ee7432b75bf100048e3cf510d63d2754f952e93d88bf07ea84'
# Security Pepper - Used for hashing/encryption of sensitive data
# This is used for:
# 1. API key hashing
# 2. User password hashing
# 3. Broker auth token encryption
# Generate a new random string during setup using: python -c "import secrets; print(secrets.token_hex(32))"
API_KEY_PEPPER = 'a25d94718479b170c16278e321ea6c989358bf499a658fd20c90033cef8ce772'
# OpenAlgo Database Configuration
DATABASE_URL = 'sqlite:///db/openalgo.db'
# OpenAlgo Ngrok Configuration
NGROK_ALLOW = 'FALSE'
# OpenAlgo Hosted Server (Custom Domain Name) or Ngrok Domain Configuration
# Change to your custom domain or Ngrok domain
HOST_SERVER = 'http://127.0.0.1:5000'
# OpenAlgo Flask App Host and Port Configuration
# For 0.0.0.0 (accessible from other devices on the network)
# Flask Environment - development or production
FLASK_HOST_IP='127.0.0.1'
FLASK_PORT='5000'
FLASK_DEBUG='False'
FLASK_ENV='development'
# OpenAlgo Rate Limit Settings
LOGIN_RATE_LIMIT_MIN = "5 per minute"
LOGIN_RATE_LIMIT_HOUR = "25 per hour"
API_RATE_LIMIT="10 per second"
# OpenAlgo API Configuration
# Required to give 0.5 second to 1 second delay between multi-legged option strategies
# Single legged orders are not affected by this setting.
SMART_ORDER_DELAY = '0.5'
# Session Expiry Time (24-hour format, IST)
# All user sessions will automatically expire at this time daily
SESSION_EXPIRY_TIME = '03:00'
# OpenAlgo CORS (Cross-Origin Resource Sharing) Configuration
# Set to TRUE to enable CORS support, FALSE to disable
CORS_ENABLED = 'TRUE'
# Comma-separated list of allowed origins (domains)
# Example: http://localhost:3000,https://example.com
# Use '*' to allow all origins (not recommended for production)
CORS_ALLOWED_ORIGINS = 'http://127.0.0.1:5000'
# Comma-separated list of allowed HTTP methods
# Default: GET,POST
CORS_ALLOWED_METHODS = 'GET,POST'
# Comma-separated list of allowed headers
# Default Flask-CORS values will be used if not specified
CORS_ALLOWED_HEADERS = 'Content-Type,Authorization,X-Requested-With'
# Comma-separated list of headers exposed to the browser
CORS_EXPOSED_HEADERS = ''
# Whether to allow credentials (cookies, authorization headers)
# Set to TRUE only if you need to support credentials
CORS_ALLOW_CREDENTIALS = 'FALSE'
# Max age (in seconds) for browser to cache preflight requests
# Default: 86400 (24 hours)
CORS_MAX_AGE = '86400'
# OpenAlgo Content Security Policy (CSP) Configuration
# Set to TRUE to enable CSP, FALSE to disable
CSP_ENABLED = 'TRUE'
# Set to TRUE to use Content-Security-Policy-Report-Only mode (testing without blocking)
# This will report violations but not block content
CSP_REPORT_ONLY = 'FALSE'
# Default source directive - restricts all resource types by default
CSP_DEFAULT_SRC = "'self'"
# Script source directive - controls where scripts can be loaded from
# Includes Socket.IO CDN which is required by the application
# 'unsafe-inline' is needed for Socket.IO to function properly
# Cloudflare Insights is used for analytics
CSP_SCRIPT_SRC = "'self' 'unsafe-inline' https://cdn.socket.io https://static.cloudflareinsights.com"
# Style source directive - controls where styles can be loaded from
# 'unsafe-inline' is needed for some inline styles in the application
CSP_STYLE_SRC = "'self' 'unsafe-inline'"
# Image source directive - controls where images can be loaded from
# 'data:' allows base64 encoded images
CSP_IMG_SRC = "'self' data:"
# Connect source directive - controls what network connections are allowed
# Includes WebSocket connections needed for real-time updates
CSP_CONNECT_SRC = "'self' wss: ws:"
# Font source directive - controls where fonts can be loaded from
CSP_FONT_SRC = "'self'"
# Object source directive - controls where plugins can be loaded from
# 'none' disables all object, embed, and applet elements
CSP_OBJECT_SRC = "'none'"
# Media source directive - controls where audio and video can be loaded from
# Allows audio alerts from your domain and potentially CDN sources in the future
CSP_MEDIA_SRC = "'self' data: https://*.amazonaws.com https://*.cloudfront.net"
# Frame source directive - controls where iframes can be loaded from
# If you integrate with TradingView or other platforms, you may need to add their domains
CSP_FRAME_SRC = "'self'"
# Form action directive - restricts where forms can be submitted to
CSP_FORM_ACTION = "'self'"
# Frame ancestors directive - controls which sites can embed your site in frames
# This helps prevent clickjacking attacks
CSP_FRAME_ANCESTORS = "'self'"
# Base URI directive - restricts what base URIs can be used
CSP_BASE_URI = "'self'"
# Set to TRUE to upgrade insecure (HTTP) requests to HTTPS
# Recommended for production environments
CSP_UPGRADE_INSECURE_REQUESTS = 'FALSE'
# URI to report CSP violations to (optional)
# Example: /csp-report
CSP_REPORT_URI = ''
Here’s a clear and professional documentation update for your .sample.env
, suitable for inclusion at:
📄 https://docs.openalgo.in/getting-started/windows-installation/environmental-variables
✅ OpenAlgo .env
Configuration Explained
.env
Configuration ExplainedThis file controls OpenAlgo's broker credentials, security options, server settings, and key platform behaviors like rate limits, API access, CORS, and CSP.
🔐 Broker Configuration
BROKER_API_KEY = 'YOUR_BROKER_API_KEY'
BROKER_API_SECRET = 'YOUR_BROKER_API_SECRET'
# Market Data Configuration (Optional and Required only for XTS API Supported Brokers)
BROKER_API_KEY_MARKET = 'YOUR_BROKER_MARKET_API_KEY'
BROKER_API_SECRET_MARKET = 'YOUR_BROKER_MARKET_API_SECRET'
Set your broker credentials here. Required for placing live orders. For XTS-supported brokers, market keys can be optionally configured.
🔄 Redirect URLs
REDIRECT_URL=http://127.0.0.1:5000/<broker>/callback
Used in OAuth-based brokers (like Fyers). Update if you're using a custom domain or ngrok.
✅ Valid Brokers
VALID_BROKERS=fivepaisa,fyers,zerodha,...
Comma-separated list of supported broker plugins enabled in your OpenAlgo deployment.
🔒 Application Keys
APP_KEY=...
API_KEY_PEPPER=...
APP_KEY
: Internal application identifier.API_KEY_PEPPER
: Random 64-character hex string used for API key hashing, password hashing, and broker token encryption. 🔐 Generate it with:python -c "import secrets; print(secrets.token_hex(32))"
🗃️ Database
DATABASE_URL=sqlite:///db/openalgo.db
Use SQLite locally. You can point to PostgreSQL or MySQL if needed.
🌐 Server Configuration
FLASK_HOST_IP=127.0.0.1
FLASK_PORT=5000
FLASK_ENV=development
Control local Flask server binding and environment behavior.
Set FLASK_HOST_IP=0.0.0.0
if you want OpenAlgo accessible from other devices on your LAN.
🚦 Rate Limiting
LOGIN_RATE_LIMIT_MIN="5 per minute"
LOGIN_RATE_LIMIT_HOUR="25 per hour"
API_RATE_LIMIT="10 per second"
Protects API and login endpoints from brute-force or abuse.
⏱️ Strategy Execution Delay
SMART_ORDER_DELAY=0.5
Delay in seconds between multi-legged order execution. Useful for options or basket strategies.
🕒 Session Expiry
SESSION_EXPIRY_TIME=03:00
Automatically expires all user sessions daily at this time (IST). Format: HH:MM
🌐 CORS Configuration (Cross-Origin Resource Sharing)
CORS_ENABLED=TRUE
CORS_ALLOWED_ORIGINS=http://127.0.0.1:5000
CORS_ALLOWED_METHODS=GET,POST
CORS_ALLOWED_HEADERS=Content-Type,Authorization,X-Requested-With
CORS_ALLOW_CREDENTIALS=FALSE
CORS_MAX_AGE=86400
CORS is only required for browser-based apps (like React/Vue UIs) calling the OpenAlgo API.
By default, only requests from the same origin are allowed (
http://127.0.0.1:5000
).To support external frontends (e.g.,
http://localhost:3000
orhttps://data.openalgo.in
), you must add those domains toCORS_ALLOWED_ORIGINS
.
🧠 CORS does not affect Postman, curl, TradingView, or server-side requests. It's enforced only by browsers.

🔐 CSP Configuration (Content Security Policy)
CSP_ENABLED=TRUE
CSP_REPORT_ONLY=FALSE
CSP_DEFAULT_SRC='self'
...
CSP_SCRIPT_SRC='self' https://cdn.socket.io
CSP_STYLE_SRC='self' 'unsafe-inline'
CSP_IMG_SRC='self' data:
CSP_CONNECT_SRC='self' wss: ws:
...
Adds a security header to prevent XSS, data injection, or loading of untrusted resources.
By default, only your own domain (
'self'
) and essential WebSocket/Socket.IO scripts are allowed.Set
CSP_REPORT_ONLY=TRUE
to test without breaking your app (recommended for dev).Add CSP rules cautiously when embedding iframes (e.g., TradingView), custom fonts, or CDNs.
Optional CSP Reporting
CSP_REPORT_URI=/csp-report
If set, violations are reported here. You can use this to monitor violations via tools like Sentry or self-logging.
🧪 Recommended Defaults for Local Testing
CORS_ENABLED
TRUE
CORS_ALLOWED_ORIGINS
http://127.0.0.1:5001
CSP_ENABLED
TRUE
CSP_REPORT_ONLY
TRUE
Last updated