Under the hood
curl -X POST "$OPENTODO/api/v1/tasks" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"title":"Renew passport","priority":1}'
ot add "Renew passport" --priority 1 --due tomorrowHow it works
Architecture
How data flows from a tap on the screen to every device: server packages, tables, client modules and the build.
Sync protocol
Operations, the schema, the winner rule, the exchange, sharing scopes, live updates, purge and history.
Offline and sync
Working without a connection, and what happens when two devices change the same task.
Shared contracts
The logic that exists in both Go and TypeScript, and the shared fixtures that keep each pair in step.
Build on it
HTTP API
Authentication, every route, entity fields, error codes and examples.
The ot command line
JSON output, exit codes and dry runs, for scripts and AI agents.
MCP for AI assistants
Read-only by default; changes only when you allow them, and every one can be undone.
Webhooks
Signed events with retries, and recipes for Home Assistant, n8n and Telegram.
CalDAV
Apple Reminders, Thunderbird and Android task apps, with an app password per device.
What it promises
Stability and compatibility
What every 1.x release keeps: the v1 API, the sync protocol, the export format, the MCP tools and the ot command.
Performance budgets
How fast OpenTodo is held to be with 10,000 tasks, how it is checked, and the latest results.
Roadmap
What comes next after 1.0, and what shipped on the way.
Changelog
Every release, with its upgrade notes.
Security
Security and trust
How to report a vulnerability, what protects your data, the threat model, how it is verified and its limits.
End-to-end encryption
What encryption hides from the server and what it does not, devices, recovery and limits.
Releases and source
Verify the image and downloads
cosign signatures, an SBOM and build provenance on every image; attestations and checksums on every release file.
Verify the Android app
One signing certificate everywhere, and a reproducible build.
Source on GitHub
The server, the apps, the docs and their tests, under the AGPL-3.0.
Open specifications
Every feature’s behaviour, written as testable scenarios before it was built.