How to give a third-party app access to Odoo safely: dedicated user and API key

The minimal, auditable way to connect an external tool to Odoo Online, Odoo.sh or self-hosted: a dedicated user, the right access rights, and an API key you can revoke.

Any tool that reads or writes Odoo data needs credentials. Sharing an administrator's password is the common shortcut and the wrong one: it bypasses two-factor authentication, cannot be revoked without changing the person's password, and every record looks like that person created it. Here is the clean approach; it takes five minutes.

1. Create a dedicated user

1. Settings → Users & Companies → Users → New.
2. Name it after the tool, for example Odoomation Integration, with its own email address.
3. Give it only the apps the tool needs. For return notes that is Sales (User), Inventory (User) and Invoicing (Billing).
4. Keep it as an internal user; portal users cannot call the API for these models.

2. Generate an API key

1. Log in as that user.
2. Open Preferences → Account Security → New API Key (available since Odoo 14).
3. Give the key a description naming the tool and copy it once; Odoo never shows it again.

3. Connect and verify

Paste the Odoo URL, database name, login and API key into the tool. Odoomation tests the connection before saving and encrypts the key with AES-256-GCM at rest. On Odoo Online the database name appears in the URL after /web?db= or in Settings with developer mode on.

4. Revoke when done

Keys can be deleted from the same Account Security page, and the whole user can be archived. Because the user is dedicated, every order and credit note the integration created is attributed to it in the chatter, which is exactly what an auditor wants to see.

Odoomation only calls the JSON-RPC endpoints the add-on needs: product lookup by barcode, partner search, sales order and picking creation, and credit note drafting.