OdooWiki OCA HUB

Auth Api Key

auth_api_key folder_open OCA/server-auth open_in_new
Uncategorised License: LGPL-3

Authenticate http requests from an API key.

API keys are codes passed in (in the http header API-KEY) by programs calling an API in order to identify -in this case- the calling program's user.

Take care while using this kind of mechanism since information into http headers are visible in clear. Thus, use it only to authenticate requests from known sources.

For unknown sources, it is a good practice to filter out this header at proxy level.

Odoo allows users to authenticate XMLRPC/JSONRPC calls using their API key instead of a password by native API keys (res.users.apikey). However, auth_api_key has some special features of its own such as:

  • API keys remain usable even when the user is inactive, if enabled via settings (e.g., for system users in a shopinvader case).
  • Supports dual authentication via Basic Auth and API_KEY in separate HTTP headers.
  • Admins can manage API keys for all users

Given these advantages, particularly in use case like system user authentication, we have decided to keep the auth_api_key module

auto_awesome What this module does

AI-generated from the code · Odoo 19.0

Lets administrators create API keys that programs can use to log into Odoo instead of a password, and control whether those keys keep working when the linked user is archived.

This module adds a new screen for managing API keys. Each key has a name, a secret value and a user; requests that send the key in an API-KEY HTTP header are processed as that user. Keys are created from the "Auth Api Key" menu (under the Custom menu) or through the list and form views, and the form offers a "Generate Random Token" button that creates a secure random secret. Key names must be unique, and a key cannot be saved empty.

A setting appears in the general settings, "Disable API key when archiving user". When it is enabled, archiving a user automatically archives their API keys, so those keys stop working; the change is not retroactive. When it is disabled, keys stay usable even for inactive users.

Only users in the system administrator group can read, create, change or delete API keys, and only they can look up a key during authentication. The module also touches the HTTP request handling so that routes protected by API key authentication accept the API-KEY header, including in cross-origin (CORS) preflight responses. It extends res.company and res.config.settings for the archiving option and ir.http for the authentication method.

Depends on

base_setup

Required by other modules

auth_api_key_environmentauth_api_key_groupauth_api_key_server_envbase_rest_auth_api_keypricelist_cache_restsale_order_import_ubl_http
Models and fields (3)
  • res.company · extends an existing modelarchived_user_disable_auth_api_key (Disable API key for archived user)
  • auth.api.key · new modelkey, name, active, user_id (User)
  • res.config.settings · extends an existing modelarchived_user_disable_auth_api_key

Text generated by AI (DeepSeek) from reading the Odoo 19.0 code on GitHub; it may contain mistakes, so check the code before deciding. View the code on GitHub

Availability by version

Reviewed: 2026-11-03
Confirmed (verified in repository and branch) Estimated (unverified) No information

Confirmation status: 8 confirmed, 1 with no information of 9 versions.

Sources · Odoo 15.0

Confirmed on 2026-11-03 in branch 15.0 of OCA/server-auth.

terminal Installation and usage

OCA documentation · Odoo 19.0

Configuration

Source · Odoo 19.0

The api key menu is available into Settings \> Technical in debug mode. By default, when you create an API key, the key is saved into the database.

When you create an API key, a random key is generated automatically. You can replace it manually, or use the Generate Random Token button if an existing record has no key. The key field is masked by default, and the password widget provides a button to reveal the value when needed.

When a database is neutralized, stored API key values are cleared.

If you want to manage them via serve environment settings use auth_api_key_server_env.

Usage

Source · Odoo 19.0

To apply this authentication system to your http request you must set 'api_key' as value for the 'auth' parameter of your route definition into your controller.

class MyController(Controller):

    @route('/my_service', auth='api_key', ...)
    def my_service(self, *args, **kwargs):
        pass

No verified information in OCA: Installation.

info

Data imported from GitHub: this sheet reflects the latest catalog review, not a live lookup. Always check the module documentation and staging before installing in production.