This module adds support for MFA using TOTP (time-based, one-time passwords). It allows users to enable/disable MFA and manage authentication apps/devices via the "Change My Preferences" view and an associated wizard.
After logging in normally, users with MFA enabled are taken to a second screen where they have to enter a password generated by one of their authentication apps and are presented with the option to remember the current device. This creates a secure, HTTP-only cookie that allows subsequent logins to bypass the MFA step.
auto_awesome What this module does
AI-generated from the code · Odoo 12.0Lets users protect their Odoo account with an authenticator app (MFA/TOTP). After the normal password login, they enter a six-digit code from their app, and can mark a device as trusted for 30 days.
This module adds multi-factor authentication (MFA) to Odoo user accounts using time-based one-time passwords generated by an authenticator app.
Users manage their own settings from "Change My Preferences": they can tick "MFA Enabled?", see their list of "Authentication Apps/Devices", and use the "Add New App/Device" button. That button opens a wizard where they give the app a name, scan a QR code (or type the secret code) into their authenticator app, and enter the six-digit confirmation code to prove it works. Administrators see the same "MFA Settings" group on the full user form.
Business rules and automatic behaviour: - MFA cannot be enabled without at least one authentication app/device, to avoid locking the user out. - Each app/device name must be unique per user. - The confirmation code is checked against the secret key before the device is saved. - After a normal password login, users with MFA enabled are redirected to a dedicated MFA login page where they enter the code; a wrong code shows an error. - A "Remember this device" option creates a secure, HTTP-only cookie valid for 30 days so that device can skip the MFA step. - Authenticators are private to their owner; administrators can read and delete them but not modify them.
It touches the user model res.users, the new res.users.authenticator model, the creation wizard res.users.authenticator.create, and the login flow.
Depends on
Required by other modules
Models and fields (3)
- res.users · extends an existing modelmfa_enabled (MFA Enabled?), authenticator_ids (Authentication Apps/Devices), trusted_device_cookie_key
- res.users.authenticator · new modelname, user_id, secret_key
- res.users.authenticator.create · new modelname (Authentication App/Device Name), user_id (Associated User), secret_key (Secret Code), qr_code_tag (QR Code), confirmation_code (Confirmation Code), secret_key_display (Secret Code)
Text generated by AI (DeepSeek) from reading the Odoo 12.0 code on GitHub; it may contain mistakes, so check the code before deciding. View the code on GitHub
Availability by version
Reviewed: 2026-11-03Confirmation status: 1 confirmed, 8 with no information of 9 versions.
Sources · Odoo 12.0
Confirmed on 2026-11-03 in branch 12.0 of OCA/server-auth.
terminal Installation and usage
OCA documentation · Odoo 12.0Installation
Source · Odoo 12.0- Install the PyOTP library using pip:
pip install pyotp - Follow the standard module install process
Configuration
Source · Odoo 12.0By default, the trusted device cookies introduced by this module have a Secure flag. This decreases the likelihood of cookie theft via eavesdropping but may result in cookies not being set by certain browsers unless your Odoo instance uses HTTPS. If necessary, you can disable this flag by going to Settings > Parameters > System Parameters and changing the auth_totp.secure_cookie key to 0.
Usage
Source · Odoo 12.0If necessary, a user's trusted devices can be revoked by disabling and re-enabling MFA for that user.
Installation instructions, the distribution package, dependencies and configuration steps are not shown because they have not yet been verified in the module documentation for any version.
Data imported from GitHub: this sheet reflects the latest catalog review, not a live lookup. Always check the module documentation and staging before installing in production.