OdooWiki OCA HUB

REST Authentication Service

base_rest_auth_user_service folder_open OCA/rest-framework open_in_new
Uncategorised License: LGPL-3

This module adds API endpoints to deal with session authentication and logout.

auto_awesome What this module does

AI-generated from the code · Odoo 15.0

Adds REST API endpoints to log in and log out of an Odoo session, so external applications can authenticate users and receive a session identifier.

This module exposes two web service endpoints under the /session/ path, meant for external apps that need to sign a user in or out of Odoo without using the normal web login page.

  • POST /session/auth/login: accepts a database name (optional, defaults to the current one), a login and a password. It authenticates the user in Odoo, returns the usual session information, and adds a session block with the session identifier and an expiry date set 90 days in the future.
  • POST /session/auth/logout: requires an already authenticated user and closes the session, returning a simple success message.

The service is implemented as a REST component named session.authenticate.service and is registered in the session.rest.services collection. It relies on the base_rest module for the REST framework. No menus, screens, reports, scheduled jobs or emails are added by this module; it only provides API access. The login endpoint is public (no prior authentication needed), while logout requires a logged-in user.

Depends on

base_rest

Required by other modules

shopfloor_mobile_base_auth_user
Models and fields (1)
  • session.authenticate.service · new model

Text generated by AI (DeepSeek) from reading the Odoo 15.0 code on GitHub; it may contain mistakes, so check the code before deciding. View the code on GitHub

Availability by version

Reviewed: 2026-11-03
Confirmed (verified in repository and branch) Estimated (unverified) No information

Confirmation status: 3 confirmed, 6 with no information of 9 versions.

Sources · Odoo 14.0

Confirmed on 2026-11-03 in branch 14.0 of OCA/rest-framework.

terminal Installation and usage

OCA documentation · Odoo 15.0

Usage

Source · Odoo 15.0

Authentication

To authenticate you need to :code:`POST` a request on :code:`[ODOO HOST]/session/auth/login` with the
following body::

    {
        "db": [DB_NAME],
        "login": [LOGIN],
        "password": [PASSWORD]
    }

:code:`"db"` is not mandatory if Odoo is able to determine it unequivocally (e.g. single database server or
:code:`dbfilter` parameter). If the authentication is successful, the response will contain (in addition to the usual
response of the JSON-RPC authentication)::

    {
        ...
        "session": {
            "sid": "ff6b4bac7a590e7960abfc0ac38361433ecac1d6",
            "expires_at": "2021-09-21 16:53:56"
        }
    }

This :code:`sid` value can then be sent in subsequent requests in the following ways:

* header :code:`X-Openerp-Session-Id`
* cookie named `session_id`
* request param `session_id`

Logout

To logout you need to POST a request on [ODOO HOST]/session/auth/logout with an empty body.

No verified information in OCA: Installation, Configuration.

info

Data imported from GitHub: this sheet reflects the latest catalog review, not a live lookup. Always check the module documentation and staging before installing in production.