OdooWiki OCA HUB

Vault

vault folder_open OCA/server-auth open_in_new
Vault License: AGPL-3

This module implements a vault for secrets and files using end-to-end-encryption. The encryption and decryption happens in the browser using a vault specific shared master key. The master keys are encrypted using asymmetrically. For this the user has to enter a second password on the first login or if he needs to access data in a vault. The asymmetric keys are stored for a certain time in the browser storage.

The server can never access the secrets with the information available. Only people registered in the vault can decrypt or encrypt values in a vault. The meta data isn't encrypted to be able to search/filter for entries more easily.

This modules requires a secure context for the browser to work properly and therefore HTTPS support is required.

The vault-recovery project focuses on disaster recovery in case of an incident to recover secrets from old database backups or old exports.

auto_awesome What this module does

AI-generated from the code · Odoo 18.0

Store passwords, secrets and files in encrypted vaults inside Odoo. Share vaults with other users, send secrets to their inbox, and import or export vaults as files.

This module adds a password and secret manager to Odoo. Users create vaults that hold entries; each entry can contain named fields (passwords, tokens) and files, plus a URL, a note, tags and an expiry date. Entries can be nested in a tree, and the full path is shown as the entry name.

Access is controlled per vault through rights: the owner can grant other users read, create, write, share and delete permissions. Only users who have generated their personal key pair can be added. Every change to a vault, entry, field, file or right is written to a log with the user and a message.

Users can send a secret directly to another user's inbox, or share an inbox link so an external person can drop a secret through a public web page. Inboxes have an access counter and an expiration date, and each write is logged.

Vaults and entries can be exported to a JSON file and imported back, optionally including child entries. Administrators can enable or disable the export and import features and the sharing module in Settings. A 'Manage my keys' screen lets users create, view and invalidate their keys; invalidating a key removes all vault accesses and inboxes.

Depends on

base_setupweb

Required by other modules

vault_share

Menus it adds

menu_vaultmenu_vault_entrymenu_vault_inboxmenu_vault_right
Models and fields (19)
  • vault · new modelname, note, uuid, log_ids, user_id, file_ids, entry_ids, field_ids, perm_user, right_ids, master_key, allowed_read, allowed_share, allowed_write, allowed_create, allowed_delete, reencrypt_required
  • res.users · extends an existing modelkeys, inbox_ids, active_key, inbox_link, inbox_token, inbox_enabled, vault_right_ids
  • vault.log · new modelstate, message, user_id, entry_id, vault_id
  • vault.tag · new modelname
  • vault.file · new modelvalue
  • vault.entry · new modelurl, name, note, tags, uuid, expired, log_ids, user_id, file_ids, vault_id, child_ids, field_ids, parent_id, perm_user, expire_date (Expires on), allowed_read, allowed_share, allowed_write, complete_name, allowed_create, allowed_delete
  • vault.field · new modelvalue
  • vault.inbox · new modeliv, key, name, token, secret, log_ids, user_id, accesses (Access counter), filename, expiration, inbox_link, secret_file
  • vault.right · new modelkey, user_id, vault_id, perm_user, master_key, perm_share (Share), perm_write (Write), public_key, perm_create (Create), perm_delete (Delete), allowed_read, allowed_share, allowed_write, allowed_create, allowed_delete
  • res.users.key · new modeliv, salt, uuid, public, current, private, user_id, version, iterations, fingerprint
  • vault.abstract · new model
  • vault.inbox.log · new modelname, inbox_id
  • vault.send.wizard · new modeliv, key, name, public, secret, user_id, filename, key_user, secret_file
  • vault.store.wizard · new modeliv, key, name, model, secret, entry_id, vault_id, master_key, secret_temporary
  • res.config.settings · extends an existing modelgroup_vault_export (Export Vaults), group_vault_import (Import Vaults), module_vault_share
  • vault.export.wizard · new modelname, content (Download), entry_id, vault_id, master_key, include_childs
  • vault.import.wizard · new modelname, path, uuid, content (Database), vault_id, parent_id, master_key, crypted_content
  • vault.abstract.field · new modeliv, name, entry_id, vault_id, perm_user, entry_name, master_key, allowed_read, allowed_share, allowed_write, allowed_create, allowed_delete
  • vault.import.wizard.path · new modelname, uuid

Text generated by AI (DeepSeek) from reading the Odoo 18.0 code on GitHub; it may contain mistakes, so check the code before deciding. The module is very large and only part of the code was read. View the code on GitHub

Availability by version

Reviewed: 2026-11-03
Confirmed (verified in repository and branch) Estimated (unverified) No information

Confirmation status: 5 confirmed, 4 with no information of 9 versions.

Sources · Odoo 13.0

Confirmed on 2026-11-03 in branch 13.0 of OCA/server-auth.

terminal Installation and usage

No verified information

Installation instructions, the distribution package, dependencies and configuration steps are not shown because they have not yet been verified in the module documentation for any version.

info

Data imported from GitHub: this sheet reflects the latest catalog review, not a live lookup. Always check the module documentation and staging before installing in production.