Skip to main content
Connect Odoo under Control Hub → Integrations → Odoo. Each organization supplies its own credentials. Multiple named databases are supported, including separate production and sandbox connections.

​
Setup

  1. Create a dedicated Odoo integration user with the model permissions and company access needed by your agents. For reporting, use a user with read access only.
  2. In Odoo, open Preferences → Account Security → New API Key. Choose a name and permitted expiry, and copy the key.
  3. As an Aster organization admin, add an Odoo connection:
    • Instance Label: a unique name, such as Production.
    • Odoo Server URL: the public HTTPS origin, such as https://your-company.odoo.com. Exclude /web, /odoo, and query parameters. Public Odoo.sh and self-hosted HTTPS servers are supported as well.
    • API Version: JSON-2 for Odoo 19+, or JSON-RPC for Odoo 14–18. Choose explicitly; Aster does not replay operations against another API when a call fails.
    • Database Name: required for JSON-RPC; also needed for JSON-2 when the hostname alone does not select a database.
    • Login Email: the key owner’s Odoo login, required for JSON-RPC. JSON-2 uses the API key directly.
    • API Key: the key created in Odoo.
  4. Aster checks authentication using field metadata before saving the connection. This check does not change business records or prove access to every model.
  5. Add the appropriate tools to your agent.
Odoo’s hosted external API requires an eligible plan; its documentation lists Custom plans and excludes One App Free and Standard. Check API availability for your deployment with your Odoo administrator.

​
Tools

The first three tools call only Odoo read/metadata methods. They do not expose arbitrary RPC methods. The write tool uses explicit record IDs for updates and deletes and may trigger Odoo automations. Business actions such as confirming a sales order or posting an invoice are not exposed by this connector’s CRUD tool. Odoo permissions remain the enforcement boundary, including for customer-installed model overrides.

​
Multiple databases and companies

Each connection has an instance slug, shown in Integrations. Tools accept instance; omitting it uses the organization’s default. An unknown named instance fails rather than falling back to another database. Use Add another, Make default, and Disconnect to manage connections individually. Within a database, context.allowed_company_ids selects accessible companies. Omit it to use the Odoo user’s default context. Odoo record rules and company permissions always apply. A successful query can return only a subset of the company’s records if the integration user has restricted access.

​
API key expiry and rotation

Edit the existing connection and enter a replacement API key to rotate it. Leave the key blank when editing other settings to preserve the saved key. Changing the server origin requires re-entering a key, so an existing secret is not silently forwarded to another destination. A one-day maximum can be an Odoo user/group policy. Odoo’s source computes permitted key duration from the user’s groups and falls back to one day when no longer duration is granted. Ask an Odoo administrator to review the integration user’s allowed key duration. Limits vary with version and configuration; do not assume keys are permanent. Aster does not create keys or change Odoo permissions automatically. Expired/revoked keys produce an authentication error with a reconnect hint.

​
Limits and troubleshooting

  • Queries return pages of up to 200 records, with has_more and next_offset. Use count or grouped aggregates for totals. Offset pages can shift during concurrent changes in Odoo.
  • Select only needed fields. Responses that exceed the size limit fail with guidance to narrow the request; they are not silently presented as complete results.
  • Model discovery uses ir.model, which some integration users cannot read. You can still inspect fields on a known model with odoo_get_schema.
  • Writes are not automatically retried. After a timeout or connection failure, read the affected records before retrying because the first request may already have committed.
  • Private-network servers and redirects are rejected. Use the final public HTTPS origin of your deployment.
References: Odoo 19 JSON-2 API, Odoo 18 external API, Odoo key-duration policy implementation.