Authentication and Scoped API Keys
Choose OAuth, OAuth plus API keys, bearer token, or no authentication and manage secure user-bound keys through their full lifecycle.
Authentication identifies the Odoo user and limits the allowed operation scopes. It is the first layer; Odoo and MCP access controls still decide which models, records, and fields are available.
Warning: Never use No Authentication on the public internet No Authentication is suitable only for isolated development environments with external network controls.
Warning: API keys are displayed once Copy the complete niyu_mcp_... value when it is generated. Odoo stores only a SHA-256 hash and cannot display the secret later.
Authentication modes
| Mode | Best use | Execution identity |
|---|---|---|
| OAuth 2.1 / PKCE | ChatGPT, Claude, Cursor, and interactive remote clients | The Odoo user who signs in and approves the connection |
| OAuth + Scoped API Keys | Interactive users plus automations, developer tools, or clients using Authorization headers | OAuth user or the user assigned to each API key |
| Bearer Token | Legacy or controlled service-account integration | One configured fallback user |
| No Authentication | Isolated development only | One configured fallback user |
OAuth flow
- The client discovers the protected resource and OAuth authorization server from the public Odoo origin.
- The client dynamically registers when supported.
- The browser opens the Odoo login and consent flow.
- The user signs in with their own Odoo account and approves scopes.
- Odoo issues a short-lived access token and a rotating refresh token bound to the /mcp resource.
- The connection appears under MCP Server > Connections.
Generate a scoped API key
- Set Authentication to OAuth + Scoped API Keys and save.
- Open MCP Server > Generate API Key.
- Choose a descriptive key name, client application, and active internal execution user.
- Select only required scopes: Read, Update, Create, and Delete.
- Optionally set expiry, requests per minute, allowed IPs or CIDR networks, denied networks, and notes.
- Generate the key and copy it immediately into the client secret store.
Use an API key
Authorization: Bearer niyu_mcp_your_generated_secretThe key does not bypass the assigned Odoo user, access bundles, fields, forced domains, limits, or tool controls.
Rotate or revoke a key
- Rotate: open MCP Server > API Keys, open the key, and choose Rotate. The default old-key grace period is seven days and can be changed or set to zero.
- Revoke: revoke the key for immediate authentication failure and connection revocation.
- Monitor: review last use, source IP, usage count, expiry, status, and rotation version.
User Roles, Access Bundles, and Model Governance
Assign MCP User or Administrator access, expose exact Odoo models, and restrict permissions, fields, records, result sizes, and tools.
Connect ChatGPT to Odoo
Add the Odoo MCP endpoint as a custom ChatGPT app, complete OAuth, scan tools, test read access, and publish it safely for a workspace.