Odoo API Key Rotation: What to Do When a Connected System Is Hacked

On 21 October 2026 PHP shipped emergency fixes for two critical PHP2shell flaws. Odoo was not the target, but many Odoo databases trust a PHP webshop or portal. Our Odoo integration services team now gets one question daily: is our Odoo exposed?

This guide is for IT leads and Odoo admins who run Odoo next to WooCommerce, Magento, PrestaShop or a custom PHP portal. For the API basics, start with our Odoo API integration guide; this post covers what to do when trust breaks.

Is Odoo affected when a connected PHP system is compromised?

Odoo is not directly affected by a PHP vulnerability, but a compromised PHP system can hand an attacker the keys it uses to reach Odoo. That makes it an Odoo security problem even though the flaw is elsewhere.

The PHP2shell flaws, CVE-2026-109618 and CVE-2026-109619, allow remote code execution on web servers that run PHP. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. An attacker with code execution can read config files, environment variables and the database of that server.

That is where Odoo credentials usually live. A WooCommerce connector stores an Odoo URL, database name, login and API key or password. Whoever reads that file can call Odoo with the same rights as the connector, from anywhere.

So the right question is not "is Odoo vulnerable" but "what could someone do in Odoo with the credentials our webshop holds". If the answer is "create invoices, edit customers or export the price list", you rotate today.

What Odoo credentials can a connected system hold?

A connected system can hold Odoo credentials going in, and Odoo can hold that system's credentials going out. Both directions need rotation after a breach.

The last row is the one most teams forget. A no-code flow often holds full credentials for both Odoo and the store. Our n8n Odoo integration guide shows where those credentials sit.

How do Odoo API keys work from Odoo 14 to Odoo 20?

Odoo API keys replace the password for external calls, and each version since Odoo 14 has added more control over expiry and revocation. Your incident plan depends on which version you run.

Odoo's API key documentation for Odoo 17 says a key gives essentially the same access as the user's password, although it cannot be used to log in to the web interface. Treat a leaked key exactly like a leaked password.

The key is a 160-bit random value shown only once. Odoo stores a hash, so nobody can read an existing key back from the database. If you lost track of which key went where, you cannot look it up; you can only delete and reissue.

If you are still on Odoo 17 or older, your keys never expire, and Odoo 17 standard support ended in September 2026. Our post on unsupported Odoo version security risks explains why that doubles the exposure.

When should you rotate an Odoo API key?

Rotate an Odoo API key on a schedule and immediately after any event that could have exposed it. A schedule handles slow leaks; events handle fast ones.

Rotate at once when any of these happen:

• A connected server, plugin or hosting account is compromised or patched for a critical flaw.
• A developer, agency or freelancer with access to the connector leaves the project.
• A key was pasted into a ticket, chat, email, Git repository or shared document.
• You see API calls from an unknown IP address or at odd hours in your logs.
• An Odoo user who owns an integration key changes role or leaves.
• You change hosting, move to Odoo.sh, or restore a database copy to a test server.

For scheduled rotation, Odoo's external API documentation says long-lasting keys must be rotated at least once every three months. Shorter is better for keys on public-facing systems.

How do you rotate an Odoo API key without breaking the integration?

Create the new key first, deploy it, confirm traffic moves, then revoke the old one. In a confirmed breach, flip the order and revoke first, accepting a short outage.

This is the planned rotation sequence we use, and it matches Odoo's own best practice list for Odoo 19 and 20:

1. List every integration and the Odoo user and key description each one uses.
2. Log in as the integration's bot user, or as an admin acting for it, and open Preferences, then Account Security.
3. Click New API Key (Add API Key in newer screens), give it a clear description with the system name and date, and pick an expiry.
4. Copy the key into the connector's secret store, never into code, chat or email.
5. Restart or reload the connector, then run one test order, stock update or invoice sync.
6. Check that new records show the bot user as the author and that no 401 "Invalid apikey" errors appear.
7. Delete the old key in Account Security, or call the revoke method using the new key.
8. Record the date, owner and next rotation date in your runbook.

On Odoo 19 and 20 an admin can script steps 3 and 7 with the res.users.apikeys generate and revoke methods. Odoo suggests authenticating with the new key to revoke the old one. By default only users with Settings access can call these methods.

On XML-RPC, the key replaces the password in the same login call. XML-RPC and JSON-RPC are deprecated in Odoo 20, so plan the move with our Odoo JSON-2 API migration guide.

How do you revoke an Odoo API key in an emergency?

In a live incident, revoke every key the compromised system could reach, block its user, and only then work out what happened. Speed matters more than a clean handover.

Use the fastest tool that fits:

The Manage API Keys screen sits in Settings for administrators and lists keys for all users. The devices list and the log out option are covered in Odoo's user devices guide.

Archiving is the blunt tool. Odoo only accepts keys whose user is active, so archiving the integration user cuts off every key it owns. Orders will stop flowing, so tell sales and warehouse teams before you do it.

What should you check in Odoo after revoking a compromised key?

After revocation, look for what the attacker may have changed or created while the key worked. Odoo records who created and last changed each record, which is why a dedicated bot user makes the review fast.

Work through this review list:

1. Open Manage API Keys and delete any key you did not create, including keys on admin users.
2. Check the user list for new users, new admin rights or changed email addresses.
3. Filter recent invoices, vendor bank accounts and payments by "last updated by" the integration user.
4. Review customer and supplier records for changed bank details, the classic payment fraud path.
5. Look at Odoo.sh or server logs for API calls from unknown IP addresses during the exposure window.
6. Check outgoing email and automation rules for anything added or edited recently.

Point 1 matters on Odoo 19 and 20. If a leaked key belonged to an admin, the attacker could create new keys through the API, and revoking only the original key leaves them in.

Our Odoo shared user account guide explains why a shared login ruins this audit: when five people and two connectors use one user, you cannot tell which change came from where.

How do you limit the damage of the next leaked Odoo API key?

Give each integration its own bot user with the fewest rights it needs, a short-lived key and no password login. Then a leak exposes one narrow lane, not your whole database.

Odoo's own documentation recommends dedicated bot users, minimum permissions and an empty password for API users. For human admins, follow Odoo's two-factor authentication guide, so a stolen password alone is not enough.

Set access with Odoo's access rights settings and test them: try to open an accounting report as the bot user. If it works and the connector only syncs stock, the rights are too wide.

The same rules apply to AI agents. An MCP server holds an Odoo key just like a webshop, so scope it the same way, as we explain in our Odoo 20 MCP server guide.

Which tokens does Odoo hold for other systems, and how do you rotate them?

Odoo often stores API tokens for your storefront, marketplace, payment and shipping accounts, and those need rotation too. If the attacker reached Odoo or its server, assume those tokens are exposed.

Most eCommerce connectors keep the other platform's credentials inside Odoo settings. Rotation happens on the other platform: issue a new token there, paste it into Odoo, run a test sync, then delete the old token on the platform.

For webhooks, change the shared secret and any token in the URL, since an old webhook URL lets anyone send fake orders. Our Odoo eCommerce integration guide covers how these sync flows are wired.

Which industries carry the most Odoo integration credential risk?

Businesses whose Odoo talks to public-facing PHP systems or payment flows carry the highest risk, because those systems face the internet all day. The table shows where we focus first.

How iVentureTeam helps with Odoo API key rotation

We find every credential your integrations use, rotate it without stopping orders, and leave you a runbook for next time. We have delivered 150+ ERP projects across 35+ countries with 40+ Odoo specialists over 13+ years.

• Integration inventory: every connector, middleware flow, webhook and AI agent mapped to the Odoo user and key it uses.
• Planned or emergency rotation: new keys deployed, tests run, old keys revoked, with the sales and warehouse teams kept informed.
• Bot user hardening: dedicated users, minimum rights, empty passwords and 2FA on human admins.
• Post-incident review: record changes, bank detail edits and unknown keys checked across the exposure window.
• Ongoing care: scheduled rotation and monitoring through our Odoo ERP support plans.

Not sure where your setup stands? Start with our free Odoo health check tool before you plan the rotation work.

Odoo integration credentials case study: a North American retailer

A retail eCommerce operator kept its Lightspeed storefront and connected it to Odoo, with the API credentials managed inside the Odoo back end. It shows why the outbound direction of rotation matters.

The retailer's storefront ran on Lightspeed eCommerce while operations moved to Odoo. Before the connector, products, orders and customers existed twice, and online stock drifted from the warehouse.

We built a scheduled, two-way connector in 6 weeks. It imports 9 record types from Lightspeed into Odoo and exports 3 data streams back, including prices, stock and order status. Credential setup and mapping live in Odoo, with no external middleware.

That design means rotating the Lightspeed credentials is one change inside Odoo, followed by a test sync. Read the Lightspeed and Odoo two-way integration case study.

The bottom line on Odoo API key rotation

If a system connected to Odoo is compromised, revoke what it held, issue new keys to dedicated bot users, and check what changed while the old keys worked. Odoo may be untouched, but its trust in that system is not.

Most teams find the real gap is not the flaw itself but the lack of a list: which systems hold which keys, owned by which users. Build that list now, set expiry dates, and the next rotation becomes a routine half-day task.

Ready to rotate your Odoo integration keys safely?

Get every connector, key and bot user checked before the next breach headline. Request an Odoo integration security review, call +91-90235-15208, or email business@iventureteam.com.