RPC & API Key Access Control

Overview

RPC & API Key Access Control.

RPC and API Key Access Control for Odoo puts a policy gate on every external API authentication path. Each user gets an API Access Allowed toggle: turn it off and that user is blocked at the door before their password is even checked. A second toggle, API Keys Only, forces the user to authenticate with an API key instead of a password. The module ships in Monitor mode so you can see who would be blocked before you enforce anything. When you switch to Enforce, every denied call raises AccessDenied. A global kill switch blocks every external API call in one click. Settings users are exempt so you can never lock yourself out, and every attempt is written to a searchable audit log with automatic retention cleanup. Two gates cover every external path: Gate A on res.users.check catches XML-RPC and JSON-RPC password logins, and Gate B on ir.http._authenticate_explicit catches API key bearer and Outlook plugin authentications. The audit log folds identical outcomes in a five-minute window onto one row with a hit count, so a brute-force attack writes one entry, not ten thousand. Works on Odoo 17, 18 and 19, Community and Enterprise editions, with no external dependencies.