Credentials and security · SmartERP Documentation

Where secrets live, who can read them, and the short list of things to do before going live.

Where each secret lives#

Secret	Held in	Who can read it
Platform tokens (Telegram bot, Facebook page, Instagram, X)	The base module's channel and account records	Managers only (the AI Workforce restricts it)
Account API Access Token (Social Marketing)	The account record	Managers only, at field level
Shared API key	A system parameter	Whoever can open System Parameters (Settings users)
AI provider key	n8n's credential store	Whoever administers n8n
Odoo master password	`odoo.conf` (`admin_passwd`)	Whoever can read the file

Prefer keeping platform tokens in n8n, not Odoo. Then a leaked Odoo backup cannot publish as you.

Before you go live#

Change the demo login. admin / admin in the Docker demo is public knowledge.
Change admin_passwd in odoo.conf.
Use HTTPS in front of anything that carries the shared key. Terminate TLS at a reverse proxy.
Replace placeholder tokens in seeded channels with real ones, or leave them: nothing is published to a real network without real accounts.
Set a strong shared API key, only when you are ready to use n8n. Until then leave it empty and the webhooks stay closed.
Review who is a Manager. See Users and access.
Set web.base.url to your public address.

The webhooks#

Authenticated with the shared API key, compared in constant time.
Closed by default. With no key set, every call is refused.
Not protected by an Odoo login and not subject to CSRF (they are machine-to-machine). The key is the only protection, so treat it like a password and keep it out of logs, tickets and screenshots.
Restrict them at the proxy if you can, for example to n8n's IP address.

The audit trail#

The AI activity log cannot be edited by anyone, and every publish decision is recorded there. That includes refusals. It is safe to hand to an auditor.

Backups contain secrets#

A database dump holds every token stored in Odoo. Store dumps as carefully as the tokens themselves. See Backup and restore.

What is not protected#

Odoo Data Access and Channels on an agent are descriptions, not restrictions. See The agent registry.
In Social Marketing, Publish Now is open to every user. See Compose and manage posts.
Publishing done by n8n outside Odoo is outside the publishing gate.