Security and access
The User and Manager roles, what each can reach, and how credentials are protected.
The module defines two groups under the Social Marketing category.
Roles#
| User | Manager | |
|---|---|---|
| Create and edit posts and campaigns | β | β |
| Delete posts and campaigns | β | |
| Submit a post for approval | β | β |
| Schedule directly, approve, reject | β | |
| Read accounts and templates | β | β |
| Create, edit and delete accounts and templates | β | |
| See and set API access tokens | β | |
| Create hashtags | β | β |
| Delete hashtags | β | |
| Use the compose wizard | β | β |
| n8n Automation Settings and the Configuration menu | β |
A Manager is also a User. The administrator is made a Manager when the module is installed.
Credentials#
- The API Access Token field on an account is restricted to Managers at the field level. A User cannot read it, even through the API.
- The Automation Settings screen, which holds the shared API key, is Manager-only.
- Tokens are shown as password fields and only when Test Mode is off.
Multi-company#
Accounts, campaigns and posts each belong to a company (a post takes its account's company). A user only sees records of the companies they have switched on, and records with no company are visible to everyone.
The webhook routes#
The /social_media/webhook/... routes are unauthenticated from Odoo's point of view and rely entirely on the shared API key sent in the X-Api-Key header:
- The key is compared in constant time.
- Leave the key blank (the default) and the endpoints are disabled. Every call then returns
401. - Set the key only when you are ready to use n8n, and only over HTTPS.
See Webhook API for the routes.
Important
Treat the shared API key like a password. Rotate it by changing Odoo's setting and n8n's environment variable together.