Connect Odoo 19 with an API key: what changed

Shuttio can connect to Odoo 19 and later over Odoo's JSON-2 API even when a proxy hides the standard version page. If Odoo refuses your credentials on one of these versions over JSON-2, the connect step adds a sentence saying that Odoo 19 and later accept only an API key, not your password. Everything described here applies only while Shuttio's ODOO_JSON2_ENABLED setting is on. It is off by default. With it off, Shuttio uses JSON-2 on Odoo 19 and later only when /web/version answers, and JSON-RPC on Odoo 17 and 18. To connect, create an API key under your Odoo profile and paste it into the Odoo key form on the Connect step.

This applies to Odoo destinations that connect with a URL, database, login and API key. The Odoo app and the import package do not use this form.

What changed

Shuttio changed three things on the path for Odoo 19 and later. All three apply only while the setting above is on.

Version detection. Shuttio first asks the server for /web/version. When the server answers, Shuttio uses JSON-2. Some proxies hide that page. When it is hidden, Shuttio asks the older version route instead. If that route reports Odoo 19 or later, Shuttio now uses JSON-2 for the connection. Before this change, a server seen only through the older route got the older API.

One fallback. If a JSON-2 call gets a 404 with no JSON body, either the route is missing or Odoo does not know the database. Shuttio then logs in over the older JSON-RPC API once and stays on it for that connection. If that login also fails, Shuttio shows the original JSON-2 error, so a wrong database name still gets the message "Odoo could not find this database." A 404 that carries an Odoo error body, such as an unknown model, is an answer from Odoo. Shuttio does not fall back on it.

A clearer refusal. When an Odoo 19 or later server refuses the key during the connect check, the error now ends with this sentence: "Odoo 19 and later accept only an API key here, not your password. Create one in Odoo under your profile → Account Security → New API Key."

While the setting is on, Shuttio also names itself in a User-Agent header on JSON-2 calls: Shuttio (+https://shuttio.com).

How to use it

1. Start a migration with Odoo as the destination and open its Connect step.
2. Use the Connect with an API key form. If the migration was set to the import package, or to the Odoo app and the app has not paired yet, press Choose another way first.
3. In Odoo, open your profile, then Account Security, then New API Key. The form's help text says to use an administrator's key and to set it to last until the migration ends.
4. In Shuttio, fill in Odoo address (for example https://acme.odoo.com), Database, Login (email) and API key. On odoo.com you can leave Database blank.
5. Press Connect Odoo. Shuttio checks the connection before it stores the key. A failed check stores nothing.
6. If the setting is on and the check fails with the API-key sentence above, create a new key and paste it into the API key field instead of the password.

You do not choose a transport. Shuttio picks it each time it opens a connection to your Odoo.

What it does not cover

• The Odoo app and the import package. They do not use the URL, database, login and key form, so this change does not affect them.
• Odoo 17 and 18. These versions keep using the JSON-RPC API. Shuttio supports Odoo 17 and later, and refuses anything older with a message naming the version it found.
• The key hint on every failure. The API-key sentence is added when the connect check reaches Odoo over JSON-2 and Odoo refuses the key. A wrong address or a missing CRM app still shows its own message.
• Key lifetime. Shuttio does not manage your key's expiry. Set the key to last until the migration ends, as the form's help text says.

FAQ

Do I need to change anything if I already connected Odoo 19? No. Shuttio detects the transport each time it opens a connection. Shuttio does not use the transport saved with the connection to choose it.

Why does Odoo say my login is wrong when my password works in the browser? On Odoo 19 and later, this form takes an API key, not your password. While the setting is on, the connect step says so when Odoo refuses the key. Create a key under Account Security and paste it into the API key field.

What does the fallback to the older API send? Shuttio sends the same model, method and parameters over the older API, and stays on it for that connection once it has switched.