Odoo 19 API key connection: fallback and clearer errors

Shuttio's Odoo connection now handles three cases on Odoo 19 and later: a server that hides its version page, a server whose JSON-2 route is missing, and a password pasted where an API key belongs. In each case you can connect with a URL, database, login and API key, and Shuttio picks the transport for you. These changes run only while Shuttio's ODOO_JSON2_ENABLED setting is on. The code ships with it off.

What changed

Shuttio checks /web/version first. If that page answers, Shuttio uses JSON-2. If it does not, Shuttio asks the older version route. With the setting on, a server that reports Odoo 19 or later through that older route also gets JSON-2.

If a JSON-2 call returns a 404 with no JSON error body, Shuttio logs in once over JSON-RPC and stays on JSON-RPC until it next opens the connection. If that login fails too, Shuttio shows the original JSON-2 error. A wrong database name therefore still reads "Odoo could not find this database." A 404 that carries an Odoo error body, such as an unknown model, counts as an answer from Odoo. Shuttio does not fall back on it.

When Odoo refuses the login during the connect check on a JSON-2 connection, the message now ends with: "Odoo 19 and later accept only an API key here, not your password. Create one in Odoo under your profile → Account Security → New API Key."

JSON-2 requests also send a User-Agent header: Shuttio (+https://shuttio.com).

How to use it

1. Create a migration with Odoo as the destination and open its Connect step.
2. In Odoo, open your profile, go to Account Security, and choose New API Key. Use an administrator's key. On a self-hosted Odoo, a user without enough access gets "This Odoo user cannot read the data we need. Use an administrator's API key." On Odoo Online, the same case shows a message about API access on your plan.
3. In Shuttio, enter the Odoo address, the database, your login email and the API key.
4. Connect. Shuttio checks the connection before it keeps the key, and it also checks that the CRM app is installed. If the CRM app is missing, the message says to install it in Odoo (Apps → CRM → Activate) and connect again.
5. If you see the API-key sentence, replace what you pasted with a key from step 2.

You do not choose a transport. Shuttio detects it each time it opens a connection.

What it does not cover

• Odoo app and import package. They do not use the URL, database, login and key form, so none of this applies to them.
• Odoo 17 and 18. They keep using JSON-RPC. Shuttio supports Odoo 17 and later and refuses older versions with a message naming the version it found.
• The setting. Everything above needs ODOO_JSON2_ENABLED on. With it off, Shuttio uses JSON-2 on Odoo 19 and later only when /web/version answers, sends no User-Agent, and adds no API-key sentence.
• Self-hosted servers behind a proxy. The fallback has not been checked live against a self-hosted Odoo 19+ server behind a proxy that hides /json/2.
• Other errors. A wrong address or an unreachable server keeps its own message. Only a refused login on a JSON-2 connection gets the API-key sentence.

FAQ

Do I need to reconnect an Odoo 19 connection I already made? No. Shuttio detects the transport each time it opens a connection to your Odoo.

Why does Odoo refuse my login when my password works in the browser? On Odoo 19 and later this form takes an API key. With the setting on, the connect check says so. Create a key under Account Security and paste it into the API key field.

What does Shuttio do after it switches to JSON-RPC? It sends the same model, method and parameters over JSON-RPC and stays on JSON-RPC until it next opens the connection. It then detects the transport again.