API keys and exposure
The management API key
The API authenticates callers with a static key sent as an X-Api-Key header. The Web UI presents
the same key, so both sides must agree on one value.
server install handles this for you: it generates a key on first install, stores it in odoo.json
and injects it into both containers. Re-running server install reuses the stored key.
Read it back when you need it for a remote CLI or a script:
# odoocli server info --show-secretsRotating
# odoocli server apikey rotateThis generates a new key, stores it and recreates both management containers with it. Every remote client using the old key stops working until you update it.
The command is deliberately local-only. It refuses remote mode, because it is a repair command that has to keep working when the API is unreachable or its key is lost. Rotating a key over the connection that key authenticates would cut the caller off mid-operation.
More than one key
Registering several keys is supported, each under a name that identifies the caller in the job log. Never reuse one value under two names: the API logs a warning and attributes both callers to one name, which defeats the point.
Exposure
This is the single most important operational fact in this manual.
| Port | Service |
|---|---|
| 5210 | Management API |
| 5220 | Management Web UI |
| 9000, 9443 | Portainer |
| 8081 | pgAdmin |
These listen on the host directly. Only the Odoo instances themselves are proxied by the managed nginx, and only they get its protection.
Restrict all four with a host firewall or reach them over a VPN. A Portainer instance open to the internet is a root shell on your Docker host.
Symptoms of a key mismatch
| Symptom | Cause |
|---|---|
| Every API call returns 401 | The Web UI's key does not match any of the API's keys. Re-run server install, or rotate |
| Every API call returns 503 | odoo.json failed to load. Check the API's health endpoint and the odoo-api container log |
| The UI reports the API as unreachable | odoo-api is not running or not listening on 5210 |
See Troubleshooting for the diagnostic commands.