Users and roles
These are the accounts that sign in to the management Web UI. They are separate from the Odoo users inside a database, which are managed per database.
The four roles
| Role | Can |
|---|---|
| Administrator | Everything, including users, licences and server-level operations |
| ReadOnlyAdministrator | See everything an administrator can, change nothing |
| Operator | Day-to-day operations on the instances they are scoped to |
| Viewer | Read-only, on the instances they are scoped to |
The first account created during setup is an Administrator and is protected: it cannot later be deleted, disabled or demoted. Locking every administrator out of the console is the one failure with no remedy from inside the console, so the product refuses to allow it.
Instance scoping
Operators and Viewers can be limited to particular instances. This is what makes a shared console workable for a hosting company: a customer's operator sees their own instances and nothing else.
Scoping is by instance id, and it applies to what the API returns, not only to what the UI draws.
Role enforcement happens on the API using the user identity the Web UI forwards. The API key is the machine boundary: anything holding a valid API key is a trusted caller, and roles refine what that caller may do on behalf of a user.
Treat the API key as equivalent to administrator access, and do not hand it to someone you only meant to give Viewer.
Managing users
Users in the Web UI. Adding a user, setting their role, scoping them to instances and requiring multi-factor authentication all happen there.
Break-glass recovery from the host
When nobody can sign in, the CLI can repair accounts locally:
# odoocli user list# odoocli user password-reset admin# odoocli user totp-disable admin# odoocli user unlock adminThese are deliberately local-only and require root on the server. They are the way back in when MFA is lost or an account is locked out, and they are the reason shell access to the host must be protected at least as carefully as the console itself.