Secure Endpoints

Each endpoint gets a unique UUID-based URL that is unguessable. No public listing, no sequential IDs — only someone with the exact URL can send data to your endpoint.

Multi-Layer Authentication

Verify requests with HMAC signatures (SHA-1/256/512), Bearer Tokens, or IP Whitelisting (with CIDR support). Compatible with GitHub, Shopify, and custom providers out of the box.

Visual Field Mapper

Map incoming JSON keys to Odoo fields with a no-code visual interface. Supports dot-notation for nested values (e.g., data.object.email) and automatic data type conversion.

None

No authentication — open endpoint. Suitable for internal use or when IP whitelisting is enough.

nx_auth_type = none

POST /nx/webhook/receive/<token>
Content-Type: application/json

{"name": "John", "email": "john@example.com"}

Bearer Token

Set a static secret token. The sender must include it in the Authorization header.

nx_auth_type  = token
nx_auth_token = mysecrettoken123

Authorization: Bearer mysecrettoken123

HMAC — GitHub / Shopify Style

HMAC-SHA256 over the raw body. Signature is prefixed with sha256= and sent in a custom header.

nx_auth_type      = hmac
nx_hmac_secret    = myhmackey
nx_hmac_header    = X-Hub-Signature-256
nx_hmac_algorithm = sha256
nx_hmac_prefix    = sha256=

X-Hub-Signature-256: sha256=<hex_digest>

HMAC — Custom Prefix Style

HMAC over the raw body with a custom header name and prefix. Works with any service that sends prefix=hex.

nx_auth_type      = hmac
nx_hmac_secret    = whsec_testkey
nx_hmac_header    = Stripe-Signature
nx_hmac_algorithm = sha256
nx_hmac_prefix    = v1=

Stripe-Signature: v1=<hex_digest>

Receive Stripe webhook events (payment_intent.succeeded, charge.refunded) to automatically create payment records or update invoice status in Odoo. Use the pre-process script to handle Stripe's custom signature format.

Sync new Shopify orders directly into Odoo as sale orders — including automatic customer creation and product matching via upsert logic.

Receive push events, issue creation, or PR merge notifications. Auto-create project tasks, log deployments, or update internal tracking records.

Connect Typeform, JotForm, Google Forms (via Zapier), or any web form to Odoo. Auto-create leads, contacts, or support tickets from form submissions.

Receive JSON payloads from IoT devices, environmental sensors, or industrial equipment. Log readings as Odoo records for monitoring and reporting.

Let partners push data into Odoo — inventory updates, price changes, or order confirmations — through a secure, authenticated endpoint.

Path A — Standard Pipeline

• 4. Field mapping converts JSON to Odoo field values
• 5. CRUD operation creates, updates, or upserts the record
• 6. Response script shapes the HTTP reply and runs side effects
• 7. Full request is logged with the linked record

Path B — Execute Script

When the operation is set to Custom, the Execute Script replaces the entire standard pipeline (steps 4–7).

Your script receives the payload and Odoo environment, performs any custom logic, and sets the HTTP response body and status code directly. The request is still logged.

Ideal for complex integrations that don't fit the standard field-mapping pattern.

No Coding Required

Create endpoints, map fields, and set authentication entirely from the Odoo UI. No custom controllers, no Python modules to write, no deployment needed. Optional scripts available when you need more control.

Enterprise-Grade Security

UUID tokens, HMAC signature verification with constant-time comparison, IP whitelisting with CIDR support, and role-based access control. Your endpoints are locked down.

Smart Record Handling

Upsert logic finds existing records by match fields and updates them, or creates new ones. Many2one auto-resolution links related records automatically. No duplicate data.

Full Audit Trail

Every request is logged with the raw payload, auth result, mapped values, and linked record. Replay failed requests after fixing your configuration.

Works With Any Service

Stripe, Shopify, GitHub, GitLab, Typeform, Zapier, Make, n8n, or your own custom systems — any service that can send an HTTP POST with JSON works.

Built for Odoo 19

Written from the ground up for Odoo 19 with modern ORM patterns, proper access control, and clean, upgrade-safe code.