Securing API Keys and Sensitive Data in Odoo: Best Practices

stripe_api = "sk_live_51234567890abcdef"  # EXPOSED!

stripe_api = os.environ.get('STRIPE_API_KEY')  # Secured!

# ❌ Hardcoded in code
stripe_key = "sk_live_abc123"

# ❌ Stored in git repository
# git log shows entire history of secrets

# ❌ Logged in error messages
logger.error(f"API call failed with key {api_key}")

# ❌ Stored in database without encryption
config['stripe_key'] = "sk_live_abc123"  # Plain text!

# ❌ Sent in emails or Slack
"Here's the API key: sk_live_abc123"

STRIPE_API_KEY=sk_live_abc123
TWILIO_API_KEY=twilio_secret_xyz
MAILCHIMP_API_KEY=mailchimp_token_789
DATABASE_PASSWORD=super_secret_123

.env
.env.local
.env.*.local

import os

stripe_key = os.environ.get('STRIPE_API_KEY')
if not stripe_key:
    raise Exception("STRIPE_API_KEY environment variable not set")

# Use stripe_key for all API calls

# Option 1: Set before running Odoo
export STRIPE_API_KEY="sk_live_abc123"
./odoo-bin -c /etc/odoo/odoo.conf -d database_name

# Option 2: Docker (recommended)
# docker-compose.yml
environment:
  - STRIPE_API_KEY=sk_live_abc123
  - TWILIO_API_KEY=twilio_secret_xyz

from odoo import models, fields, api

class StripeSetting(models.TransientModel):
    _name = 'stripe.settings'
    _inherit = 'res.config.settings'
    
    stripe_api_key = fields.Char(
        string='Stripe API Key',
        help='Get from https://dashboard.stripe.com/apikeys'
    )
    
    @api.model
    def get_values(self):
        res = super().get_values()
        config = self.env['ir.config_parameter'].sudo()
        res.update(
            stripe_api_key=config.get_param('stripe.api_key', ''),
        )
        return res
    
    def set_values(self):
        res = super().set_values()
        config = self.env['ir.config_parameter'].sudo()
        config.set_param('stripe.api_key', self.stripe_api_key)
        return res

class PaymentProcessor(models.Model):
    _name = 'payment.processor'
    
    def process_payment(self):
        api_key = self.env['ir.config_parameter'].sudo().get_param(
            'stripe.api_key'
        )
        # Use api_key

from odoo import models, fields, api
from cryptography.fernet import Fernet
import os

class SecurePaymentConfig(models.Model):
    _name = 'secure.payment.config'
    
    name = fields.Char(string='Config Name', required=True)
    
    # Encrypted field (stored encrypted in database)
    api_key = fields.Char(
        string='API Key',
        groups='base.group_system',  # Only system admin can read
    )
    
    # Store encryption key in environment (NOT database)
    _encryption_key = os.environ.get('ENCRYPTION_KEY')
    
    def _encrypt_api_key(self, api_key):
        """Encrypt before storing."""
        if not self._encryption_key:
            raise Exception("ENCRYPTION_KEY not set")
        cipher = Fernet(self._encryption_key.encode())
        return cipher.encrypt(api_key.encode()).decode()
    
    def _decrypt_api_key(self, encrypted_key):
        """Decrypt when retrieving."""
        if not self._encryption_key:
            raise Exception("ENCRYPTION_KEY not set")
        cipher = Fernet(self._encryption_key.encode())
        return cipher.decrypt(encrypted_key.encode()).decode()
    
    @api.model_create_multi
    def create(self, vals_list):
        """Encrypt API key before storing."""
        for vals in vals_list:
            if 'api_key' in vals:
                vals['api_key'] = self._encrypt_api_key(vals['api_key'])
        return super().create(vals_list)
    
    def get_decrypted_api_key(self):
        """Retrieve decrypted API key."""
        return self._decrypt_api_key(self.api_key)

odoo_project/
├── .env                    # Local secrets (never commit)
├── .env.production         # Production secrets
├── .gitignore              # Includes .env
├── docker-compose.yml      # Load .env
├── odoo/
│   ├── models/
│   │   └── payment_integration.py
│   └── views/
│       └── payment_settings_views.xml
└── .github/
    └── workflows/
        └── deploy.yml      # Secure secret injection

from odoo import models, fields, api
from odoo.exceptions import ValidationError
import os
import requests

class PaymentGateway(models.Model):
    _name = 'payment.gateway'
    
    name = fields.Char(string='Gateway Name', required=True)
    provider = fields.Selection([
        ('stripe', 'Stripe'),
        ('paypal', 'PayPal'),
        ('square', 'Square'),
    ])
    is_active = fields.Boolean(default=True)
    
    def action_process_payment(self, amount, customer):
        """Process payment using configured gateway."""
        # Retrieve API key from environment or config
        api_key = self._get_api_key()
        if not api_key:
            raise ValidationError("Payment gateway API key not configured")
        
        # Log transaction (without exposing API key!)
        self.env['payment.log'].create({
            'gateway': self.name,
            'amount': amount,
            'customer': customer.name,
            'masked_key': api_key[:10] + '***',  # Log masked key
            'timestamp': fields.Datetime.now(),
        })
        
        # Call payment API
        response = requests.post(
            f'https://api.{self.provider}.com/payments',
            headers={'Authorization': f'Bearer {api_key}'},
            json={'amount': amount, 'customer': customer.id}
        )
        return response.json()
    
    def _get_api_key(self):
        """Get API key from secure source."""
        # Priority 1: Environment variable
        env_key = os.environ.get(f'{self.provider.upper()}_API_KEY')
        if env_key:
            return env_key
        
        # Priority 2: ir.config_parameter
        config = self.env['ir.config_parameter'].sudo()
        key = config.get_param(f'payment.{self.provider}.api_key')
        if key:
            return key
        
        # Priority 3: Company-specific config
        company = self.env.company
        if hasattr(company, f'{self.provider}_api_key'):
            encrypted_key = getattr(company, f'{self.provider}_api_key')
            return self._decrypt(encrypted_key)
        
        return False

version: '3'
services:
  odoo:
    image: odoo:18
    ports:
      - "8069:8069"
    environment:
      - HOST=db
      - USER=odoo
      - PASSWORD=odoo
      - STRIPE_API_KEY=${STRIPE_API_KEY}
      - TWILIO_API_KEY=${TWILIO_API_KEY}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
    depends_on:
      - db
  
  db:
    image: postgres:15
    environment:
      - POSTGRES_DB=odoo
      - POSTGRES_USER=odoo
      - POSTGRES_PASSWORD=${DB_PASSWORD}

# Create .env file
cat > .env << EOF
STRIPE_API_KEY=sk_live_abc123
TWILIO_API_KEY=twilio_secret_xyz
ENCRYPTION_KEY=your_encryption_key_32_chars
DB_PASSWORD=super_secret_db_password
EOF

# Run (loads .env automatically)
docker-compose up -d

class SensitiveActionLog(models.Model):
    _name = 'sensitive.action.log'
    
    action = fields.Char(required=True)  # What happened
    user_id = fields.Many2one('res.users', required=True)  # Who did it
    timestamp = fields.Datetime(auto_now_add=True)  # When
    ip_address = fields.Char()  # From where
    result = fields.Selection([
        ('success', 'Success'),
        ('failed', 'Failed'),
    ])
    details = fields.Text()  # What was the operation
    
    @staticmethod
    def log_api_access(user, action, result='success', details=''):
        """Log access to sensitive operations."""
        request = request.environ.get('werkzeug.request')
        ip = request.remote_addr if request else 'unknown'
        
        return CurrentRecordEnv['sensitive.action.log'].create({
            'action': action,
            'user_id': user.id,
            'ip_address': ip,
            'result': result,
            'details': details,
        })

class PaymentProcessor(models.Model):
    _inherit = 'payment.processor'
    
    def process_payment(self):
        try:
            # Process payment
            result = self._call_stripe_api()
            
            # Log success
            SensitiveActionLog.log_api_access(
                user=self.env.user,
                action='Payment processed via Stripe',
                result='success',
                details=f'Amount: $' + '{result["amount"]}'
            )
        except Exception as e:
            # Log failure
            SensitiveActionLog.log_api_access(
                user=self.env.user,
                action='Payment processing failed',
                result='failed',
                details=str(e)
            )