A checklist for integrating Odoo with third-party APIs

Most integration failures happen after launch, when a remote API times out or sends a duplicate webhook.

Authenticate properly

Use OAuth2 or signed tokens, rotate secrets and never store keys in module code. Keep them in system parameters or environment variables.

Make calls idempotent

Store an external reference on every record you create so a retried request updates instead of duplicating.

Queue and retry

Push outbound calls to a queue with exponential back-off. Log every request and response with a correlation ID.

Validate webhooks

Verify signatures and reject replays. Respond fast, then process asynchronously.