Connection and Authentication
Add one or more Odoo servers, choose how to authenticate, and if you wish, protect access with the biometrics of your Android device. Credentials are never saved in plain text: they remain always encrypted in your phone or tablet's hardware.
Overview
Before using any SiltaFlow feature you must connect the app to your Odoo server. The configuration is called a "connection profile" and contains everything you need: the server address, the database name, your username, and login credentials.
You can create as many profiles as you want: one for production, one for the test environment, one for each client or branch. Switching from one profile to another takes just one tap, and the app always remembers which one is active so you never accidentally work on the wrong server.
On first launch, SiltaFlow guides you directly to the screen for adding your first profile. After saving it, the app is ready to use.
Creating a connection profile
Go to Settings › Connections and tap the "+" button in the top right. The configuration form opens with the following fields:
| Field | Description | Example |
|---|---|---|
| Profile name | A descriptive label to recognize the profile in the list | Produzione – Acme S.p.A. |
| Server URL | Full address of the Odoo instance, with protocol and port if different from 443/80 | https://mioserver.com:8069 |
| Database | Name of the Odoo database (visible on Odoo's web login page) | mydb_prod |
| Username / Email | The email address you normally use to log in to Odoo | mario@azienda.it |
| Auth mode | Username+Password or API Key (see next section) | Username + Password |
| Password / API Key | The Odoo password or the API key generated from the user panel | Encrypted — not visible after saving |
After filling in all fields, tap Save. SiltaFlow automatically runs a connection test to verify that the address, database, and credentials are correct. If the test succeeds, the profile is saved and set as active; if there's an error, a message is displayed indicating the specific problem.
Choose clear and unique profile names, such as "Production – Milan Office" or "Staging – Sprint 42". During urgent operations, the name of the active profile is your only defense against accidental work on the wrong database.
Authentication modes
SiltaFlow supports two different ways to authenticate on Odoo. The choice does not affect the available features: both provide full access to all app functions.
Username + Password
The classic way: enter the same email and password you use in the browser to access Odoo. Compatible with all Odoo versions from 12 onwards. The password is encrypted immediately and is never saved in plain text on the device.
- Compatible with Odoo v12 and later
- Requires no additional configuration on the Odoo server
- The session is automatically renewed on expiration
- Ideal for on-premise servers or personal Odoo instances
API Key
A safer alternative to password: instead of your login credentials, you use a special key generated from Odoo's user panel. This key can be revoked at any time without changing your account password.
- Available from Odoo v14 onwards
- Your Odoo account password is never stored on the device
- You can revoke the key from the Odoo panel without changing your password
- Recommended for devices shared by multiple people
- In Odoo you can set an optional expiration date for each key
If the device is used by multiple people or left unattended, use API Key mode. In case of phone loss, you can block access to Odoo simply by revoking the key from the browser, without changing your password.
How to generate an API Key on Odoo
- Log in to Odoo with your account from the browser
- Open the Settings menu
- In the sidebar go to Technical › API Keys (you may need to enable developer mode, or find it in the user menu at the top right from Odoo v16)
- Click New, give it a descriptive name — for example "SiltaFlow – Warehouse Tablet" — and set an expiration date if your policy requires it
- Confirm: the key is shown <strong>only once</strong>. Copy it immediately.
- Paste the key in the API Key field of your SiltaFlow profile and select API Key mode
Odoo displays the full API key only once, when it's created. If you lose it before saving it in your profile, you must revoke it and create a new one. SiltaFlow encrypts it and stores it in your device's hardware secure enclave as soon as you enter it.
Comparison of modes
| Feature | Username + Password | API Key |
|---|---|---|
| Minimum Odoo version | v12+ | v14+ |
| Server configuration required | None | Generate key from user panel |
| Main password exposed | Saved encrypted on device | No, password is never used |
| Selective access revocation | Requires password change | Single key revocation from Odoo |
| Suitable for shared devices | With precautions | Recommended |
| Available SiltaFlow features | All | All |
Profile management
All configured profiles are visible in Settings › Connections. The active profile is highlighted with a colored border and an animated green dot. Inactive profiles are listed below with a gray dot.
Changing the active profile
Tap the Activate button next to any inactive profile to switch to it. The switch happens instantly: the app updates the active connection locally and shows a confirmation notification. Network errors (server unreachable, expired credentials) will only be reported when you perform your first actual operation on the new profile.
Before confirming transfers, receipts, or any irreversible operation, always check in Settings › Connections which profile is active. One second of attention can prevent hours of corrections on the wrong database.
Logging out (Logout)
Tap Logout on the active profile to disconnect. The app always shows a confirmation dialog to prevent accidental disconnections. Logout deactivates the profile but does not delete the credentials: you can reconnect at any time by tapping Activate.
Editing or deleting a profile
Tap Edit to update a profile's data (for example to change the password or update an expired API Key). Tap Delete to permanently remove a profile: this operation also removes the credentials from your device's hardware and is not reversible.
Delete profiles you no longer use (finished clients, decommissioned servers). Besides keeping your list organized, deletion securely erases the credentials, reducing risks in case of device loss.
How credentials are protected
Passwords and API Keys are never written in plain text on the device. As soon as you enter them in the configuration form, SiltaFlow encrypts them with AES-256 using a key stored in your phone's hardware (Android Keystore). This key is tied to your specific device: even if someone extracted the app's database, the encrypted credentials would be useless on any other device.
While using the app, credentials are decrypted in memory only for the time needed to make the call to Odoo, then they are discarded. They never end up in log files or temporary files.
Encrypted credentials are tied to your device's hardware. If you restore your phone or switch to a new device, you will need to re-enter the passwords or API Keys for all profiles. The profile data (name, URL, database, username) will be retained.
Biometric authentication
If your Android device has a fingerprint sensor (or face recognition), you can enable biometric unlock to protect access to your saved connections. Each time you select a profile to connect, the app asks for confirmation from the sensor before proceeding.
Biometrics do not replace Odoo credentials: they protect them locally. It prevents anyone who picks up your phone from connecting to your Odoo even if the connection is already configured in the app.
How to enable biometrics
- Go to Settings › Connections
- Turn on the Biometric Unlock toggle (visible only if the device has at least one fingerprint registered)
- The system immediately shows a biometric confirmation request to verify that you are the device owner
- From now on, each access to a saved connection will require sensor verification
The biometric feature requires Android 10 or later (API 29+) and at least one fingerprint registered in Android settings. If your device does not meet these requirements, the toggle will not appear.
How unlock works
When you tap a profile to connect, the Android operating system unlock dialog appears — the same one you use to unlock your phone. Place your thumb on the sensor: if recognition succeeds, SiltaFlow reads the credentials and completes the login to Odoo in a few moments.
If the sensor fails to recognize you (for example because your fingers are wet or you're wearing gloves), after three attempts the app automatically offers the alternative Use PIN, which uses your device's unlock PIN.
Register at least two fingers in Android settings (for example right thumb and left index). In the warehouse, with single-hand gloves or small cuts, having an alternative prevents you from being locked out of the app during work.
Limitations to keep in mind
- Biometric unlock only happens at login time: it does not protect an already open session. To protect the app while in use, use Android's automatic screen lock.
- In environments with work gloves or very wet fingers, the sensor may have difficulty. The PIN fallback is always available.
- Some Android manufacturers disable biometrics with battery below 5%. In these cases, SiltaFlow automatically offers the PIN.
- SiltaFlow does not collect or transmit fingerprints. Recognition happens entirely in the sensor's hardware; the app only receives success or failure confirmation.
Common usage scenarios
Production and test environment
Configure two profiles: one for the production server and one for staging. Before applying new procedures to the real database, switch to the test profile with one tap, run your checks, then return to production. The green dot in the list always reminds you which server you're working on.
Consultant with multiple clients
Add a profile for each client using a dedicated API Key. When you visit a client's office, activate their profile in two seconds. If you stop working with a client, their access is revoked directly from Odoo without touching the app.
Shared device in warehouse
On a tablet used by multiple operators on shifts, each person can have their own personal profile. At shift change, the person leaving logs out (with a confirmation dialog to prevent accidental taps) and the new person activates their profile. With biometrics enabled, each access requires verification of the correct operator.
Common problems and solutions
If the connection test fails or access to Odoo doesn't work, check these points in the order indicated:
- Network connection — Is the device connected to the correct network? For on-premise servers, is the corporate VPN active?
- Server URL — Check that there's no trailing slash, the port is correct, and the protocol (http or https) matches the server configuration.
- Database name — The name is case-sensitive on some systems. Check it in Odoo via Settings › Technical › Database.
- Expired credentials — If you use an API Key, verify it hasn't expired or been revoked from the Odoo panel.
- Server under maintenance — Open the same URL from the device's browser to confirm that Odoo is reachable.
- SSL certificate — On servers with self-signed certificates you may need to add the certificate as trusted in Android settings.
Requirements
- Android 10 device or later
- Internet connection (for initial connection test and app usage)
- An Odoo v12 or later instance with an enabled user account
- For API Key mode: Odoo v14 or later
- For biometrics: Android 10+ with at least one fingerprint registered in system settings