Odoo API Integration — connecting Bangladesh's payment, banking, and shipping ecosystem.

The Bangladesh API Landscape: What Can and Cannot Connect

Before writing a single line of integration code, you need to understand a fundamental truth about Bangladesh's digital ecosystem: API quality varies enormously, from well-documented REST APIs (bKash, SSLCommerz) to barely-documented SOAP services (some bank corporate portals) to systems with no API at all (NBR's iBAS++ requires browser automation, not API calls).

Here is a practical map of what Bangladesh businesses typically want to connect to Odoo and the realistic integration level for each:

The Bangladesh fintech ecosystem is growing fast, but API quality still lags behind the ambition. Know what tier of integration you are building before you budget for it.

Odoo API Fundamentals: XML-RPC, JSON-RPC, and REST

Odoo exposes three API interfaces. Understanding which to use for which purpose is the first decision your integration team needs to make.

import requests, json

url = "https://your-odoo.com"

# Step 1: Authenticate
auth = requests.post(f"{url}/web/dataset/call_kw", json={
    "jsonrpc": "2.0", "method": "call", "id": 1,
    "params": {
        "model": "res.users",
        "method": "authenticate",
        "args": ["your-db", "user@company.com", "password", {}],
        "kwargs": {}
    }
}).json()

uid = auth["result"]

# Step 2: Read confirmed sale orders
orders = requests.post(f"{url}/web/dataset/call_kw", json={
    "jsonrpc": "2.0", "method": "call", "id": 2,
    "params": {
        "model": "sale.order",
        "method": "search_read",
        "args": [[["state", "=", "sale"]]],
        "kwargs": {"fields": ["name", "partner_id", "amount_total"], "limit": 50}
    }
}).json()

print(orders["result"])

curl -H "Authorization: Bearer YOUR_API_KEY" \
     https://your-odoo.com/api/sale.order?domain=[["state","=","sale"]]

Authentication & API Security

Authentication is where Bangladesh integrations most often fail — not because the code is wrong, but because the security configuration is not thought through. There are three patterns to choose from:

1. API Key Authentication (Recommended for Odoo 16+) Generate a dedicated API key for each external system. Settings → Technical → API Keys (or per-user API Keys tab). Store the key as an environment variable on the integration server — never in source code. Rotate keys every 90 days. Use one key per integration so you can revoke without affecting others.
2. Dedicated Integration User (All Versions) Create a dedicated Odoo user (e.g., api-integration@company.com) with the minimum permissions required for the integration's function. Do not use an admin account. If the key is compromised, a minimal-permission user limits blast radius. See the Odoo User Access Rights guide for configuring a restricted user role.
3. IP Whitelisting via Nginx/Server Config If your integration server has a static IP (recommended for Bangladesh office servers and cloud VMs), restrict API access at the web server level. Nginx allow/deny rules ensure that even with a leaked credential, the API cannot be accessed from arbitrary IPs.
4. Store Keys in System Parameters For third-party API keys that Odoo itself needs to call (e.g., bKash API key, courier API key), use Settings → Technical → System Parameters to store them. Name them clearly: bkash.app_key, steadfast.api_key. Restrict access to System Parameters to admin only.

Payment Gateway Integration

Bangladesh businesses — especially e-commerce, B2C SaaS, and export billing — need payment gateways connected to Odoo's invoicing and accounting modules. Here is how each major gateway integrates.

import hashlib

def validate_sslcommerz_ipn(data, store_passwd):
    """Verify SSLCommerz IPN hash before marking payment as received."""
    received_hash = data.get("verify_sign")
    data_without_sign = {k: v for k, v in data.items()
                         if k not in ("verify_sign", "verify_key")}
    # Sort keys and concat with store password
    sorted_data = dict(sorted(data_without_sign.items()))
    sorted_data["store_passwd"] = hashlib.md5(
        store_passwd.encode()).hexdigest()
    hash_str = "&".join(f"{k}={v}" for k, v in sorted_data.items())
    expected = hashlib.md5(hash_str.encode()).hexdigest()
    return received_hash == expected

Bank Feed Integration: The Bangladesh Reality

Bangladesh corporate banking APIs are significantly less mature than payment gateway APIs. Here is the honest state of bank connectivity for Bangladesh Odoo implementations.

Shipping & Delivery API Integration

For Bangladesh e-commerce and B2B fulfilment companies, courier API integration is often the highest-ROI integration to build. Automating shipment creation, label printing, and tracking status sync saves hours of manual data entry per day at any meaningful order volume.

import requests

STEADFAST_BASE = "https://portal.packzy.com/api/v1"
headers = {
    "Api-Key": "YOUR_API_KEY",
    "Secret-Key": "YOUR_SECRET_KEY",
    "Content-Type": "application/json"
}

def create_steadfast_order(invoice, customer, address, cod_amount):
    payload = {
        "invoice": invoice,         # Your order reference
        "recipient_name": customer,
        "recipient_phone": address["phone"],
        "recipient_address": address["street"],
        "cod_amount": cod_amount    # 0 for prepaid
    }
    resp = requests.post(
        f"{STEADFAST_BASE}/create_order",
        json=payload, headers=headers
    )
    data = resp.json()
    return data.get("consignment", {}).get("tracking_code")

NBR & Tax System: What is Actually Possible

Many Bangladesh businesses ask whether Odoo can submit Mushak reports or VAT returns directly to NBR. The honest answer: not directly — but Odoo can generate the data in exactly the format NBR requires.

The NBR iBAS++ system (where government tax is submitted) and the Mushak online portal (VAT returns) require manual submission through a browser interface as of 2026. There is no public REST API for automated submission.

What Odoo can do:

• Generate Mushak 6.3 (sales VAT register), 6.4 (purchase VAT register), and 6.5 (credit note register) as PDF or CSV exports — exactly the format required for NBR filing.
• Calculate TDS (Tax Deducted at Source) on vendor payments and generate 108 and 108A certificates.
• Track VAT payable/receivable for monthly reconciliation before filing.
• Export VAT return data in the Excel format required for upload to the VAT Online portal.

The integration gap is the final submission step — which still requires a human to log in to the NBR portal and upload or enter the data. Odoo bridges everything up to that point.

Common Integration Patterns for Bangladesh Businesses

Troubleshooting API Connectivity Issues

Problem: "odoo.exceptions.AccessDenied" on every API call
The integration user either has the wrong password or is not in the correct database. Verify: the database name matches exactly (case-sensitive), the user is active (not archived), and the password has not expired. If using Odoo 17+, check whether 2FA is enabled on the user — API key auth bypasses 2FA; session-based auth does not.

Problem: API works in testing but fails from Bangladesh production server
Most likely cause: the Bangladesh server's IP is blocked by the external API provider (bKash, SSLCommerz, etc.). Check IP whitelisting. If your Bangladesh server uses a shared/dynamic IP (common with ISPs like BTCL, Grameenphone home plans), you need a static IP — available from your ISP on request, or use a cloud VM with a fixed public IP.

Problem: SSL certificate errors from Bangladesh server
Bangladesh servers often have outdated CA certificate bundles. Run sudo update-ca-certificates on Ubuntu/Debian or install the ca-certificates package. Also verify your server's clock is accurate (NTP-synced) — certificate validation fails if the server clock is more than 5 minutes off, which is surprisingly common on misconfigured Bangladesh VMs.

Problem: Webhook callbacks from bKash/SSLCommerz not reaching Odoo
Check that your Odoo server is accessible on port 443 (HTTPS) from the internet. Many Bangladesh on-premise servers are behind a NAT router without port forwarding configured. Use a service like ngrok for development/testing. For production, ensure your firewall and router forward port 443 to your Odoo server and that you have a valid SSL certificate (Let's Encrypt works perfectly).

For the access rights configuration that underpins all integration security, the Odoo User Roles & Access Rights guide covers how to create minimal-permission integration users correctly. And for the multi-company setups where API integration becomes more complex, the Odoo Multi-Company Setup guide explains the database architecture that determines which company's data your API calls will see.

Frequently asked questions

Does Odoo have a REST API?

Yes. Odoo 16 and later expose a native REST API at /api/ endpoints for specific objects. Earlier versions use XML-RPC or JSON-RPC at /web/dataset/call_kw. The JSON-RPC interface is the most commonly used method for Bangladesh integrations because it works with any HTTP client and does not require a special SDK.

Can bKash be integrated directly with Odoo?

Yes, but not with a native Odoo module. bKash merchant API (REST, OAuth 2.0) must be connected via a custom payment provider module. The bKash merchant API requires a registered business account, IP whitelisting, and sandbox credentials from bKash before production integration. Most Bangladesh Odoo partners build this as a custom module that extends Odoo's payment.provider model.

Which shipping APIs work with Odoo in Bangladesh?

Pathao Courier, Steadfast Courier, Redx, and eCourier are the main Bangladesh delivery APIs. None have official Odoo modules on the App Store as of 2026. Integration requires a custom delivery carrier module. Steadfast has the simplest API (flat REST with API key auth) and is the easiest starting point for custom development.

What is the safest way to store API keys in Odoo?

Use Settings → Technical → System Parameters to store third-party API keys in the database. For Odoo's own API keys granted to external systems, generate dedicated API keys per integration from the user's API Keys tab. Never commit API keys to Git. Restrict System Parameters access to Administrator role only via access rights configuration.