Secure Public Invoice Preview in Odoo Using Access Tokens and PDF Generation
Overview
For many businesses, especially those working with partners or customers on credit terms, sharing outstanding invoice details securely and professionally is crucial. Odoo provides a robust way to achieve this using QWeb PDF reports and custom HTTP controllers.
In this article, we’ll walk through an implementation where a public link allows customers to preview or download their outstanding invoices, using a secure UUID-based access token. This ensures that sensitive financial documents are shared securely without requiring the user to log in.
Implementation Details
1️. Generating a Secure Access Token
Each invoice record is assigned a unique token for secure access:
This token is used to construct the public URL that allows access to the invoice PDF.
2️.Controller for Public Access
The controller /public/invoice/<token> checks the token and returns a PDF rendered from a QWeb report:
3️. Triggering Access Token Creation from Button
When a user triggers the Outstanding Report PDF action, tokens are created if they don't exist:
In the xml template define like this:
This approach ensures that the customer can click on a particular invoice number and get a PDF download of the full invoice.
Benefits
Secure Access: Only users with the token can view/download the invoice.
No Login Required: Useful for external users or customers.
Professional Format: Uses Odoo’s native PDF reporting for branding and structure.
One-click Download: Simplifies the customer experience.