OpenCart Store Management

OpenCart Store Management connects a self-hosted OpenCart storefront to Odoo. This page is the installation and configuration guide for the module you downloaded from your ECOSIRE dashboard. Everything below describes the opencart_store_management module as it ships today.

Technical name	opencart_store_management
Odoo versions	17.0, 18.0, 19.0 (Community or Enterprise)
Current shipped version	17.0 → 17.0.2.2.2, 18.0 → 18.0.2.2.2, 19.0 → 19.0.2.2.2
Price	$499 USD — one-time, per Odoo version
Odoo module licence	LGPL-3
Category	Connector

Licences are bound to one Odoo major version

A licence issued for Odoo 17 unlocks only the 17.0 download and only validates on an Odoo 17 database. It will not activate on 18 or 19, and the 18.0/19.0 ZIPs will not appear in your dashboard. Buy the version you actually run — and if you later upgrade Odoo, you need the licence for the new version. This is enforced on both the download and the activation paths, so there is no way round it.

Requirements

Requirement	Detail
Odoo	17.0, 18.0 or 19.0, Community or Enterprise. Self-hosted or Odoo.sh — Odoo Online (SaaS) cannot install third-party modules
Odoo apps	base, sale_management, stock, account, delivery, mail, web, product, contacts, knowledge — Odoo installs any that are missing
ECOSIRE dependency	ecosire_license_client — a separate free download, not bundled in this ZIP. See step 3
Python packages	requests
Platform account	An OpenCart seller/partner account with API access
Licence	An active ECOSIRE licence for this module and your Odoo version

Install the Python packages into the same interpreter that runs Odoo:

sudo -u odoo pip install requests

Installation

1. Download the ZIP for your Odoo version

Sign in at ecosire.com and open your dashboard downloads. You will only be offered the file matching your licence's Odoo version — that is expected, see the warning above.

2. Extract into your addons path

unzip opencart_store_management_v19_*.zip -d /opt/odoo/addons/
ls /opt/odoo/addons/opencart_store_management/__manifest__.py   # sanity check

The archive contains a single top-level opencart_store_management/ directory. If your ls check fails, the module folder ended up one level too deep — move it up so __manifest__.py sits directly inside opencart_store_management/.

3. Install the ECOSIRE licence client

opencart_store_management declares ecosire_license_client as a hard dependency. It is a separate, free module and it is not bundled in the connector ZIP — Odoo will refuse to install the connector until the licence client is present in your addons path. Download it from your ECOSIRE dashboard alongside the connector and extract it the same way:

unzip ecosire_license_client_v19_*.zip -d /opt/odoo/addons/

4. Restart Odoo and install

sudo systemctl restart odoo

1. Go to Apps and click Update Apps List (developer mode must be on).
2. Search for OpenCart Store Management and click Install.
3. Odoo pulls in ecosire_license_client and the Odoo apps listed above automatically.

When the install finishes, an OpenCart menu appears in the main Odoo app switcher.

Activate your licence

Get your licence key

1. Create an account, or sign in, at ecosire.com. Your licences and downloads live in your account dashboard — this is also where the ZIP files in Installation come from.
2. Purchased directly on ecosire.com: your licence key is issued to your dashboard automatically once the order completes. No further step is needed.
3. Purchased through the Odoo App Store: the App Store does not tell ECOSIRE about your purchase automatically, so a manual verification step is required. Email your Odoo sales-order slip / order reference (the purchase receipt Odoo sends you when you buy the app) to [email protected], from the same email address as your ecosire.com account. Once the purchase is verified, the ECO-XXXX-XXXX-XXXX key is issued to your dashboard.

With the key in your dashboard, continue below to activate it in Odoo.

Before you activate

Set your instance's public URL first. The licence is bound to the domain derived from web.base.url, so activating with a placeholder value binds the licence to the wrong host:

1. Turn on developer mode.
2. Settings → Technical → System Parameters, find web.base.url.
3. Set it to the real HTTPS URL your users browse to, e.g. https://erp.example.com.

Activate

1. Go to Settings → ECOSIRE.COM → Activate License.
2. Paste your licence key.
3. Choose OpenCart Store Management in the module dropdown (it lists the installed ECOSIRE modules).
4. Click Activate.

Settings → ECOSIRE.COM → License Status then shows, per module, the licence state, last-verified time, Odoo version, module version, support expiry, and whether an offline token is cached.

What the client sends

Activation and validation are plain HTTPS JSON calls to https://api.ecosire.com/api. Every request carries the same five fields:

{
  "key": "ECO-XXXX-XXXX-XXXX-XXXX",
  "module_name": "opencart_store_management",
  "domain": "erp.example.com",
  "hw_fingerprint": "<sha256 of this installation's hardware/db identity>",
  "odoo_version": "19.0"
}

Endpoint	Used for
POST /api/licenses/activate	First-time activation — binds the licence to this domain
POST /api/licenses/validate	Ongoing verification
POST /api/licenses/issue-token	Fetches the RSA-signed offline token used for the grace period
POST /api/licenses/deactivate-self	Releases this domain so the key can move to another database

The base URL is overridable through the ecosire.license.api_url system parameter, and the client refuses any value that is not HTTPS. You do not need to change it.

Activation slots, and moving between databases

Each licence carries its own activation limit. New licences default to a single domain; some licences are issued with more. Check License Status, or the licence detail page in your ECOSIRE portal, for the number on yours. Re-activating on a domain that is already bound is a no-op success, not a second slot.

• Odoo.sh staging and development builds do not consume a slot — they are recognised as non-production hosts and activate without binding.
• To move a live licence to a different database, use Deactivate on the activation screen first; that releases the domain server-side so you can activate elsewhere.
• Ten failed activation attempts within an hour trips a client-side rate limiter. Wait up to 60 minutes, or contact support — do not keep retrying a key you are unsure about.

Staying licensed after activation

A daily scheduled action, ECOSIRE License: Background Re-verification, re-checks the licence out of the request path, refreshes the cached offline token, and keeps the last-known-good timestamp fresh. Because of that, a transient network problem, an Odoo.sh rebuild or a worker restart does not lock you out. Verification results are cached for five minutes, so a licence change can take a few minutes to show up.

If you see a hard rejection instead — LICENSE_NOT_FOUND, LICENSE_INACTIVE, LICENSE_EXPIRED, MODULE_MISMATCH, VERSION_MISMATCH or NOT_ACTIVATED_ON_DOMAIN — the grace period is deliberately not granted; fix the underlying problem. See Troubleshooting.

Configuration

Connect to OpenCart

Open OpenCart → Configuration and create a record (model opencart.instance). The connection fields are:

Label	Technical name	Required	Values
—	store_url	Yes	Text
—	api_key	Yes	Text
—	api_secret	Yes	Text

Where the Label column shows —, the module does not set an explicit label and Odoo derives one from the technical name, so the wording on screen may differ slightly. The technical name is the reliable identifier.

OpenCart issues API credentials from System → Users → API in its own admin. Set OpenCart Version to match your storefront (3.x or 4.x) — the module speaks a different API dialect for each.

Credentials are issued from the your OpenCart admin panel — see docs.opencart.com/en-gb. The connector talks to your own store — the Store URL you enter on the instance.

When the fields are filled in, click Test Connection. The record's status moves to connected only when the platform answers successfully — do not run a first import until it does.

Scheduled actions

The module installs 4 scheduled actions (Settings → Technical → Scheduled Actions):

Scheduled action	Runs every	Enabled on install
OpenCart: Sync Products	30 minutes	Yes
OpenCart: Sync Orders	15 minutes	Yes
OpenCart: Sync Customers	60 minutes	Yes
OpenCart: Process Queue Jobs	5 minutes	Yes

Intervals above are the shipped defaults. Adjust them to your volume — but be aware that the platform, not Odoo, sets the API rate limits, and shortening a sync interval is the usual cause of throttling errors in the logs.

Using the module

The OpenCart menu is laid out as:

• OpenCart → Automation Dashboard
• OpenCart → Configuration — OpenCart Instances, Cron Jobs, Webhooks
• OpenCart → Products — Products
• OpenCart → Orders — Orders
• OpenCart → Customers
• OpenCart → Operations — Queue Jobs, Logs
• OpenCart → Tools — Manual Sync

A normal first run is:

1. Test Connection until the instance reads connected.
2. Review the mapping records (categories, order statuses, payment and shipping methods) so imported data lands on the right Odoo records.
3. Run a small import first — restrict it by date or by a handful of products — and check the results before letting the scheduled actions take over.
4. Watch the Logs view during the first full sync. Every sync writes a log line; failures are recorded there rather than raised at the user.

Module-specific notes

• OpenCart Version (3.x or 4.x) is required and selects the API dialect. OpenCart 4 changed its admin API; picking the wrong one produces authentication errors that look like bad credentials.
• OpenCart is self-hosted, so the connector reaches your server. The Store URL must be reachable over HTTPS from the Odoo host — a firewall between the two is a common cause of connection failures.
• This module ships four scheduled actions; there is no inventory-sync job, so stock is handled through the product sync.

What's new since 19.0.2.0.2

The last few releases focused on correctness (dashboard numbers, manual sync, order-status counting), access control, and accessibility rather than new menus. If you are updating from 2.0.2 or earlier, here is what changed in user-facing terms.

19.0.2.2.2 (current)

• Listing truth pass. The App Store page and module description now state only what the shipped code does. The "2026 compliance flows (EU VAT, EU DSA, GDPR)" marketing claim was removed: the three instance toggles behind it were settings that no code ever read, and they have been deleted. The manual tracking fields on orders and partners (VAT OSS country/amount, DSA seller info, GDPR DSR state) remain available for your own processes — they are simply no longer sold as automated compliance flows.
• The module summary now leads with what this connector is genuinely best at: OpenCart 4.1 authentication (core 4.1 removed api/login — handled), whole-store imports with no 100-record truncation, FX-safe order booking, credential-redacting logs, honest sync outcomes, OCMod tracking, and two-level multi-store.
• A duplicate support key was removed from the manifest. No functional change.

19.0.2.2.1

• Reliability hardening (fleet-wide class fix). Every per-record sync/import loop now wraps its body in its own database savepoint with an explicit flush. One bad record rolls back alone: it can no longer poison the batch, abort the database cursor for later records, or make a run's closing write roll back every good record while the logs claim success. A containment regression suite now proves this behaviour on every release.

19.0.2.2.0

• The Automation Dashboard now follows Odoo's dark mode — switching the web client to dark renders the dashboard in its dark palette instead of leaving light cards with unreadable contrast.
• A store that has never synchronized no longer shows a fabricated "100% Sync Health" figure — the dashboard reports No syncs yet until a real synchronization has actually run.
• Starting a sync before the connection has been tested now tells you exactly that ("Test the OpenCart connection before starting synchronization.") instead of a generic "review the logs" message.
• Test Connection is now restricted to the OpenCart Manager role, matching Synchronization — the button writes the instance status that the scheduled syncs act on.
• The per-instance OpenCart Version (3.x/4.x), REST Admin bearer token, and rate limit settings now actually take effect on every sync and connection test — previously the API client was built from the store URL and key alone, so a 3.x store could be addressed with 4.x routes and the rate limit always ran at its default. Automatic order-workflow rules now also match per-store correctly on multi-instance installs, instead of always applying whichever rule happened to be first.
• Full-store sync — product, order, and customer imports no longer stop after the first 100 records. Every import service now pages through the entire store until it is exhausted, so a catalog, order history, or customer base larger than 100 is no longer silently cut off.
• An OpenCart customer or order with no email address no longer attaches to the wrong Odoo contact — previously it could match the first Odoo contact that also had no email; an empty email is now correctly treated as "no match."
• Faster, page-batched imports — each page of 100 records now reads its existing mappings, buyer contacts, and product mappings once and creates all of that page's records in a single pass, instead of one database round-trip per record. A single bad record in a page is reported and skipped instead of failing the whole page.
• Resumable scheduled syncs — a scheduled import or export now saves each completed page as it goes, so a long sync interrupted mid-run (server restart, timeout) keeps the work already done instead of losing it and starting over.
• Scheduled product exports are now incremental — only products still awaiting export are pushed on each run, rather than re-uploading the whole catalog every time. A new Force Full Export option on the export cron restores the old full-catalog behaviour when you need it; the manual "Export Products" action under Tools → Manual Sync still exports everything on demand. Products exported through the update path are now marked as synced so they are not queued again on the next run.
• Added database indexes on the OpenCart instance and on the OpenCart product, order, and customer identifiers, keeping mapping lookups fast on large stores.

19.0.2.1.1

• Fixed a bug that made every manual or dashboard-triggered sync fail before it reached the OpenCart API — the product, order, and customer import services were being registered incorrectly internally, so clicking Sync (or calling /opencart/api/sync) never actually synced anything. All three now dispatch correctly and report success, partial, or failed outcomes as intended.
• The ECOSIRE App Store listing now links directly to the live demo (opencart.demo.ecosire.com) and to this documentation page from the listing's hero section, a dedicated Resources section, and the footer.
• Version renumbered to 2.1.1 to supersede a stale 2.1.0 build that had been deployed to the demo server, so upgrades from the demo build land cleanly.

19.0.2.0.9

• The Automation Dashboard now clearly reports whether a sync completed, partially failed, or failed outright, instead of showing a generic success message for any HTTP 200 response.
• Dashboard data is scoped to the OpenCart instances visible in your allowed companies, and error cards no longer show raw text returned by the OpenCart server.
• A custom dashboard date range now includes the end date in full — previously, orders placed later in the day on the end date could be dropped from the totals.
• The product form gained an OpenCart tab showing that product's connector mapping and catalog settings directly on the product record.
• Accessibility pass: retry/recovery buttons on failed dashboard panels, accessible labels on the custom date pickers, keyboard-navigable KPI cards, named charts, stronger focus outlines, WCAG AA colour contrast, and dashboard headers that wrap correctly on narrow screens.
• Editing an existing OpenCart Instance record, and using the optional REST Admin bearer token, now require the OpenCart Manager role.

19.0.2.0.8

• The webhook endpoint now requires a valid HMAC signature — see Webhooks below. The previous, unsigned webhook route was removed.
• Tools → Manual Sync for products, orders and customers now runs through the same mapping engine as the scheduled actions. Manual sync could previously fail silently.
• Automation Dashboard KPIs are now built from your actual product, order, customer and sales records. A connected instance with real data now shows real numbers instead of zeros.
• An order whose internal workflow step fails is now correctly reported as failed rather than counted as successfully synced.
• Added Kanban, pivot, graph and chart drill-down views for Orders, alongside the existing list and search views.

19.0.2.0.7

• Restored full behavioural parity across the Odoo 19, 18 and 17 builds.
• Stored API credentials (API Key, API Secret, and the optional REST Admin token) are now visible only to Administrators and rendered masked everywhere else.

Webhooks

OpenCart's core has no built-in outbound webhooks — this is a limitation of the platform, not the connector. opencart_store_management still ships a webhook receiver for stores that add their own outbound event source: OpenCart's built-in event/hook system (a small custom extension that POSTs on an event such as catalog/model/checkout/order/addOrder/after), or a third-party webhook extension from the OpenCart marketplace. If your store does not have one of those installed, skip this section — the four scheduled actions already keep Odoo current by polling on a 5–30 minute cycle, and that remains the primary sync path regardless of whether webhooks are configured.

Endpoint

POST https://<your-odoo-host>/opencart/webhook/<instance_id>

<instance_id> is the numeric ID of the OpenCart Instance record you connected in Configuration (visible in the record's browser URL, e.g. .../odoo/opencart-instances/3).

Method	POST only
Auth	Public — no Odoo user session required
Signature header	X-OpenCart-Hmac-SHA256 — required on every request
Body	Any JSON payload

The request must be signed: compute an HMAC-SHA256 of the raw POST body, keyed with the instance's API Secret (the same secret you entered in Configuration), hex-encode it, and send it as the X-OpenCart-Hmac-SHA256 header. Whatever extension sends the webhook on the OpenCart side needs to be configured with this same URL and secret.

Response	Meaning
200 {"status": "success"}	Signature verified, body parsed as JSON
401 {"error": "Missing signature"}	The X-OpenCart-Hmac-SHA256 header was not sent
401 {"error": "Invalid signature"}	The header was sent but does not match the computed HMAC
404 {"error": "Instance not found"}	<instance_id> does not match an OpenCart Instance record
400 {"error": "Invalid JSON body"}	The body could not be parsed as JSON

There is no fixed payload schema to match — the endpoint accepts any JSON body and reads an optional event key purely to label its log entry (it logs unknown if the key is absent). The exact fields available depend entirely on which OpenCart-side extension is sending the request.

What the webhook does today

A verified webhook call is logged (OpenCart → Operations → Logs) so you have an audit trail that OpenCart is reaching Odoo. It does not yet trigger an immediate import of that specific record — the scheduled actions remain the mechanism that actually pulls products, orders, and customers into Odoo. Treat the webhook as a signed delivery-confirmation channel today, not a replacement for the 5–30 minute polling cycle.

The OpenCart → Configuration → Webhooks list (model opencart.webhook) is where you keep a record of which event types you expect (Product/Order/Customer Created, Updated, or Deleted) and note the URL you configured on the OpenCart side. It is for your own documentation and tracking — creating a record here does not register anything with OpenCart itself, and the Test button on a webhook record only confirms the Odoo record exists; it does not perform a real round trip to your store.

Internal API endpoints

These three endpoints back the Automation Dashboard screen itself. They require an authenticated Odoo user session (auth='user') and the roles noted below — they are not meant to be called from outside Odoo, but are documented here for completeness if you script against your own instance.

Endpoint	Role required	Purpose
/opencart/api/status	OpenCart User	Connection state and last-sync timestamps for products, orders and customers
/opencart/api/sync	OpenCart Manager	Triggers a manual dashboard sync (sync_type: all, products, orders, or customers)
/opencart/dashboard/data	OpenCart User	Full KPI, sales-chart, order-status and recent-activity payload behind the dashboard, for a period or a custom date range

Troubleshooting

Licensing

Symptom / error code	Cause and fix
VERSION_MISMATCH	The licence is for a different Odoo major version than the database you activated on. Licences are not transferable across Odoo versions — you need the licence for the version you run.
MODULE_MISMATCH	The licence belongs to a different ECOSIRE module. Check you selected OpenCart Store Management (opencart_store_management) in the activation dropdown.
NOT_ACTIVATED_ON_DOMAIN	The database's web.base.url domain is not among the licence's activated domains. Activate on this domain, or deactivate the old one first.
LICENSE_EXPIRED / LICENSE_INACTIVE	The licence is past its expiry or has been suspended/revoked. Check the licence in your ECOSIRE portal.
LICENSE_NOT_FOUND	The key does not exist. Keys are upper-cased before sending, so case is not the problem — re-copy it from your portal.
Activation limit reached	Every slot on the licence is bound to a domain. Deactivate one first.
Too many failed activation attempts	Ten failures in an hour. Wait up to 60 minutes.
Could not determine your Odoo instance domain	web.base.url is empty. Set it, then activate.
The requests library is required	requests is missing from Odoo's Python environment. Install it into the interpreter that runs Odoo.
The downloaded ZIP is the wrong version	The download list is filtered by your licence's version. If you need a different Odoo version, you need that version's licence.

Syncing

Symptom	Cause and fix
Test Connection fails	Re-check every required field in the table above. Most failures are a mistyped secret, or credentials created for the sandbox while the connector points at production (or vice-versa).
Nothing syncs even though the connection is fine	The scheduled actions are disabled at the Odoo level, or Odoo's cron worker is not running. Check Settings → Technical → Scheduled Actions and that --max-cron-threads is greater than zero.
Sync starts then stops part-way	Read the Logs view for that run. Rate limiting and rejected field values are the two common causes; both are logged with the platform's own error text.
Records import but map to the wrong Odoo values	Fix the mapping records under the module's configuration, then re-run the import.
Duplicated products or customers	Run the initial import once. If a first attempt half-finished, check the existing records before re-running rather than importing on top.

Version history

Odoo version	Version you download today
17.0	17.0.2.2.2
18.0	18.0.2.2.2
19.0	19.0.2.2.2

ECOSIRE module versions follow the pattern <odoo major>.<module major>.<minor>.<patch> — for example 19.0.2.2.0 is the Odoo 19 build of module version 2.2.0. Your installed version is shown in Apps and in Settings → ECOSIRE.COM → License Status.

Support

• General troubleshooting
• Licence verification guide
• Email: [email protected]
• Support portal