Hi,

Both concepts are technically possible in Odoo, but they differ a lot in scalability, security, and complexity of implementation.

Between the two approaches, Concept 1 (email template with Approve/Reject buttons) is generally more effective and scalable in Odoo v18. Odoo already supports secure tokenized links inside emails, so you can embed "Approve" and "Reject" buttons in your email templates that call custom controller routes. When the recipient clicks, Odoo validates the token and updates the approval status — this is relatively simple to implement, highly secure, and provides a smooth user experience without requiring login (if you configure public routes with token checks). On the other hand, Concept 2 (approval via email reply) is possible but more complex: you would need to configure incoming mail servers, parse reply content or special email aliases, and reliably distinguish between approvals/rejections, which becomes harder to maintain and scale with many workflows. It also introduces risks with ambiguous replies ("Yes, but…" vs "Reject"), whereas button clicks are unambiguous. Therefore, from both an automation and coding perspective, Concept 1 is the recommended path: you can extend Odoo’s email templates with action buttons tied to controllers, ensuring a secure and streamlined approval process while keeping the implementation maintainable.

For reference, please take a look at the app below,

* https://apps.odoo.com/apps/modules/18.0/hr_leave_request_aliasing

Hope it helps