dj-rest-auth
Secure drop-in authentication endpoints for Django REST Framework. Works seamlessly with SPAs and mobile apps.
Features
- Login, logout, password change, password reset
- User registration with email verification
- Built-in MFA/2FA support (TOTP + recovery codes)
- JWT authentication with HTTP-only cookies
- Social auth (Google, GitHub, Facebook) via django-allauth
- Fully customizable serializers
Architecture
flowchart LR
Client[Client<br/>React / Vue / Mobile]
subgraph Django
subgraph dj-rest-auth
Auth[Login / Logout]
Reg[Registration]
PW[Password Reset]
end
DRF[Django REST Framework]
DJAuth[django.contrib.auth]
AA[django-allauth]
JWT[simplejwt]
end
Client <--> dj-rest-auth
Auth --> DRF
Auth --> DJAuth
Auth -.-> JWT
Reg -.-> AA
PW --> DJAuth
Quick Start
pip install dj-rest-auth
# settings.py
INSTALLED_APPS = [
...
'rest_framework',
'rest_framework.authtoken',
'dj_rest_auth',
]
# urls.py
urlpatterns = [
path('auth/', include('dj_rest_auth.urls')),
]
You now have:
| Endpoint | Method | Description |
|---|---|---|
/auth/login/ |
POST | Obtain auth token |
/auth/logout/ |
POST | Revoke token |
/auth/user/ |
GET, PUT | User details |
/auth/password/change/ |
POST | Change password |
/auth/password/reset/ |
POST | Request reset email |
/auth/password/reset/confirm/ |
POST | Confirm reset |
JWT with HTTP-only Cookies
pip install dj-rest-auth djangorestframework-simplejwt
# settings.py
REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': [
'dj_rest_auth.jwt_auth.JWTCookieAuthentication',
],
}
REST_AUTH = {
'USE_JWT': True,
'JWT_AUTH_COOKIE': 'access',
'JWT_AUTH_REFRESH_COOKIE': 'refresh',
'JWT_AUTH_HTTPONLY': True,
}
Registration
pip install 'dj-rest-auth[with-social]'
# settings.py
INSTALLED_APPS = [
...
'django.contrib.sites',
'allauth',
'allauth.account',
'dj_rest_auth.registration',
]
SITE_ID = 1
# urls.py
urlpatterns = [
path('auth/', include('dj_rest_auth.urls')),
path('auth/registration/', include('dj_rest_auth.registration.urls')),
]
MFA / 2FA
pip install 'dj-rest-auth[with-mfa]'
MFA ships as an opt-in sub-package (dj_rest_auth.mfa) with:
- TOTP login challenge flow
- Recovery codes
- Security-focused defaults (short-lived MFA tokens, activation confirmation)
See the guide for setup and endpoint details:
MFA Guide
Documentation
Full documentation at dj-rest-auth.readthedocs.io
Contributing
pip install -r dj_rest_auth/tests/requirements.txt
python runtests.py
See Contributing Guide for details.
License
MIT
Release files for dj-rest-auth 7.2.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| dj_rest_auth-7.2.0.tar.gz | 490.1 kB | Details |
Release files / dj_rest_auth-7.2.0.tar.gz
| Download URL | dj_rest_auth-7.2.0.tar.gz |
|---|---|
| Size | 490.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
f77af37da5cf6ee28f03f283a378a2f5761860e72d1d6f2fa3d50e6286000482
|
|
BLAKE2b-256 checksum How to use checksums |
14fdc8a185a98f6860b802dc5e663c652efc01cd68f4e046c65f8cb9328c0077
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.11.7
|
