Error pages

Tell users why not on 403 pages, in your root URLconf:

handler403 = "no.views.permission_denied"

Django has no handler429, so hand no.views.too_many_requests to your rate limiter instead, e.g. django-ratelimit:

RATELIMIT_VIEW = "no.views.too_many_requests"

Both render your own 403.html / 429.html if you have one, with {{ reason }} and {{ exception }} in the context, and fall back to a minimal built-in page otherwise. Reasons come from the configured backend; if that’s RemoteBackend, read the notes under RemoteBackend first.

Django REST framework

Add a reason to every 403 and 429 JSON response:

pip install django-no[drf]

REST_FRAMEWORK = {
    "EXCEPTION_HANDLER": "no.contrib.rest_framework.exception_handler",
}

{
    "detail": "You do not have permission to perform this action.",
    "reason": "I'm on a strict 'no commitments' diet."
}

Reasons come from the configured backend, same as error pages above. Already have a custom exception handler? Pass its response through no.contrib.rest_framework.add_reason().

LocalBackend

The default. Picks a random reason from a JSON file containing a list of strings.

path

Path to your own reasons file. Defaults to the bundled reasons.json.

NO = {
    "BACKEND": "no.backends.local.LocalBackend",
    "OPTIONS": {"path": BASE_DIR / "reasons.json"},
}

RemoteBackend

Fetches a reason from an HTTP API that responds with {"reason": "..."}. Whenever the request fails it falls back to LocalBackend and stops calling the API for cooldown seconds.

url

API endpoint, must be http or https. Defaults to https://naas.isalman.dev/no.

timeout

Request timeout in seconds. Defaults to 3.

cooldown

Seconds to wait before retrying the API after a failure. Defaults to 60.

path

Reasons file for the fallback LocalBackend.

NO = {
    "BACKEND": "no.backends.remote.RemoteBackend",
    "OPTIONS": {"timeout": 1, "cooldown": 300},
}

Things to consider before using it:

• Every reason is an HTTP request made while the response is built, so a slow API slows down your pages by up to timeout seconds.

• The default public endpoint is rate limited to 120 requests per minute. Past that it answers 429, and RemoteBackend falls back to local reasons for cooldown seconds. Fine for a hobby site; for anything busier, run your own no-as-a-service instance and point url at it, or stick with LocalBackend.

• Error responses tend to come in floods, 429s especially. With error pages or the REST framework handler enabled, every one of them is also a request to url. Make sure your endpoint can take it.

Custom backends

Subclass no.backends.base.BaseBackend and implement get_reason(). OPTIONS are available as self.options:

from no.backends.base import BaseBackend

class PoliteBackend(BaseBackend):
    def get_reason(self):
        return self.options.get("reason", "No, thank you.")

1.1.1 (2026-09-25)

• Fix RemoteBackend always falling back to local reasons: send a User-Agent header, since Cloudflare blocks urllib’s default with a 403

• Error pages and the REST framework handler now use the configured backend instead of always using local reasons

• Document RemoteBackend trade-offs and the default endpoint’s rate limit

1.1.0 (2026-09-25)

• Add no management command that prints a reason to say no

• Add Django REST framework exception handler that adds a reason to 403 and 429 responses (pip install django-no[drf])

• Add permission_denied (handler403) and too_many_requests error views with built-in fallback templates

1.0.0 (2026-09-25)

• Initial release