drf-auth-kit

Modern Django REST Framework authentication toolkit with JWT cookies, social login, MFA, and comprehensive user management.

Built as a next-generation alternative to existing DRF authentication packages, DRF Auth Kit provides a complete authentication solution with modern developer experience, inspired by dj-rest-auth but enhanced with full type safety, automatic OpenAPI schema generation, and comprehensive MFA support inspired by django-trench.

Features

Multiple Authentication Types: JWT (default), DRF Token, or Custom
Cookie-Based Security: HTTP-only cookies
Complete User Management: Registration, password reset, email verification
Multi-Factor Authentication: Support multiple MFAs with backup codes, including passkeys and hardware security keys
Passwordless Authentication: Email magic links and passkey (WebAuthn) login
Social Authentication: Django Allauth integration with 50+ providers, support for both OAuth2 and OpenID connect.
Internationalization: Built-in support for 57 languages including English, Spanish, French, German, Chinese, Japanese, Korean, Vietnamese, and more
Full Type Safety: Complete type hints with mypy and pyright
OpenAPI Integration: Auto-generated API documentation with DRF Spectacular
Flexible Configuration: Customizable serializers, views, and authentication backends

Installation

pip install drf-auth-kit

Optional Features:

# For MFA support
pip install drf-auth-kit[mfa]

# For social authentication
pip install drf-auth-kit[social]

# For passkeys / WebAuthn (passwordless and MFA)
pip install drf-auth-kit[webauthn]

# For everything
pip install drf-auth-kit[all]

Core Dependencies: Django 5.0+, DRF 3.0+, Django Allauth, DRF SimpleJWT

Quick Start

Add to your Django settings:

INSTALLED_APPS = [
    # ... your apps
    'rest_framework',
    'allauth',  # Required for social auth
    'allauth.account',  # Required for social auth
    # 'allauth.socialaccount',  # For social login
    # 'allauth.socialaccount.providers.google',  # For Google login
    'auth_kit',
    # 'auth_kit.social',  # For social authentication
    # 'auth_kit.mfa',  # For MFA support
    # 'auth_kit.webauthn',  # For passkeys (passwordless login and MFA)
]

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'auth_kit.authentication.JWTCookieAuthentication',
    ],
}

# Override only if needed:
# AUTH_KIT = {
#     'USE_MFA': True,  # Enable MFA
#     'USE_PASSWORDLESS': True,  # Enable passwordless login
# }

# Google OAuth2 settings (for social login)
# SOCIALACCOUNT_PROVIDERS = {
#     'google': {
#         'SCOPE': ['profile', 'email'],
#         'AUTH_PARAMS': {'access_type': 'online'},
#         'OAUTH_PKCE_ENABLED': True,
#         'APP': {
#             'client_id': 'your-google-client-id',
#             'secret': 'your-google-client-secret',
#         }
#     }
# }

Include Auth Kit URLs:

from django.urls import path, include

urlpatterns = [
    path('api/auth/', include('auth_kit.urls')),
    # path('api/auth/social/', include('auth_kit.social.urls')),  # For social auth
    # path('api/auth/webauthn/', include('auth_kit.webauthn.urls')),  # For passkey management
    # ... your other URLs
]

Run migrations (needed if using MFA or WebAuthn):

python manage.py migrate

Authentication Types

JWT Authentication (Recommended)

Access and refresh tokens
Token refresh support
Secure cookie storage

DRF Token Authentication

Simple token-based auth
Compatible with DRF TokenAuthentication
Cookie support available

Custom Authentication

Bring your own authentication backend
Full customization support
Integrate with third-party services

Documentation

Please visit DRF Auth Kit docs for complete documentation, including:

Detailed configuration options
Custom serializer examples
Advanced usage patterns
Integration guides

Upcoming Features

Enhanced Multi-Factor Authentication

☐ SMS & Voice: Twilio integration for SMS and voice-based MFA
☐ Authenticator Apps: Enhanced TOTP support (Google Authenticator, Authy, etc.)
☐ Trusted Devices: Remember MFA verification for trusted browsers/sessions

Passwordless Authentication

☐ SMS Login: One-time password via SMS

Advanced Security Features

☐ Rate Limiting: Configurable rate limits for authentication endpoints
☐ Account Lockout: Progressive delays and temporary account locks
☐ Audit Logging: Comprehensive security event logging
☐ Geographic Restrictions: IP-based access controls and geo-blocking

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

License

This project is licensed under the MIT License - see the LICENSE file for details.

Metadata

Release files for drf-auth-kit 1.8.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for drf-auth-kit 1.8.1
File	Size	Uploaded
drf_auth_kit-1.8.1.tar.gz	591.6 kB	Aug 10, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for drf-auth-kit 1.8.1
File	Interpreter	ABI	Platform	Reset
drf_auth_kit-1.8.1-py3-none-any.whl 685.1 kB Aug 10, 2026	Python 3	none	any	Details

Total release size: 1.3 MB

Release files / drf_auth_kit-1.8.1.tar.gz

Download URL	drf_auth_kit-1.8.1.tar.gz
Size	591.6 kB
Tags	Source
SHA-256 checksum How to use checksums	`2ef098f7f385690e404a6295ecbd883db639c32b22e2e5771c67db31b2bd640d`
BLAKE2b-256 checksum How to use checksums	`9cebe2eda941fb0d5048d496c7ff7b43271d418032223ba06cce8f164e70be98`
Upload date	Aug 10, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/forthecraft/drf-auth-kit
Publishing commit: github.com/forthecraft/drf-auth-kit/tree/587986fe97c8a30118c36b6af9ebe78ec1e7dff2

Workflow

Publishing configuration: github.com/forthecraft/drf-auth-kit/blob/587986fe97c8a30118c36b6af9ebe78ec1e7dff2/.github/workflows/publish.yml
Publishing logs: github.com/forthecraft/drf-auth-kit/actions/runs/31392819858/attempts/1

Artifact

Subject: drf_auth_kit-1.8.1.tar.gz
SHA-256 checksum: 2ef098f7f385690e404a6295ecbd883db639c32b22e2e5771c67db31b2bd640d Verifying attestations

Release files / drf_auth_kit-1.8.1-py3-none-any.whl

Download URL	drf_auth_kit-1.8.1-py3-none-any.whl
Size	685.1 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`1d52a1dfdcad1b291f0546bbaed7b26f8c947dbabfa509a68254866a60b03a0d`
BLAKE2b-256 checksum How to use checksums	`96aaa79075d90685f86066bd32c101745b9cbed5888b6e7b9ce4097b5fd0d657`
Upload date	Aug 10, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/forthecraft/drf-auth-kit
Publishing commit: github.com/forthecraft/drf-auth-kit/tree/587986fe97c8a30118c36b6af9ebe78ec1e7dff2

Workflow

Publishing configuration: github.com/forthecraft/drf-auth-kit/blob/587986fe97c8a30118c36b6af9ebe78ec1e7dff2/.github/workflows/publish.yml
Publishing logs: github.com/forthecraft/drf-auth-kit/actions/runs/31392819858/attempts/1

Artifact

Subject: drf_auth_kit-1.8.1-py3-none-any.whl
SHA-256 checksum: 1d52a1dfdcad1b291f0546bbaed7b26f8c947dbabfa509a68254866a60b03a0d Verifying attestations