dj-rest-auth

dj-rest-auth is a Django REST Framework library that supplies ready-made, secure API endpoints for authentication and account management. Out of the box it covers login, logout, password change and reset, user registration with email verification, JWT with HTTP-only cookies, MFA/2FA, passkeys, and social login via django-allauth.

Designed for single-page applications and mobile clients, it wires into an existing Django project through a small set of installed apps, URL includes, and settings, while keeping every serializer and view customizable when you need to override default behavior.

What You Get

• Prebuilt DRF endpoints for login, logout, password change, and password reset
• User registration with email verification via django-allauth integration
• JWT authentication with optional HTTP-only cookie storage
• Built-in MFA/2FA (TOTP plus recovery codes) and passkey/WebAuthn support
• Social authentication for providers like Google, GitHub, and Facebook
• Overridable serializers and views for customizing every flow

Common Use Cases

• Adding token or JWT authentication to a Django REST API backing a React or Vue SPA
• Providing registration and password-reset endpoints for a mobile app backend
• Enabling social login without hand-writing OAuth handling
• Layering MFA and passkey login onto an existing Django authentication system

Under The Hood

Architecture - dj-rest-auth is a reusable Django app (dj_rest_auth/) built on top of django.contrib.auth and Django REST Framework. It ships class-based views (views.py) and serializers (serializers.py, social_serializers.py) wired through urls.py, with pluggable behavior driven by app_settings.py. Optional sub-packages layer in registration/, mfa/, passkeys/, and JWT handling (jwt_auth.py), delegating to django-allauth for account and social flows and simplejwt for tokens.

Tech Stack - Pure Python targeting Django 4.2-6.0 and Python 3.10-3.14, built on Django REST Framework, with optional dependencies on django-allauth for registration/social auth and djangorestframework-simplejwt for JWT. Packaging is via setuptools (setup.py/setup.cfg), docs are built with MkDocs, and tests run through tox.

Code Quality - The library is mature and widely deployed (hundreds of thousands of weekly downloads) with a dedicated tests/ package and a runtests.py/tox matrix exercising multiple Django and Python versions. Settings indirection via app_settings.py keeps overrides clean, and the codebase separates concerns across auth, registration, MFA, and passkeys.

API Design - Developer experience centers on drop-in configuration: add the app to INSTALLED_APPS, include the URL modules, and endpoints appear. Serializers and views are documented and designed for subclassing, so teams can customize responses and validation without forking. Recent activity has slowed somewhat, but the surface is stable and thoroughly documented.