Account flows
Account lifecycle
Authkits provides signup, login, logout, email verification, password recovery, authenticated password change, and protected account deletion without replacing your Django user model.
Signup and login
Use the host user model, Django password validation, username/email login rules, and optional email-verification gating.
Verification and recovery
Short-lived, attempt-bounded verification and password-recovery proofs with generic public responses.
Password and deletion
Password change and permanent account deletion require fresh authentication and scoped single-use authorization.
Mount the account routes
Mount the packaged browser flows wherever they fit your project.
from django.urls import include, path
urlpatterns = [
path("auth/", include("authkits.urls")),
]The default mount provides signup/login/logout, verification, password recovery, MFA and security-center flows, session/device management, social-account management, password change, and account deletion.
Keep your existing user model
Authkits respects AUTH_USER_MODEL, including UUID and email-only models. With ACCOUNTS.LOGIN_FIELD left blank, login accepts the host username field or email where supported and rejects ambiguous matches.
Fresh authorization for sensitive changes
Password changes and account deletion do not trust an old session alone. Authkits verifies the current password again and, when current policy requires it, completes MFA before issuing a short-lived authorization scoped to that exact action.
A successful password change revokes existing Authkits API credentials, trusted devices, tracked sessions, and pending security grants. Account deletion requires an explicit final DELETE confirmation.
Next steps
Configure MFA, session tracking, and trusted devices around these account flows.
MFA, sessions, and devices