Integrations

Headless and DRF APIs

The optional API boundary exposes versioned Django REST Framework endpoints without creating a second authentication or account-security model.

Session-backed JSON

Use JSON account endpoints with normal Django session authentication.

Revocable bearers

Issue opaque Authkits credentials with bounded lifetimes and explicit scopes.

Headless security

Password/MFA login, bearer-bound step-up, session security, and social OAuth handoff.

Install and enable

Terminal

$python -m pip install "authkits-django[api]"

settings.py

AUTHKITS = {
    "API": {
        "ENABLED": True,
        "CREDENTIAL_TTL": 604800,
        "CREDENTIAL_MAX_ACTIVE": 10,
    },
}

urls.py

urlpatterns += [
    path("api/v1/auth/", include("authkits.api.urls")),
]

Fully headless login

Password login can issue a bearer immediately when MFA is not required, or return a short-lived MFA transaction that reuses the same email, TOTP, and recovery-code factor services as browser login.

Credential security

Authkits bearer tokens are opaque and stored server-side as digests. Credentials can be scoped, rotated, revoked, inventoried, and invalidated by relevant password, email-identity, or MFA security changes.

Bearer-bound step-up

Sensitive API mutations can require a fresh password and current MFA, issuing a short-lived single-use authorization bound to the exact user, bearer credential, action, and target.

Headless social OAuth

Social API login uses a browser handoff through the configured django-allauth provider. Provider tokens never become Authkits bearer credentials directly, and final Authkits credentials are not placed in redirect URLs.

Configure social login too

Install both optional boundaries with authkits-django[api,social].

Social authentication