Getting started

Configuration

All Authkits settings live under one typed AUTHKITS mapping. Unknown sections, unknown options, and invalid values fail closed through configuration validation and Django system checks.

ACCOUNTS

SECURITY

Challenge lifetimes, fresh authorization, session tracking, trusted devices, transient retention, and trusted proxies.

MFA

Enforcement, allowed methods, TOTP enrollment, issuer labels, verification window, and encryption-key rotation.

Trusted base URL and optional host-owned message sender.

Local signup, login, and logout redirect paths.

SOCIAL

Optional django-allauth integration in managed or existing-provider mode.

API

Optional DRF/headless API boundary and bearer credential limits.

UPDATES

Explicit release discovery endpoint and network timeouts.

LICENSING

License key, local entitlement source, activation endpoint, and bounded activation timeouts.

Representative configuration

settings.py

AUTHKITS = {
    "ACCOUNTS": {
        "REQUIRE_EMAIL_VERIFICATION": True,
    },
    "SECURITY": {
        "SESSION_TRACKING": True,
        "TRUSTED_DEVICES": True,
    },
    "MFA": {
        "TOTP_ENABLED": True,
        "ALLOWED_METHODS": ["totp", "email"],
        "ENCRYPTION_KEYS": [env("AUTHKITS_MFA_KEY")],
    },
    "UI": {
        "LOGIN_REDIRECT": "/",
        "LOGOUT_REDIRECT": "/auth/login/",
    },
}

Security configuration

Authkits intentionally keeps proof lifetimes bounded. Session tracking and trusted devices are opt-in. Forwarded client IPs are trusted only from exact IPs or strict CIDRs listed in SECURITY.TRUSTED_PROXIES.

Optional integrations

Social authentication and DRF/headless APIs are not imported by the base package. Install their extras and enable SOCIAL.ENABLED or API.ENABLED only when your project uses them.

Licensing sources

Configure either LICENSING.ENTITLEMENT or LICENSING.ENTITLEMENT_FILE, not both. Environment fallbacks are available for the license key and local entitlement. Normal authentication does not call the activation endpoint.

Validate before deployment

Terminal

$python manage.py check$python manage.py check --deploy$python manage.py authkits_check --security

Next steps

Configure the account-security surface around your app's assurance needs.

MFA, sessions, and devices