Templates and UI overrides

Add your project-level templates directory before app templates and keep Django app-template discovery enabled.

TEMPLATES = [
    {
        "BACKEND": "django.template.backends.django.DjangoTemplates",
        "DIRS": [BASE_DIR / "templates"],
        "APP_DIRS": True,
        # ...
    },
]

Mirror the Authkits template path

To override a packaged template, create the same path under your project's templates directory. You only need to copy the templates you actually want to change.

your_project/
├── templates/
│   └── authkits/
│       ├── login.html
│       ├── signup.html
│       └── emails/
│           └── verification.txt
└── manage.py

For example, templates/authkits/login.html overrides the packaged authkits/login.html while every other Authkits template continues using the default shipped version.

Override one page

Individual page overrides can keep the packaged Authkits base layout while replacing only the page content.

{% extends "authkits/base.html" %}

{% block title %}Welcome back{% endblock %}

{% block content %}
  <h1>Welcome back</h1>
  <form method="post">
    {% csrf_token %}
    {% include "authkits/fields.html" %}
    <button type="submit">Sign in</button>
  </form>
{% endblock %}

Replace the global Authkits shell

All packaged browser templates extend authkits/base.html. To apply your own global markup, typography, navigation, and stylesheet, copy the packaged base template into templates/authkits/base.html and customize that project copy.

The packaged base exposes title, styles, extra head content, language, and page-content blocks. You can also replace the default authkits/auth.css reference with your own static stylesheet.

Shared form fields

Override templates/authkits/fields.html when you want one consistent rendering treatment for Authkits forms. The packaged partial already handles hidden fields, validation errors, help text, accessible error associations, and password reveal controls.

Email template overrides

Verification, password-reset, and email-MFA messages are normal Django templates too.

templates/authkits/emails/
├── verification.txt
├── reset.txt
└── mfa.txt

Keep the required challenge identifiers, codes, or page URLs that the corresponding flow expects. Authkits deliberately keeps secrets out of query strings.

Template ownership does not bypass the Authkits security boundary. Preserve CSRF tokens on POST forms, keep destructive actions as POSTs, render hidden fields supplied by Authkits forms, and avoid putting passwords, MFA codes, recovery codes, bearer credentials, or other secrets into URLs or client logs.