Package: djangorestframework-api-key
Django REST Framework API KeyAPI key permissions for theDjango REST Framework.IntroductionDjango REST Framework API Key is a library for allowing server-side clients to safely use your API.These clients are typically third-party backends and services (i.e.machines) which do not have a user account but still need to interact with your API in a secure way.Features✌️Simple to use: create, view and revoke API keys via the admin site, or use built-in helpers to create API keys programmatically.🔒As secure as possible: API keys are treated with the same level of care as user passwords. They are only visible at creation and hashed before storing in the database.🎨Customizable: satisfy specific business requirements by building your own customized API key models, permission classes and admin panels.Should I use API keys?There are important security aspects you need to consider before switching to an API key access control scheme. We've listed some of these inSecurity caveats, including serving your API over HTTPS.Besides, seeWhy and when to use API keysfor hints on whether API keys can fit your use case.API keys are ideal in the following situations:Blocking anonymous traffic.Implementing API key-basedthrottling. (Note that Django REST Framework already has may built-in utilities for this use case.)Identifying usage patterns by logging request information along with the API key.They can also present enough security for authorizing internal services, such as your API server and an internal frontend application.Please note that this package is NOT meant for authentication. You should NOT use this package to identify individual users, either directly or indirectly.If you need server-to-server authentication, you may want to consider OAuth instead. Libraries such asdjango-oauth-toolkitcan help.QuickstartInstall withpip:pipinstall"djangorestframework-api-key==3.*"Note: It is highly recommended topin your dependencyto the latest major version (as depicted above), as breaking changes may and will happen between major releases.Add the app to yourINSTALLED_APPS:# settings.pyINSTALLED_APPS=[# ..."rest_framework","rest_framework_api_key",]Run the included migrations:pythonmanage.pymigrateTo learn how to configure permissions and manage API keys, head to theDocumentation.ChangelogSeeCHANGELOG.md.ContributingSeeCONTRIBUTING.md.LicenseMITChangelogAll notable changes to this project will be documented in this file.The format is based onKeep a Changelog. This project adheres toSemantic Versioning.3.0.0 - 2023-09-30ChangedUse faster SHA512-based key hasher instead of password hashers. Reduces server load by making API key validation orders of magnitude faster (10x to 30x according to estimations, network latency aside). Hashed key will be transparently upgraded the first time.is_valid()is called. (Pull #244, Pull #251)RemovedDropped support for Python 3.7, which has reached EOL. (Pull #247)Drop redundant.has_object_permission()implementation onBaseHasAPIKeywhen using DRF 3.14.0 or above. (Pull #240)AddedAdd official support for Python 3.11. (Pull #247)2.3.0 - 2023-01-19RemovedDrop support for Python 3.6, which has reached EOL. (Pull #210)FixedFix migration 0004 when run against a non default database. (Pull #215)2.2.0 - 2022-03-11AddedAdded support for Django config detection for different versions (PR #187)ChangedAdd official support for Django 3.2 and Python 3.9 and 3.10 (PR #189)Bumpedhashed_keyfield'smax_lengthfrom 100 to 150 to address length issue withargon2-cffi(PR #193)2.1.0 - 2021-09-24AddedAdd support for custom APIkeyword. (Pull #175)2.0.0 - 2020-04-07NOTE: this release drops compatibility with certain Python and Django versions, but contains no other breaking changes. SeeUpgrade to 2.0for detailed migration steps.RemovedDropped support for Django 2.0 and Django 2.1. (Pull #126)Dropped support for Python 3.5. (Pull #84)AddedAdd support for Django 3.0. (Pull #82)Add support for Python 3.8. (Pull #81)AddBaseAPIKeyManager.get_from_key()to allow retrieving API keys from views. (Pull #93)Add type annotations, and partial support fordjango-stubsanddjangorestframework-stubs. (Pull #88, Pull #122)1.4.1 - 2019-08-24AddedNow ships with type annotations (PEP 561). (Pull #73)1.4.0 - 2019-07-16NOTE: this release contains migrations. SeeUpgrade to v1.4for detailed instructions.AddedTheprefixandhashed_keyare now stored in dedicated fields on theAPIKeymodel. (Pull #62)1.3.0 - 2019-06-28NOTE: this release contains migrations. In your Django project, run them using:pythonmanage.pymigraterest_framework_api_keyAddedAdd abstract API key model (AbstractAPIKey) and base manager (BaseAPIKeyManager). (Pull #36)Add base permissions (BaseHasAPIKey). (Pull #46)ChangedTheidfield ofAPIKeyis now non-editable.APIKeyModelAdmindoes not definefieldsetsanymore. This allows subclasses to benefit from Django's automatic fieldsets. (Pull #52)FixedExplicitly useutf-8encoding insetup.py, which could previously lead to issues when installing on certain systems. (Pull #58)1.2.1 - 2019-06-03FixedFixed a critical bug inAPIKeyModelAdminthat preventedrest_framework_api_keyfrom passing Django system checks. (Pull #39)1.2.0 - 2019-05-29NOTE: this release contains migrations. In your Django project, run them using:pythonmanage.pymigraterest_framework_api_keyAddedAPI keys can now have an optionalexpiry_date. (Pull #33)HasAPIKeydenies access if the API key has expired, i.e. ifexpiry_date, if set, is in the past.It is now possible to search byprefixin the API key admin panel.Theprefixis now displayed in the edit view of the API key admin panel.1.1.0 - 2019-05-14AddedImprove documentation on which password hasher is used.Add tests against the Argon2, BcryptSHA256 and PBKDF2SHA1 hashers. (Pull #32)FixedFix support for password hashers that generate hashes that contain dots. (Pull #31)1.0.0 - 2019-04-24This release is incompatible with 0.x. SeeUpgrade to 1.0for migration steps.RemovedRemoveHasAPIKeyOrIsAuthenticatedpermission class. You should use bitwise composition now, e.g.HasAPIKey | IsAuthenticated.Drop theDRF_API_KEY_*settings. (Pull #19)ChangedSwitch to a new API key generation and validation scheme. Clients must now authorize using a single API key header (Pull #19). The header isAuthorizationby default. It can be customized using theAPI_KEY_CUSTOM_HEADERsetting (Pull #26). Use thenamefield to identify clients.AddedAdd support for Django 2.2. (Pull #27)Add programmatic API key creation usingAPIKey.objects.create_key(). (Pull #19)FixedImproved API key storage using Django's password hashing helpers. (Uses the default Django password hasher.) (Pull #19)0.4.0 - 2019-04-21RemovedDrop support for Python 3.4. Only 3.5, 3.6 and 3.7 are supported now.Drop support for Django < 2.0. Only 2.0 and 2.1 are supported now.FixedHasAPIKeynow implements.has_object_permissions(), which allows to compose it with other permission classes and perform object-level permission checks. (Pull #25)0.3.1 - 2018-11-17Initial changelog entry.AddedAPIKeymodel.HasAPIKeyandHasAPIKeyOrIsAuthenticatedpermission classes.Generate, view and revoke API keys from the Django admin.Authenticate requests using theApi-TokenandApi-Secret-Keyheaders. Customizable via theDRF_API_KEY_TOKEN_HEADERandDRF_API_KEY_SECRET_KEY_HEADERsettings.