Welcome to Django OAuth Toolkit Documentation

Django OAuth Toolkit is an OAuth 2.0 authorization server for teams already running Django. It provides, out of the box, the endpoints, models, and logic to issue and manage OAuth2 tokens from your existing Django project. It can also act as a resource server to protect a Django or Django REST Framework API. Django OAuth Toolkit makes extensive use of the excellent OAuthLib, so that everything is rfc-compliant.

See our Changelog for information on updates.

MCP authorization

As of 3.4.0, Django OAuth Toolkit supports the authorization server role required by the Model Context Protocol (MCP) authorization specification. PKCE is required by default, and the authorization server metadata (RFC 8414) and protected resource metadata (RFC 9728) discovery endpoints are included in the default URLconf. Dynamic Client Registration (RFC 7591/7592) and Client ID Metadata Documents can be enabled with the DCR_ENABLED and CIMD_ENABLED settings. See the 3.4.0 release discussion for the supported specifications and current gaps.

Support

If you need help please submit a question.

Requirements

• Python 3.10, 3.11, 3.12, 3.13 or 3.14

• Django 4.2, 5.0, 5.1, 5.2 or 6.0

• oauthlib 3.2.2+

Index

• Installation
  • Sync your database
• Getting started
  • What we will build?
  • What is OAuth?
  • Django
  • Django OAuth Toolkit
  • OAuth2 Authorization Grants
  • Authorization Code
  • Client Credential
• Tutorials
  • Part 1 - Make a Provider in a Minute
  • Part 2 - protect your APIs
  • Part 3 - OAuth2 token authentication
  • Part 4 - Revoking an OAuth2 Token
  • Part 5 - Using Celery to Automate Maintenance Chores
  • Part 6 - Device authorization grant flow
• Django Rest Framework
  • Getting started
  • Permissions
• Django Ninja
  • Basic Usage
  • Optional Authentication
  • Scope Enforcement
  • Custom Authorization Behavior
• Using the views
  • Function-based views
  • Class-based Views
  • Application Views
  • Granted Tokens Views
  • Mixins for Class Based Views
  • Dynamic Client Registration
• Templates
  • base.html
  • authorize.html
  • Management
• Views code and details
  • Generic
  • Mixins
  • Base
• Models
  • AbstractAccessToken
  • AbstractApplication
  • AbstractDeviceGrant
  • AbstractGrant
  • AbstractIDToken
  • AbstractRefreshToken
  • AccessToken
  • Application
  • ClientSecretField
  • DeviceCodeResponse
  • DeviceGrant
  • DeviceRequest
  • Grant
  • IDToken
  • RefreshToken
  • ResourceJSONField
  • TokenChecksumField
  • get_access_token_admin_class()
  • get_access_token_model()
  • get_application_admin_class()
  • get_application_model()
  • get_device_grant_model()
  • get_grant_admin_class()
  • get_grant_model()
  • get_id_token_admin_class()
  • get_id_token_model()
  • get_refresh_token_admin_class()
  • get_refresh_token_model()
  • is_origin_allowed()
  • redirect_to_uri_allowed()
  • refresh_token_expire_timedelta()
• Advanced topics
  • Extending the Application model
  • Extending the token models
  • Skip authorization form
  • Overriding views
  • Content Security Policy and the authorization form
• RFC 9700 Security Best Current Practice
  • Gated behaviors and the 3.x → 4.0 transition
  • Compliant settings block
  • Recommendation-by-recommendation
  • Out of scope
• OpenID Connect
  • OpenID Connect support
  • Configuration
  • Setting up OIDC enabled clients
  • Customizing the OIDC responses
  • Customizing the login flow
  • OIDC Views
  • Define where to store the profile
• OAuth 2.0 Authorization Server Metadata
  • URL Configuration
• OAuth 2.0 Protected Resource Metadata
  • URL Configuration
  • Advertising metadata in WWW-Authenticate challenges
• Client ID Metadata Documents (CIMD)
  • How it works
  • Settings
  • Security model
• Signals
• Settings
  • List of available settings within OAUTH2_PROVIDER
  • List of non-namespaced settings
  • Settings imported from Django project
• Separate Resource Server
  • Setup the Authentication Server
  • Setup the Resource Server
• Token Audience Binding (RFC 8707)
  • How It Works
  • Validating Token Audiences
  • Rejecting tokens of an unusable application
• Management commands
  • cleartokens
  • clearcimdapplications
  • createapplication
• Glossary

• Contributing
• Changelog

Indices and tables

• Index

• Module Index