Welcome to Django OAuth Toolkit Documentation
Django OAuth Toolkit is an OAuth 2.0 authorization server for teams already running Django. It provides, out of the box, the endpoints, models, and logic to issue and manage OAuth2 tokens from your existing Django project. It can also act as a resource server to protect a Django or Django REST Framework API. Django OAuth Toolkit makes extensive use of the excellent OAuthLib, so that everything is rfc-compliant.
See our Changelog for information on updates, and the Upgrading guide for the breaking changes and steps involved in upgrading between releases.
Support
If you need help please submit a question.
Requirements
Python 3.10, 3.11, 3.12, 3.13 or 3.14
Django 4.2, 5.0, 5.1, 5.2 or 6.0
oauthlib 3.2.2+
Index
Getting started
Using the toolkit
- Using the views
- Views code and details
- Templates
- Models
AbstractAccessTokenAbstractApplicationAbstractDeviceGrantAbstractGrantAbstractIDTokenAbstractPushedAuthorizationRequestAbstractRefreshTokenAccessTokenApplicationClientSecretFieldDeviceCodeResponseDeviceGrantDeviceRequestGrantIDTokenPushedAuthorizationRequestRefreshTokenResourceJSONFieldTokenChecksumFieldcheck_redirect_to_uri_allowed()get_access_token_admin_class()get_access_token_model()get_application_admin_class()get_application_model()get_device_grant_model()get_grant_admin_class()get_grant_model()get_id_token_admin_class()get_id_token_model()get_par_request_model()get_refresh_token_admin_class()get_refresh_token_model()is_origin_allowed()redirect_to_uri_allowed()refresh_token_expire_timedelta()revoke_access_token()set_token_value()
- Signals
- Management commands
- Advanced topics
- Extending the Application model
- Validating a custom Application model
- Custom redirect URI and origin validators
- Extending the token models
- Custom scopes backend
- Varying the access token lifetime per request
- Skip authorization form
- Overriding views
- Content Security Policy and the authorization form
- Debugging redirect URI mismatches
- RFC 9700 Security Best Current Practice
- Security Vulnerability Response and Release Process
- Principles
- Roles and access
- Repositories and data boundaries
- Report intake and triage
- Advisory and CVE management
- Patch development paths
- Shared security repository conventions
- Required private validation
- Multi-advisory release trains
- Final private release gate
- Public promotion and release
- Failure during public cutover
- Post-release work
Authorization Server
Resource Server
Reference
Project