Registry / auth-security / django-oauth-toolkit

django-oauth-toolkit

library3.4.1pypypi✓ verified 26d ago

Django OAuth Toolkit (DOT) is a Python library that provides OAuth2 capabilities to Django projects, offering out-of-the-box endpoints, data, and logic for robust authorization. It leverages OAuthLib to ensure RFC-compliance and is currently at version 3.2.0. The project is actively maintained with regular releases, supporting recent Django and Python versions.

auth-security web-framework

pip install django-oauth-toolkit

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · DJANGO-OAUTH-TOOLK

django-oauth-toolkit

auth-securitypythonv3.4.1

Install

5.1s avg

Import

—

Disk

90MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v3.4.1 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.000s · 89.9MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 5.1s · import 0.000s · 90MB

90MB installed

● package 90MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

oauth2_urls

✓ from oauth2_provider import urls as oauth2_urls

✗ from oauth2_provider import urls as oauth2_urls

To quickly set up Django OAuth Toolkit, first install it along with `django-cors-headers` (if needed for cross-origin requests). Add `oauth2_provider` and `corsheaders` to `INSTALLED_APPS`. Configure `MIDDLEWARE` to include `OAuth2TokenMiddleware` and `CorsMiddleware`. Add `OAuth2Backend` to `AUTHENTICATION_BACKENDS`. Finally, include `oauth2_provider` URLs in your project's `urls.py`. Remember to run `python manage.py makemigrations` and `python manage.py migrate` to apply database changes. After migration, you can register OAuth2 applications via the Django admin at `/o/applications/`.

import os # settings.py INSTALLED_APPS = [ # ... other apps 'django.contrib.admin', 'django.contrib.auth', 'django.contrib.contenttypes', 'django.contrib.sessions', 'oauth2_provider', 'corsheaders', # If using django-cors-headers ] MIDDLEWARE = [ 'django.middleware.security.SecurityMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'corsheaders.middleware.CorsMiddleware', # If using django-cors-headers 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'oauth2_provider.middleware.OAuth2TokenMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', ] AUTHENTICATION_BACKENDS = [ 'oauth2_provider.backends.OAuth2Backend', 'django.contrib.auth.backends.ModelBackend', # Required for Django admin login ] # urls.py from django.contrib import admin from django.urls import include, path from oauth2_provider import urls as oauth2_urls urlpatterns = [ path('admin/', admin.site.urls), path('o/', include(oauth2_urls)), # Your other app URLs ] # Configure CORS if needed (e.g., for local development or specific clients) CORS_ORIGIN_ALLOW_ALL = True # WARNING: Set to specific origins in production

Debug

Known issues

breakingUpgrading to version 3.0.0 or later requires running `manage.py migrate` due to significant changes in the `AbstractAccessToken` model. Custom swappable models based on `AbstractAccessToken` will also need to be updated and re-migrated.

fix

Run `python manage.py migrate` after upgrading. If using custom swappable models, ensure they are compatible with the new base model and create/apply migrations for them (e.g., `python manage.py makemigrations your_app_name`). Also note minimum Django version is 4.2+ for 3.x.

affects: >=3.0.0

breakingBeginning with version 2.0.0, client secrets are hashed upon save. If you need the cleartext secret (e.g., for testing or specific OIDC configurations), you must copy it *before* saving an application in the Django admin. Also, `PKCE_REQUIRED` is now `True` by default, leading to 'invalid_client' errors for clients not using PKCE.

fix

When creating/editing an application, copy the client secret before saving if you need its unhashed value. For clients not supporting PKCE, set `OAUTH2_PROVIDER = {'PKCE_REQUIRED': False}` in your Django settings to revert to the pre-2.x behavior. It is recommended to implement PKCE where possible for enhanced security.

affects: >=2.0.0

gotchaThe project transitioned from the `jazzband` GitHub organization to `django-oauth` starting with version 3.1.0. While the PyPI package name (`django-oauth-toolkit`) remains the same, this indicates a change in project governance and potentially development practices.

fix

No direct code change is typically required for existing installations. Be aware of the new organization when seeking support, contributing, or referencing project repositories.

affects: >=3.1.0

gotchaIf you plan to use a custom `Application` model (by setting `OAUTH2_PROVIDER_APPLICATION_MODEL` in settings), you *must* define and run the migration for your custom model *before* running the initial `oauth2_provider` migrations. Failing to do so will result in system check errors.

fix

Ensure your custom application model is defined and its migrations are created and applied (potentially with a `run_before` dependency on `oauth2_provider`'s initial migration) before running `python manage.py migrate` for `oauth2_provider`.

affects: *

Upgrade

Version history

3.4.1latest on PyPI · released Aug 21, 2026

Audit

Dependencies

DjangorequiredCore framework requirement, currently supports >=4.2, 5.0, 5.1, 5.2, or 6.0.

oauthlibrequiredUnderlying OAuth2 protocol implementation, requires 3.2.2+.

djangorestframeworkoptionalCommonly used for building APIs and featured in quickstart examples, though not strictly required by DOT itself.

django-cors-headersoptionalRecommended for cross-origin requests, especially during development/testing, as shown in quickstart.

Agent activity

25 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/django-oauth/django-oauth-toolkit ↗

packagehttps://pypi.org/project/django-oauth-toolkit/ ↗

homepagehttps://django-oauth-toolkit.readthedocs.io/ ↗