Registry / auth-security / django-otp-webauthn

django-otp-webauthn

library0.9.0pypypiunverified

FIDO2 WebAuthn support for django-otp, enabling passkey authentication. Version 0.8.0 requires Python >=3.10 and Django 4.2+. Active development, monthly releases.

auth-security web-framework database

pip install django-otp-webauthn

github ↗package ↗docs ↗changelog ↗

INSTALL

IMPORT

SIG · DJANGO-OTP-WEBAUTH

django-otp-webauthn

auth-securitypythonv0.9.0

Install

5.0s avg

Import

—

Disk

93MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v0.9.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.000s · 92.9MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 5.0s · import 0.000s · 93MB

93MB installed

● package 93MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

WebAuthnDevice

✓ from django_otp_webauthn import WebAuthnDevice

✗ from django_otp_webauthn import WebAuthnDevice

Minimal setup: add to INSTALLED_APPS, backend, and configure relying party.

INSTALLED_APPS = [ ... 'django_otp', 'django_otp_webauthn', ] AUTHENTICATION_BACKENDS = [ 'django.contrib.auth.backends.ModelBackend', 'django_otp_webauthn.backends.WebAuthnBackend', ] OTP_WEBAUTHN_RP_NAME = 'My App' OTP_WEBAUTHN_RP_ID = 'example.com' OTP_WEBAUTHN_ORIGIN = 'https://example.com'

Debug

Known issues

breakingStarting from version 0.7.0, the model field 'webauthn_key' was renamed to 'credential_public_key'. This breaks custom code that references the old field name.

fix

Update any direct field references: old_obj.webauthn_key -> old_obj.credential_public_key

affects: >=0.7.0

deprecatedThe setting OTP_WEBAUTHN_ALLOWED_ORIGINS is deprecated in 0.8.0; use OTP_WEBAUTHN_ORIGIN (single string) instead.

fix

Replace OTP_WEBAUTHN_ALLOWED_ORIGINS = ['https://example.com'] with OTP_WEBAUTHN_ORIGIN = 'https://example.com'

affects: 0.8.0

gotchaThe 'webauthn' library (not django-otp-webauthn) uses a non-standard field name 'credential_id' in its return dict. When accessing credential data, use 'credential_id' (lowercase) not 'credentialID'.

fix

Always use .get('credential_id') on the response dict, not .credentialID or .get('credentialID')

affects: all

Upgrade

Version history

0.9.0latest on PyPI · released Jun 8, 2026

Audit

Dependencies

django-otprequiredCore OTP framework integration

djangorequiredDjango ORM and admin integration

webauthnrequiredWebAuthn protocol handling

cryptographyrequiredKey handling and attestation

Agent activity

32 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubhttps://github.com/Stormbase/django-otp-webauthn ↗

packagehttps://pypi.org/project/django-otp-webauthn/ ↗

docshttps://django-otp-webauthn.readthedocs.io/en/latest/ ↗

changeloghttps://github.com/Stormbase/django-otp-webauthn/blob/main/CHANGELOG.md ↗