Registry /
auth-security / djangorestframework-jwt
Install & Compatibility
Where this runs
tested against v1.11.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.920 runs
installs and imports cleanly · install 0.0s · import 0.000s · 18.1MB
glibcpy 3.10–3.920 runs
installs and imports cleanly · install 1.6s · import 0.000s · 19MB
16MB installed
● package 16MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
JSONWebTokenAuthentication
✓ from rest_framework_jwt.authentication import JSONWebTokenAuthentication
✗ from rest_framework_jwt.authentication import JSONWebTokenAuthentication
Configure `settings.py` by adding `rest_framework_jwt` to `INSTALLED_APPS`, setting `DEFAULT_AUTHENTICATION_CLASSES` for DRF, and defining `JWT_AUTH` settings, especially `JWT_SECRET_KEY`. Then, add the token authentication URLs to your project's `urls.py`.
import os
import datetime
# settings.py
INSTALLED_APPS = [
# ... other apps
'rest_framework',
'rest_framework_jwt',
]
REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': (
'rest_framework_jwt.authentication.JSONWebTokenAuthentication',
# 'rest_framework.authentication.SessionAuthentication', # Optional
# 'rest_framework.authentication.BasicAuthentication', # Optional
),
}
JWT_AUTH = {
'JWT_RESPONSE_PAYLOAD_HANDLER': 'your_project_name.utils.jwt_response_payload_handler', # Customize response data
'JWT_SECRET_KEY': os.environ.get('DJANGO_SECRET_KEY', 'insecure-dev-secret-key'), # IMPORTANT: Use a strong, unique key from env var in production
'JWT_ALLOW_REFRESH': True,
'JWT_EXPIRATION_DELTA': datetime.timedelta(seconds=3600), # Token valid for 1 hour
'JWT_REFRESH_EXPIRATION_DELTA': datetime.timedelta(days=7), # Refresh token valid for 7 days
# ... other settings
}
# your_project_name/urls.py
from django.urls import path
from rest_framework_jwt.views import obtain_jwt_token, refresh_jwt_token, verify_jwt_token
urlpatterns = [
# ... your other urls
path('api/token/', obtain_jwt_token, name='api_token_auth'),
path('api/token/refresh/', refresh_jwt_token, name='api_token_refresh'),
path('api/token/verify/', verify_jwt_token, name='api_token_verify'),
]
Debug
Known issues
gotchaThis library is largely unmaintained since its last release in 2017. It may lack security updates and compatibility with recent Django and Django REST Framework versions. For new projects or migrations, consider using `drf-simplejwt` or other actively maintained alternatives.fixEvaluate migrating to `drf-simplejwt` for better long-term support and security.
affects: 1.11.0 and prior
breakingOfficial support for Django REST Framework 2.x and older Django versions (pre-1.8) was dropped in version 1.8.0. Using `djangorestframework-jwt` with unsupported versions may lead to unexpected errors or vulnerabilities.fixEnsure your project uses Django >= 1.8 and Django REST Framework >= 3.x for compatibility. For newer Django/DRF, consider alternatives like `drf-simplejwt`.
affects: >=1.8.0
gotchaUsing a static or easily discoverable `JWT_SECRET_KEY` directly in `settings.py` is a severe security vulnerability. This key is used to sign and verify JWTs, and its compromise allows attackers to forge tokens.fixAlways retrieve `JWT_SECRET_KEY` from a secure source like environment variables (`os.environ.get('YOUR_SECRET_KEY')`) or a secrets management service in production environments. Never commit it directly to source control. affects: All versions
breakingThe `verify_expiration` argument for PyJWT's `decode` function was removed in PyJWT 1.0.0. `djangorestframework-jwt` version 1.5.0 and later fixed this incompatibility, but older versions might fail if using PyJWT >= 1.0.0.fixUpgrade `djangorestframework-jwt` to version 1.5.0 or higher to ensure compatibility with newer PyJWT versions and proper token expiration handling.
affects: <1.5.0
Upgrade
Version history
1.11.0latest on PyPI · released Jun 23, 2017
Audit
Dependencies
djangorestframeworkrequiredCore dependency for integration with Django REST Framework.
PyJWTrequiredHandles the encoding and decoding of JSON Web Tokens.