How do I create a login API using Django Rest Framework?


I want to create a login api (or use an existing one if it is already pre-bundled) using django rest framework. However, I’m completely at a loss. Whenever I send a post request to the django rest framework “login” url, it just sends back the browsable api template page…


url(r'^api/v1/', include('rest_framework.urls', namespace='rest_framework'))




POST /api/v1/login  username='name' pass='pass'


200 OK "{username: 'name', 'userId': '54321'}" set-cookie: sessionid="blahblah"
Asked By: JayPrime2012



Take a look at the api view from django-rest-framework-jwt. It’s an implementation for creating auth tokens rather than cookie sessions, but your implementation will be similar. See and You can probably use the unchanged, and just adjust your views to return the right parameters and possibly set the session cookie (can’t recall if that’s already performed in authentication).

Answered By: Kevin Stone

If you want something like this I do the same thing however I use Token authentication.

Check out their token page here

This may not be what you want but the way I do it is (since I’m using it as a rest api endpoints for mobile clients)

I can do my url localhost:8000/api/users/ -H Authorization : Token
A browser could then use the regular login page that you create at the provided rest framework url

url(r'^api-auth/', include('rest_framework.urls', namespace='rest_framework')

and to get tokens for ‘login-less’ navigation

url(r'^api-token-auth/', 'rest_framework.authtoken.views.obtain_auth_token')

Then if you make calls and such you can pass the authorization tokens. Of course this is just how I do it and it’s probably not the most efficient way but my goal was to create a way that I can provide users with session authentication for browsers and mobile access via tokens.

Then in your make sure you add the authentication requirements for that view. Almost the same as session authentication section

permission_classes = (permissions.IsAdminUser,)

but also include

authentication_classes = (authentication.TokenAuthentication,)

I hope this helps but if not, good luck on your search.

Answered By: TimD

Of course token is a good way to authenticate, but questioner is asking about session authentication.


POST /api/v1/login  username='username' password='password' 
  • Put csrftoken value at X-CSRFToken in header
  • Even though someone using email as username filed, username name parameter is required for email input (e.g. username='[email protected]')


302 FOUND sessionid="blahblah"
  • If you not specified next value, it will automatically redirect into /accounts/profile/ which can yield 404 error
Answered By: Chemical Programmer

Adding our views:

from rest_framework_jwt.views import refresh_jwt_token

urlpatterns = [
    url(r'^rest-auth/', include('rest_auth.urls')),
    url(r'^rest-auth/registration/', include('rest_auth.registration.urls')),
    url(r'^refresh-token/', refresh_jwt_token),
Answered By: mt2609