API key permissions for the Django REST Framework.
Django REST Framework API Key is a library for allowing server-side clients to safely use your API. These clients are typically third-party backends and services (i.e. machines) which do not have a user account but still need to interact with your API in a secure way.
There are important security aspects you need to consider before switching to an API key access control scheme. We've listed some of these in Security caveats, including serving your API over HTTPS.
Besides, see Why and when to use API keys for hints on whether API keys can fit your use case.
API keys are ideal in the following situations:
They can also present enough security for authorizing internal services, such as your API server and an internal frontend application.
Please note that this package is NOT meant for authentication. You should NOT use this package to identify individual users, either directly or indirectly.
If you need server-to-server authentication, you may want to consider OAuth instead. Libraries such as django-oauth-toolkit can help.
pip install "djangorestframework-api-key==2.*"
Note: It is highly recommended to pin your dependency to the latest major version (as depicted above), as breaking changes may and will happen between major releases.
Add the app to your
# settings.py INSTALLED_APPS = [ # ... "rest_framework", "rest_framework_api_key", ]
Run the included migrations:
python manage.py migrate
To learn how to configure permissions and manage API keys, head to the Documentation.