django-graphql-jwt

What it is and what it does

django-graphql-jwt bridges JWT authentication into Django GraphQL APIs by providing middleware, authentication backends, and GraphQL mutations for token lifecycle management. It integrates with Django's built-in authentication system and graphene to let you issue, verify, and refresh JWTs through GraphQL mutations rather than REST endpoints.

The package handles the plumbing: it adds middleware to extract and validate tokens from request headers, registers a custom authentication backend that Django's permission system recognizes, and exposes three core mutations (obtain, verify, refresh) that clients call to manage their tokens. You configure it by adding middleware to Django settings and mutations to your GraphQL schema, then use standard Django decorators and permission checks on your resolvers.

Use it for:

• Secure a GraphQL API by issuing JWTs to authenticated users and requiring tokens on protected queries and mutations.
• Build a single-page app or mobile client that exchanges credentials for a JWT once, then uses the token for subsequent requests.
• Implement token refresh logic so clients can renew expired tokens without re-authenticating.
• Integrate GraphQL authentication with Django's existing user model and permission system.
• Replace REST-based token endpoints with GraphQL mutations for a unified API surface.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Adds JSON Web Token (JWT) authentication to Django GraphQL APIs, handling token generation, verification, and refresh through GraphQL mutations and middleware.

Yes, if you are building a Django GraphQL API and need JWT authentication. The package is stable (version 0.4.0, Beta status), has no known vulnerabilities, and integrates cleanly with standard Django and graphene patterns. Dormancy is a minor concern—last commit was 2023-12-20—but the code is mature and unlikely to require frequent updates. Not suitable if you need active maintenance or support for very recent Django or Python versions.

Install

django-graphql-jwt on PyPI

pip install django-graphql-jwt

uv add django-graphql-jwt

poetry add django-graphql-jwt

Installing django-graphql-jwt

Before you install

Low friction install with four runtime dependencies (django, graphene-django, graphene, pyjwt). Maintenance is dormant—last commit was 2023-12-20—but the repository remains unarchived with 826 stars. Suitable for existing projects but expect no active development.

License in practice

MIT license (permissive). You can use, modify, and distribute this package freely in commercial and private projects with minimal restrictions.

Quickstart

pip install django-graphql-jwt

# In Django settings:
MIDDLEWARE = [
    "django.contrib.auth.middleware.AuthenticationMiddleware",
]

AUTHENTICATION_BACKENDS = [
    "graphql_jwt.backends.JSONWebTokenBackend",
]

# In schema:
import graphene
class Mutation(graphene.ObjectType):
    token_auth = graphql_jwt.ObtainJSONWebToken.Field()
    verify_token = graphql_jwt.Verify.Field()
    refresh_token = graphql_jwt.Refresh.Field()

Requires django, graphene-django, and pyjwt to be installed and configured; Django's AuthenticationMiddleware must be in MIDDLEWARE settings.

Verify before relying

• Whether the package works with Django versions released after 4.2 or Python versions after 3.11.
• Current state of the documentation at https://django-graphql-jwt.domake.io and whether examples remain accurate.
• Whether dormancy affects real-world reliability for new projects or only indicates no active feature development.

Package facts

Evidence: django_graphql_jwt-0.4.0-py3-none-any.whl

Keywords: django, graphql, jwt

Tags

More Software Development packages