django-otp-webauthn

What it is and what it does

Django OTP WebAuthn is a plugin for the Django OTP framework that integrates FIDO2 WebAuthn Passkey authentication into Django projects. It uses the py_webauthn library for cryptographic operations and provides both passwordless login and multi-factor authentication modes—users can either replace passwords entirely with biometric or security-key verification, or use Passkeys as a second factor after password entry.

The package includes a default frontend implementation with JavaScript templates for registration and verification flows, styled to work with strict Content Security Policy settings. It requires minimal configuration: adding the app and middleware to Django settings, setting a few environment variables (relying party name, domain, and allowed origins), and including template tags in your login and registration pages. The package supports Django 5.2+ and Python 3.10+, and as of May 2025 is considered stable enough for production use, though it remains relatively new.

Use it for:

• Replace password-based login entirely with biometric or security-key verification for users with compatible devices.
• Add a second authentication factor after password entry, letting users approve login with a tap or biometric scan.
• Migrate existing Django projects to FIDO2-compliant authentication without rewriting authentication logic.
• Support passwordless authentication for organizations requiring strong credential security without managing certificate infrastructure.
• Enable cross-platform authentication across web, mobile, and desktop by leveraging platform authenticators.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Adds WebAuthn Passkey support to Django OTP, enabling passwordless and multi-factor authentication via biometric, security key, or platform authenticators.

Yes, if you need WebAuthn Passkey support in Django and are willing to target Django 5.2+ and Python 3.10+. The package is actively maintained, has low install friction, carries no known vulnerabilities, and is marked stable for production use. The permissive BSD-3-Clause license poses no restrictions. Evaluate whether your target browsers and user base support WebAuthn before committing.

Install

django-otp-webauthn on PyPI

pip install django-otp-webauthn

uv add django-otp-webauthn

poetry add django-otp-webauthn

Installing django-otp-webauthn

Before you install

Low install friction with a pure-Python wheel. Actively maintained as of August 2026, with recent commits and marked stable for production use as of May 2025, though the package is still relatively new.

License in practice

BSD-3-Clause permissive license allows commercial and private use with minimal restrictions.

Quickstart

pip install django-otp-webauthn

# In Django settings.py
INSTALLED_APPS = [
    "django_otp_webauthn",
    "django_otp",
]

MIDDLEWARE = [
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "django_otp.middleware.OTPMiddleware",
]

OTP_WEBAUTHN_RP_NAME = "My Site"
OTP_WEBAUTHN_RP_ID = "example.com"
OTP_WEBAUTHN_ALLOWED_ORIGINS = ["https://example.com"]

Requires Django >= 5.2, Python >= 3.10, and django-otp >= 1.4.0; WebAuthn support in the target browser (Chrome 67+, Firefox 60+, Safari 13+, Edge 18+).

Verify before relying

• Whether the default frontend JavaScript implementation meets CSP requirements in all deployment contexts.
• Production-readiness status and any known limitations beyond the May 2025 stability claim.
• Performance characteristics under high registration or authentication volume.

Package facts

Evidence: django_otp_webauthn-0.10.0-py3-none-any.whl

Keywords: authentication, django, django-otp, fido2, mfa, security, u2f, webauthn

Tags

More Security packages