---
id: django-otp-webauthn
version: "0.10.0"
license: BSD-3-Clause
license_treatment: permissive
maintenance: active
---

# django-otp-webauthn — FIDO2 WebAuthn support for django-otp: lets your users authenticate with Passkeys

License: permissive · Maintenance: active · Downloads: 142.0K/mo

## What it is and what it does

Django OTP WebAuthn is a plugin for the Django OTP framework that integrates FIDO2 WebAuthn Passkey authentication into Django projects. It uses the py_webauthn library for cryptographic operations and provides both passwordless login and multi-factor authentication modes—users can either replace passwords entirely with biometric or security-key verification, or use Passkeys as a second factor after password entry.

The package includes a default frontend implementation with JavaScript templates for registration and verification flows, styled to work with strict Content Security Policy settings. It requires minimal configuration: adding the app and middleware to Django settings, setting a few environment variables (relying party name, domain, and allowed origins), and including template tags in your login and registration pages. The package supports Django 5.2+ and Python 3.10+, and as of May 2025 is considered stable enough for production use, though it remains relatively new.

Use it for:

- Replace password-based login entirely with biometric or security-key verification for users with compatible devices.
- Add a second authentication factor after password entry, letting users approve login with a tap or biometric scan.
- Migrate existing Django projects to FIDO2-compliant authentication without rewriting authentication logic.
- Support passwordless authentication for organizations requiring strong credential security without managing certificate infrastructure.
- Enable cross-platform authentication across web, mobile, and desktop by leveraging platform authenticators.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Adds WebAuthn Passkey support to Django OTP, enabling passwordless and multi-factor authentication via biometric, security key, or platform authenticators.

Yes, if you need WebAuthn Passkey support in Django and are willing to target Django 5.2+ and Python 3.10+. The package is actively maintained, has low install friction, carries no known vulnerabilities, and is marked stable for production use. The permissive BSD-3-Clause license poses no restrictions. Evaluate whether your target browsers and user base support WebAuthn before committing.

## Install

pip install django-otp-webauthn
uv add django-otp-webauthn
poetry add django-otp-webauthn

## Installing django-otp-webauthn

Before you install: Low install friction with a pure-Python wheel. Actively maintained as of August 2026, with recent commits and marked stable for production use as of May 2025, though the package is still relatively new.

License in practice: BSD-3-Clause permissive license allows commercial and private use with minimal restrictions.

Quickstart:

pip install django-otp-webauthn

# In Django settings.py
INSTALLED_APPS = [
    "django_otp_webauthn",
    "django_otp",
]

MIDDLEWARE = [
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "django_otp.middleware.OTPMiddleware",
]

OTP_WEBAUTHN_RP_NAME = "My Site"
OTP_WEBAUTHN_RP_ID = "example.com"
OTP_WEBAUTHN_ALLOWED_ORIGINS = ["https://example.com"]

Requires Django >= 5.2, Python >= 3.10, and django-otp >= 1.4.0; WebAuthn support in the target browser (Chrome 67+, Firefox 60+, Safari 13+, Edge 18+).

Verify before relying:

- Whether the default frontend JavaScript implementation meets CSP requirements in all deployment contexts.
- Production-readiness status and any known limitations beyond the May 2025 stability claim.
- Performance characteristics under high registration or authentication volume.

## Package facts

- License: BSD-3-Clause (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 142.0K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

webauthn passkey django, django passwordless authentication, fido2 django otp, django multi-factor authentication, webauthn mfa django, passkey registration django, django security key login, webauthn, passwordless-auth, fido2

[View on SkillFed](https://skillfed.io/packages/django-otp-webauthn) · [View on PyPI](https://pypi.org/project/django-otp-webauthn/)