django-rest-knox

What it is and what it does

Django-rest-knox is a token authentication module for Django REST Framework that replaces DRF's single-token-per-user model with a one-token-per-login approach. This allows multiple devices or clients to authenticate independently, each holding its own token that can be revoked without affecting other sessions. Tokens are stored as secure hashes (not plaintext) in the database, mitigating the risk of account compromise if the database is stolen. The package also adds token expiry support with a configurable default (10 hours), addressing a gap in DRF's native implementation.

It integrates directly into Django REST Framework's authentication system and requires only django and djangorestframework as dependencies. The package is actively maintained, supports modern Python versions (3.10 through 3.14) and recent Django releases (4.2 through 6.0), and carries no known security vulnerabilities. It is suitable for REST APIs that need per-device session management and stronger token security than DRF provides out of the box.

Use it for:

• Multi-device mobile apps where each phone/tablet needs its own independent login token and logout does not affect other devices.
• Web applications requiring server-side token revocation without forcing all users to re-authenticate.
• APIs where database compromise should not immediately grant access to all user accounts via stolen tokens.
• Systems needing automatic token expiry to limit the window of exposure if a token is leaked.
• REST services that need to track and manage which client devices are currently authenticated.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Provides token-based authentication for Django REST Framework with per-device tokens, secure hashing, and configurable expiry—addressing limitations of DRF's built-in TokenAuthentication.

Yes. Knox solves real security and multi-device problems that DRF's built-in TokenAuthentication does not address. It has low install friction, active maintenance, no known vulnerabilities, and a permissive MIT license. Install it if your Django REST API needs per-device tokens, secure token storage, or token expiry—otherwise DRF's native authentication may suffice.

Install

django-rest-knox on PyPI

pip install django-rest-knox

uv add django-rest-knox

poetry add django-rest-knox

Installing django-rest-knox

Before you install

Low friction: pure Python wheel with only django and djangorestframework as runtime dependencies. Actively maintained with a recent release (33 days old) and steady commit activity.

License in practice

MIT license permits commercial and private use with minimal restrictions; you may use, modify, and distribute this package freely provided you include the license notice.

Quickstart

pip install django-rest-knox

# In Django settings.py:
INSTALLED_APPS = [
    'rest_framework',
    'knox',
]

# In urls.py:
from knox import views as knox_views
urlpatterns = [
    path('api-token-auth/', knox_views.LoginView.as_view()),
]

Requires Django and Django REST Framework to be installed and configured in your project; Python 3.10 or later.

Verify before relying

• Whether token expiry default of 10 hours is configurable per-token or only globally via settings.
• Performance characteristics when managing large numbers of concurrent tokens per user.
• Compatibility with custom DRF authentication backends or permission classes.

Package facts

Evidence: django_rest_knox-5.1.0-py3-none-any.whl

Keywords: django, rest, authentication, login

Tags

More Session packages