django-rest-knox
Authentication for django rest framework
Decision gist · record as of 2026-08-14
Yes. Knox solves real security and multi-device problems that DRF's built-in TokenAuthentication does not address. It has low install friction, active maintenance, no known vulnerabilities, and a permissive MIT license. Install it if your Django REST API needs per-device tokens, secure token storage, or token expiry—otherwise DRF's native authentication may suffice.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Django and Django REST Framework to be installed and configured in your project; Python 3.10 or later.
- Low friction: pure Python wheel with only django and djangorestframework as runtime dependencies.
- Actively maintained with a recent release (33 days old) and steady commit activity.
License · maintenance · safety
MIT (permissive) — MIT license permits commercial and private use with minimal restrictions; you may use, modify, and distribute this package freely provided you include the license notice.
last release 2026-07-12 (33 days) · last repo commit 2026-08-10 · 1,258 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 823,745 downloads/mo, #4,966 on PyPI
Alternatives
Verify before relying
pip install django-rest-knox
# In Django settings.py:
INSTALLED_APPS = [
'rest_framework',
'knox',
]
# In urls.py:
from knox import views as knox_views
urlpatterns = [
path('api-token-auth/', knox_views.LoginView.as_view()),
]- Whether token expiry default of 10 hours is configurable per-token or only globally via settings.
- Performance characteristics when managing large numbers of concurrent tokens per user.
- Compatibility with custom DRF authentication backends or permission classes.
What it is and what it does
Django-rest-knox is a token authentication module for Django REST Framework that replaces DRF's single-token-per-user model with a one-token-per-login approach. This allows multiple devices or clients to authenticate independently, each holding its own token that can be revoked without affecting other sessions. Tokens are stored as secure hashes (not plaintext) in the database, mitigating the risk of account compromise if the database is stolen. The package also adds token expiry support with a configurable default (10 hours), addressing a gap in DRF's native implementation.
It integrates directly into Django REST Framework's authentication system and requires only django and djangorestframework as dependencies. The package is actively maintained, supports modern Python versions (3.10 through 3.14) and recent Django releases (4.2 through 6.0), and carries no known security vulnerabilities. It is suitable for REST APIs that need per-device session management and stronger token security than DRF provides out of the box.
Use it for
- Multi-device mobile apps where each phone/tablet needs its own independent login token and logout does not affect other devices.
- Web applications requiring server-side token revocation without forcing all users to re-authenticate.
- APIs where database compromise should not immediately grant access to all user accounts via stolen tokens.
- Systems needing automatic token expiry to limit the window of exposure if a token is leaked.
- REST services that need to track and manage which client devices are currently authenticated.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
Knox solves real security and multi-device problems that DRF's built-in TokenAuthentication does not address. It has low install friction, active maintenance, no known vulnerabilities, and a permissive MIT license. Install it if your Django REST API needs per-device tokens, secure token storage, or token expiry—otherwise DRF's native authentication may suffice.
Install
django-rest-knox on PyPI
Before you install
Low friction: pure Python wheel with only django and djangorestframework as runtime dependencies. Actively maintained with a recent release (33 days old) and steady commit activity.
Requires Django and Django REST Framework to be installed and configured in your project; Python 3.10 or later.
License in practice
MIT license permits commercial and private use with minimal restrictions; you may use, modify, and distribute this package freely provided you include the license notice.
Quickstart
pip install django-rest-knox
# In Django settings.py:
INSTALLED_APPS = [
'rest_framework',
'knox',
]
# In urls.py:
from knox import views as knox_views
urlpatterns = [
path('api-token-auth/', knox_views.LoginView.as_view()),
]Verify before relying
- Whether token expiry default of 10 hours is configurable per-token or only globally via settings.
- Performance characteristics when managing large numbers of concurrent tokens per user.
- Compatibility with custom DRF authentication backends or permission classes.
Package facts
| License | MIT permissive |
| Python support | Supports the current Python release >=3.10 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 2 packagesdjangodjangorestframework |
| Maintenance | Actively maintained 33 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 823,745 / month, #4,966 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableFramework :: DjangoFramework :: Django :: 4.2Framework :: Django :: 5.0Framework :: Django :: 5.2Framework :: Django :: 6.0Intended Audience :: DevelopersLicense :: OSI Approved :: MIT LicenseProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Topic :: Internet :: WWW/HTTP :: Session |
Evidence: django_rest_knox-5.1.0-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “per-device authentication tokens”
- django-rest-knoxProvides token-based authentication for Django REST Framework with…
- glocaltokensExtracts local authentication tokens from Google Home devices by…
- biscuit-pythonPython bindings for the biscuit authentication library, enabling…
Give your agent the search over MCP, or paste the wish link into any chat.
More WWW/HTTP packages
urllib3 is an HTTP client library that provides thread-safe connection pooling, SSL/TLS verification, multipart file uploads, request retries, compression support, and proxy handling for Python applications.
Requests is a Python HTTP library that simplifies sending HTTP/1.1 requests with automatic handling of headers, authentication, cookies, and response parsing.
h11 is a pure-Python HTTP/1.1 protocol implementation that handles parsing and serializing HTTP messages without any built-in I/O, letting you integrate it with any network layer you choose.
HTTPX is a fully featured HTTP client library for Python that provides both sync and async APIs, with support for HTTP/1.1 and HTTP/2, plus an integrated command-line client.
Install it if you are building new projects or modernizing existing ones that rely on HTTP.
A minimal low-level HTTP client library that sends HTTP requests with thread-safe and task-safe connection pooling, supporting HTTP/1.1, HTTP/2, proxies, and both sync and async interfaces.
aiohttp is an async HTTP client and server framework built on asyncio, supporting both WebSockets and middleware-based routing for building concurrent web applications.
Install it if you need async HTTP client or server capabilities in asyncio-based applications.
See also drf-jwt · dj-rest-auth · djangorestframework-simplejwt · django-sesame · djangorestframework-jwt · djoser · quart-auth · django-auth-adfs · fastapi-login · aws-bedrock-token-generator