django-rest-passwordreset

What it is and what it does

Django-rest-passwordreset is a Django REST Framework extension that adds password reset functionality via REST endpoints. It provides two main endpoints: one to request a reset token (sent to a registered email) and another to verify the token and set a new password. The package does not assume how tokens are delivered—instead, it fires Django signals when tokens are created or used, allowing you to hook in your own delivery mechanism (email, SMS, push notification, etc.).

The package stores tokens in a database table with configurable expiry (default 24 hours) and includes a management command for periodic cleanup of expired tokens. It handles security concerns like token validation, expiration checking, and optional information-leakage prevention to avoid revealing whether an account exists. You integrate it by adding it to INSTALLED_APPS, running migrations, including its URL patterns, and connecting signal handlers to send notifications.

Use it for:

• Add a self-service password reset flow to a Django REST API without building token management from scratch.
• Send password reset links via email by connecting to the reset_password_token_created signal.
• Validate reset tokens before allowing password changes, with automatic expiry and cleanup.
• Prevent account enumeration attacks by returning generic responses for invalid, expired, or missing tokens.
• Schedule periodic cleanup of expired tokens using the included management command to keep the database lean.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Provides REST API endpoints for Django applications to handle password reset requests and confirmations, with token-based verification and signal-driven delivery (email, SMS, etc.).

Yes. This is a production-stable, actively maintained package with zero dependencies and low install friction. It solves a common Django problem (password reset) with a clean signal-based design that lets you control delivery. No known vulnerabilities. Use it unless you need highly custom password reset logic that the signal system cannot accommodate.

Install

django-rest-passwordreset on PyPI

pip install django-rest-passwordreset

uv add django-rest-passwordreset

poetry add django-rest-passwordreset

Installing django-rest-passwordreset

Before you install

Low friction: pure Python wheel with no runtime dependencies. Actively maintained with recent releases and 435 repository stars. Production-stable status.

License in practice

BSD License (permissive): you can use this in commercial and proprietary projects with minimal restrictions, provided you include a copy of the license.

Quickstart

pip install django-rest-passwordreset

# In settings.py INSTALLED_APPS:
INSTALLED_APPS = [
    'rest_framework',
    'django_rest_passwordreset',
]

# In urls.py:
path('api/password_reset/', include('django_rest_passwordreset.urls', namespace='password_reset'))

# Run migrations:
# python manage.py migrate

# Connect a signal handler to send emails:
from django_rest_passwordreset.signals import reset_password_token_created
from django.dispatch import receiver

@receiver(reset_password_token_created)
def send_password_reset_email(sender, reset_password_token, **kwargs):
    # Send email with reset_password_token.key

Requires Django and Django REST Framework to be installed and configured in your project; the package itself has no runtime dependencies but is useless without them.

Verify before relying

• Whether Django and Django REST Framework are listed as explicit install dependencies or assumed to be pre-installed.
• Exact token expiry time default value (description mentions 24 hours but setting name differs from documented behavior).
• Whether the management command name is `clearresetpasswodtokens` (as shown) or if that is a typo in the documentation.

Package facts

Evidence: django_rest_passwordreset-1.6.0-py3-none-any.whl

Tags

More WWW/HTTP packages