django-sesame
Frictionless authentication with "Magic Links" for your Django project.
Decision gist · record as of 2026-08-14
Yes, if you need passwordless authentication for Django and accept the security tradeoff that tokens in URLs are inherently exposed to logs, emails, and browser history. The package is stable (Production/Stable status), well-maintained despite aging release cadence, has no known vulnerabilities, and integrates cleanly with Django's auth system. Review the (in)security section of the documentation before deploying to understand token lifetime and invalidation strategy for your use case.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires django.contrib.auth to be enabled in your Django project; Python ≥ 3.9 and Django 4.2, 5.0, 5.1, or 5.2.
- Low install friction with a single runtime dependency on django.
- Maintenance status is aging—last release was 469 days ago, though the repository remains active with a recent commit on 2026-01-05 and 1034 stars.
License · maintenance · safety
BSD-3-Clause (permissive) — BSD-3-Clause is a permissive license; you can use, modify, and distribute django-sesame with minimal restrictions, provided you include the license notice.
last release 2025-05-02 (469 days) · last repo commit 2026-01-05 · 1,034 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 258,503 downloads/mo, #8,429 on PyPI
Alternatives
Verify before relying
pip install django-sesame
# In Django settings.py:
AUTHENTICATION_BACKENDS = [
"django.contrib.auth.backends.ModelBackend",
"sesame.backends.ModelBackend",
]
# Generate a login URL:
from sesame.utils import get_query_string
from django.contrib.auth import get_user_model
User = get_user_model()
user = User.objects.first()
login_url = "https://example.com/sesame/login/" + get_query_string(user)- Whether token expiration (SESAME_MAX_AGE) defaults are suitable for your use case without explicit configuration.
- Performance impact of token validation on high-traffic sites.
- Compatibility with custom user models beyond the default Django User model.
What it is and what it does
django-sesame is a Django authentication backend that replaces password-based login with token-based "Magic Links." When you generate a link containing a token and send it to a user (typically via email), clicking that link authenticates them without requiring a password. The package handles token generation, validation, and user authentication through a pluggable Django backend.
It's designed for scenarios where password entry is inconvenient or unnecessary: mobile login flows, time-limited authenticated links for reports or shared content, WebSocket authentication, and private sites where users don't manage personal accounts. The documentation explicitly warns that whoever obtains a token can authenticate, so tokens should be short-lived or single-use depending on your threat model. The package uses modern cryptography for token security and provides configuration options for token invalidation.
Use it for
- Send login links via email for mobile-friendly passwordless login, similar to Slack's approach.
- Generate time-limited authenticated links to reports or documents that work even if the user isn't logged in.
- Create shareable links for guests to access specific content without logging them into a full account.
- Authenticate WebSocket connections by passing a token from the Django server to a WebSocket client.
- Simplify access to private community or family sites where users bookmark personalized authenticated URLs.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need passwordless authentication for Django and accept the security tradeoff that tokens in URLs are inherently exposed to logs, emails, and browser history.
The package is stable (Production/Stable status), well-maintained despite aging release cadence, has no known vulnerabilities, and integrates cleanly with Django's auth system. Review the (in)security section of the documentation before deploying to understand token lifetime and invalidation strategy for your use case.
Install
django-sesame on PyPI
Before you install
Low install friction with a single runtime dependency on django. Maintenance status is aging—last release was 469 days ago, though the repository remains active with a recent commit on 2026-01-05 and 1034 stars.
Requires django.contrib.auth to be enabled in your Django project; Python ≥ 3.9 and Django 4.2, 5.0, 5.1, or 5.2.
License in practice
BSD-3-Clause is a permissive license; you can use, modify, and distribute django-sesame with minimal restrictions, provided you include the license notice.
Quickstart
pip install django-sesame
# In Django settings.py:
AUTHENTICATION_BACKENDS = [
"django.contrib.auth.backends.ModelBackend",
"sesame.backends.ModelBackend",
]
# Generate a login URL:
from sesame.utils import get_query_string
from django.contrib.auth import get_user_model
User = get_user_model()
user = User.objects.first()
login_url = "https://example.com/sesame/login/" + get_query_string(user)Verify before relying
- Whether token expiration (SESAME_MAX_AGE) defaults are suitable for your use case without explicit configuration.
- Performance impact of token validation on high-traffic sites.
- Compatibility with custom user models beyond the default Django User model.
Package facts
| License | BSD-3-Clause permissive |
| Python support | Supports the current Python release >=3.9 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 1 packagedjango |
| Maintenance | Aging 469 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 258,503 / month, #8,429 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableEnvironment :: Web EnvironmentFramework :: DjangoFramework :: Django :: 4.2Framework :: Django :: 5.0Framework :: Django :: 5.1Framework :: Django :: 5.2Intended Audience :: DevelopersLicense :: OSI Approved :: BSD LicenseOperating System :: OS IndependentProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.9 |
Evidence: django_sesame-3.2.3-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “token-based login django”
- django-sesamedjango-sesame provides token-based authentication for Django projects…
- django-authlibProvides passwordless authentication for Django using email-based…
- django-rest-knoxProvides token-based authentication for Django REST Framework with…
Give your agent the search over MCP, or paste the wish link into any chat.
More Dynamic Content packages
MarkupSafe provides a text object that escapes special characters so untrusted strings can be safely embedded in HTML and XML without injection attacks.
Jinja2 is a templating engine that renders dynamic content by combining templates with Python-like syntax and data, supporting template inheritance, macros, autoescaping, and sandboxed execution.
Soupsieve is a CSS selector library designed to work with Beautiful Soup 4 to select, match, and filter HTML and XML elements using modern CSS selectors from CSS level 1 through CSS level 4 specifications.
Install it if you use Beautiful Soup for HTML or XML parsing and want modern CSS selector support.
Werkzeug is a WSGI utility library providing request/response objects, URL routing, an interactive debugger, HTTP utilities, and a development server for building web applications.
Flask is a lightweight WSGI web application framework for building web applications in Python, from simple single-page sites to complex multi-route applications.
Mako compiles Python-embedded templates into Python modules for fast rendering, supporting layout inheritance, custom functions, and direct Python expressions within template syntax.
See also django-magiclink · django-authlib · djangorestframework-simplejwt · drf-jwt · django-rest-knox · django-auth-ldap · dj-rest-auth · django-rest-passwordreset · django-auth-adfs · quart-auth