django-sesame

What it is and what it does

django-sesame is a Django authentication backend that replaces password-based login with token-based "Magic Links." When you generate a link containing a token and send it to a user (typically via email), clicking that link authenticates them without requiring a password. The package handles token generation, validation, and user authentication through a pluggable Django backend.

It's designed for scenarios where password entry is inconvenient or unnecessary: mobile login flows, time-limited authenticated links for reports or shared content, WebSocket authentication, and private sites where users don't manage personal accounts. The documentation explicitly warns that whoever obtains a token can authenticate, so tokens should be short-lived or single-use depending on your threat model. The package uses modern cryptography for token security and provides configuration options for token invalidation.

Use it for:

• Send login links via email for mobile-friendly passwordless login, similar to Slack's approach.
• Generate time-limited authenticated links to reports or documents that work even if the user isn't logged in.
• Create shareable links for guests to access specific content without logging them into a full account.
• Authenticate WebSocket connections by passing a token from the Django server to a WebSocket client.
• Simplify access to private community or family sites where users bookmark personalized authenticated URLs.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

django-sesame provides token-based authentication for Django projects using "Magic Links"—URLs containing authentication tokens that log users in without passwords.

Yes, if you need passwordless authentication for Django and accept the security tradeoff that tokens in URLs are inherently exposed to logs, emails, and browser history. The package is stable (Production/Stable status), well-maintained despite aging release cadence, has no known vulnerabilities, and integrates cleanly with Django's auth system. Review the (in)security section of the documentation before deploying to understand token lifetime and invalidation strategy for your use case.

Install

django-sesame on PyPI

pip install django-sesame

uv add django-sesame

poetry add django-sesame

Installing django-sesame

Before you install

Low install friction with a single runtime dependency on django. Maintenance status is aging—last release was 469 days ago, though the repository remains active with a recent commit on 2026-01-05 and 1034 stars.

License in practice

BSD-3-Clause is a permissive license; you can use, modify, and distribute django-sesame with minimal restrictions, provided you include the license notice.

Quickstart

pip install django-sesame

# In Django settings.py:
AUTHENTICATION_BACKENDS = [
    "django.contrib.auth.backends.ModelBackend",
    "sesame.backends.ModelBackend",
]

# Generate a login URL:
from sesame.utils import get_query_string
from django.contrib.auth import get_user_model
User = get_user_model()
user = User.objects.first()
login_url = "https://example.com/sesame/login/" + get_query_string(user)

Requires django.contrib.auth to be enabled in your Django project; Python ≥ 3.9 and Django 4.2, 5.0, 5.1, or 5.2.

Verify before relying

• Whether token expiration (SESAME_MAX_AGE) defaults are suitable for your use case without explicit configuration.
• Performance impact of token validation on high-traffic sites.
• Compatibility with custom user models beyond the default Django User model.

Package facts

Evidence: django_sesame-3.2.3-py3-none-any.whl

Keywords: authentication, token-based-authentication

Tags

More Dynamic Content packages