{"id":2000,"library":"django-oauth-toolkit","title":"Django OAuth Toolkit","description":"Django OAuth Toolkit (DOT) is a Python library that provides OAuth2 capabilities to Django projects, offering out-of-the-box endpoints, data, and logic for robust authorization. It leverages OAuthLib to ensure RFC-compliance and is currently at version 3.2.0. The project is actively maintained with regular releases, supporting recent Django and Python versions.","status":"active","version":"3.2.0","language":"python","source_language":"en","source_url":"https://github.com/django-oauth/django-oauth-toolkit","tags":["django","oauth","oauth2","authentication","authorization","rest","openid-connect"],"install":[{"cmd":"pip install django-oauth-toolkit","lang":"bash","label":"Install stable version"}],"dependencies":[{"reason":"Core framework requirement, currently supports >=4.2, 5.0, 5.1, 5.2, or 6.0.","package":"Django","optional":false},{"reason":"Underlying OAuth2 protocol implementation, requires 3.2.2+.","package":"oauthlib","optional":false},{"reason":"Commonly used for building APIs and featured in quickstart examples, though not strictly required by DOT itself.","package":"djangorestframework","optional":true},{"reason":"Recommended for cross-origin requests, especially during development/testing, as shown in quickstart.","package":"django-cors-headers","optional":true}],"imports":[{"wrong":"from oauth2_provider import urls as oauth2_urls","symbol":"oauth2_urls","correct":"from oauth2_provider import urls as oauth2_urls"}],"quickstart":{"code":"import os\n\n# settings.py\nINSTALLED_APPS = [\n    # ... other apps\n    'django.contrib.admin',\n    'django.contrib.auth',\n    'django.contrib.contenttypes',\n    'django.contrib.sessions',\n    'oauth2_provider',\n    'corsheaders', # If using django-cors-headers\n]\n\nMIDDLEWARE = [\n    'django.middleware.security.SecurityMiddleware',\n    'django.contrib.sessions.middleware.SessionMiddleware',\n    'corsheaders.middleware.CorsMiddleware', # If using django-cors-headers\n    'django.middleware.common.CommonMiddleware',\n    'django.middleware.csrf.CsrfViewMiddleware',\n    'django.contrib.auth.middleware.AuthenticationMiddleware',\n    'oauth2_provider.middleware.OAuth2TokenMiddleware',\n    'django.contrib.messages.middleware.MessageMiddleware',\n    'django.middleware.clickjacking.XFrameOptionsMiddleware',\n]\n\nAUTHENTICATION_BACKENDS = [\n    'oauth2_provider.backends.OAuth2Backend',\n    'django.contrib.auth.backends.ModelBackend', # Required for Django admin login\n]\n\n# urls.py\nfrom django.contrib import admin\nfrom django.urls import include, path\nfrom oauth2_provider import urls as oauth2_urls\n\nurlpatterns = [\n    path('admin/', admin.site.urls),\n    path('o/', include(oauth2_urls)),\n    # Your other app URLs\n]\n\n# Configure CORS if needed (e.g., for local development or specific clients)\nCORS_ORIGIN_ALLOW_ALL = True # WARNING: Set to specific origins in production\n","lang":"python","description":"To quickly set up Django OAuth Toolkit, first install it along with `django-cors-headers` (if needed for cross-origin requests). Add `oauth2_provider` and `corsheaders` to `INSTALLED_APPS`. Configure `MIDDLEWARE` to include `OAuth2TokenMiddleware` and `CorsMiddleware`. Add `OAuth2Backend` to `AUTHENTICATION_BACKENDS`. Finally, include `oauth2_provider` URLs in your project's `urls.py`. Remember to run `python manage.py makemigrations` and `python manage.py migrate` to apply database changes. After migration, you can register OAuth2 applications via the Django admin at `/o/applications/`."},"warnings":[{"fix":"Run `python manage.py migrate` after upgrading. If using custom swappable models, ensure they are compatible with the new base model and create/apply migrations for them (e.g., `python manage.py makemigrations your_app_name`). Also note minimum Django version is 4.2+ for 3.x.","message":"Upgrading to version 3.0.0 or later requires running `manage.py migrate` due to significant changes in the `AbstractAccessToken` model. Custom swappable models based on `AbstractAccessToken` will also need to be updated and re-migrated.","severity":"breaking","affected_versions":">=3.0.0"},{"fix":"When creating/editing an application, copy the client secret before saving if you need its unhashed value. For clients not supporting PKCE, set `OAUTH2_PROVIDER = {'PKCE_REQUIRED': False}` in your Django settings to revert to the pre-2.x behavior. It is recommended to implement PKCE where possible for enhanced security.","message":"Beginning with version 2.0.0, client secrets are hashed upon save. If you need the cleartext secret (e.g., for testing or specific OIDC configurations), you must copy it *before* saving an application in the Django admin. Also, `PKCE_REQUIRED` is now `True` by default, leading to 'invalid_client' errors for clients not using PKCE.","severity":"breaking","affected_versions":">=2.0.0"},{"fix":"No direct code change is typically required for existing installations. Be aware of the new organization when seeking support, contributing, or referencing project repositories.","message":"The project transitioned from the `jazzband` GitHub organization to `django-oauth` starting with version 3.1.0. While the PyPI package name (`django-oauth-toolkit`) remains the same, this indicates a change in project governance and potentially development practices.","severity":"gotcha","affected_versions":">=3.1.0"},{"fix":"Ensure your custom application model is defined and its migrations are created and applied (potentially with a `run_before` dependency on `oauth2_provider`'s initial migration) before running `python manage.py migrate` for `oauth2_provider`.","message":"If you plan to use a custom `Application` model (by setting `OAUTH2_PROVIDER_APPLICATION_MODEL` in settings), you *must* define and run the migration for your custom model *before* running the initial `oauth2_provider` migrations. Failing to do so will result in system check errors.","severity":"gotcha","affected_versions":"*"}],"env_vars":null,"search_vec":"'3.2.0':45 'activ':49 'authent':63 'author':31,64 'box':24 'capabl':15 'complianc':39 'connect':68 'current':42 'data':26 'django':1,4,17,56,60 'dot':7 'endpoint':25 'ensur':36 'leverag':33 'librari':11 'logic':28 'maintain':50 'oauth':2,5,61 'oauth2':14,62 'oauthlib':34 'offer':19 'openid':67 'openid-connect':66 'out-of-the-box':20 'project':18,47 'provid':13 'python':10,58 'recent':55 'regular':52 'releas':53 'rest':65 'rfc':38 'rfc-complianc':37 'robust':30 'support':54 'toolkit':3,6 'version':44,59","created_at":"2026-04-09T18:39:14.318732+00:00","updated_at":"2026-04-16T14:32:50.771129+00:00","problems":{"verify_error":"Traceback (most recent call last):\n  File \"<string>\", line 1, in <module>\n  File \"/tmp/tmpf3ut156x/venv/lib/python3.12/site-packages/oauth2_provider/urls.py\", line 3, in <module>\n    from . import views\n  File \"/tmp/tmpf3ut156x/venv/lib/python3.12/site-packages/oauth2_provider/views/__init__.py\", li"},"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"3.4.1","cli_name":"","cli_version":null,"type":"library","homepage":"https://django-oauth-toolkit.readthedocs.io/","github":"https://github.com/django-oauth/django-oauth-toolkit","docs":null,"changelog":null,"pypi":"https://pypi.org/project/django-oauth-toolkit/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["auth-security","web-framework"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-07-03","last_verified":"2026-08-28","next_check":"2026-07-10","install_tag":null}}