Token Authentication0%
JWT Authentication

Token Authentication

Beginner12 min read•Updated: Jul 11, 2026
Study MaterialsCheatsheet

DRF Token Authentication and Session Auth

Securing API endpoints requires identifying the caller on every request. Django REST Framework ships with built-in authentication mechanisms, the two most prominent being SessionAuthentication (ideal for browser web SPAs on the same domain) and TokenAuthentication (ideal for mobile apps, external clients, and third-party integrations).

1. SessionAuthentication vs TokenAuthentication

FeatureSessionAuthenticationTokenAuthentication
CredentialCookie-based session ID (sessionid)Static Bearer Token string
CSRF Required?Yes (on all mutating requests)No (immune to CSRF)
Best Used ForSame-domain React/Vue SPAsMobile apps, CLI tools, server-to-server APIs
Storagedjango_session tableauthtoken_token table

2. Setting Up DRF TokenAuthentication

Add rest_framework.authtoken to INSTALLED_APPS:

Python
# config/settings.py
INSTALLED_APPS = [
# ...
"rest_framework",
"rest_framework.authtoken", # Creates authtoken_token database table
]
 
# Run migration to create token table
# python manage.py migrate

Configure TokenAuthentication in global settings:

Python
REST_FRAMEWORK = {
"DEFAULT_AUTHENTICATION_CLASSES": [
"rest_framework.authentication.TokenAuthentication",
"rest_framework.authentication.SessionAuthentication",
],
}

3. Exposing the Login / Token Obtain Endpoint

DRF provides a built-in view (obtain_auth_token) that validates username and password and returns a token:

Python
# config/urls.py
from django.urls import path, include
from rest_framework.authtoken.views import obtain_auth_token
 
urlpatterns = [
# POST /api/auth/token/ { "username": "...", "password": "..." }
path("api/auth/token/", obtain_auth_token, name="api-token-auth"),
]

Response:

JSON
{
"token": "9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b"
}

4. Making Authenticated Requests

Clients transmit the token in the Authorization HTTP header prefixed with Token:

HTTP
GET /api/v1/projects/ HTTP/1.1
Host: api.enterprise.com
Authorization: Token 9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b
Accept: application/json

5. Automatically Generating Tokens on User Signup

Use a Django post_save signal to automatically generate an auth token whenever a new user registers:

Python
# accounts/signals.py
from django.conf import settings
from django.db.models.signals import post_save
from django.dispatch import receiver
from rest_framework.authtoken.models import Token
 
@receiver(post_save, sender=settings.AUTH_USER_MODEL)
def create_auth_token(sender, instance=None, created=False, **kwargs):
if created:
Token.objects.create(user=instance)
Interactive Quiz

Practice Quiz

Question 1
What HTTP header and prefix format does DRF TokenAuthentication expect?
Question 2
Why does TokenAuthentication not require CSRF token validation on POST requests?
Question 3
What database table is created by adding rest_framework.authtoken to INSTALLED_APPS?
Question 4
What view does DRF provide out-of-the-box to exchange credentials for an auth token?
Question 5
What is a known limitation of DRF's built-in TokenAuthentication in large-scale enterprise systems?
Next Lesson

JWT Authentication

Continue learning with hands-on practice, examples, and exercises in the upcoming topic.

Related Lessons

Previous LessonNext Lesson
URL RoutingJWT Authentication

Practice Quiz

Test your understanding of this lesson with 5 questions. Each question has one correct answer.

PreviousNext
PrevNext