Permissions and Throttling
Control who can call your API and how often.
Permissions and Throttling is a free Django Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Django Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Who Can Call Your API?
An open API lets anyone read or change your data. Permissions decide who is allowed to do what on each endpoint.
The permission_classes Attribute
You attach access rules with permission_classes on a view or ViewSet. DRF checks them before any action runs.
from rest_framework.permissions import IsAuthenticated
class BookViewSet(viewsets.ModelViewSet):
permission_classes = [IsAuthenticated]Built-in Permission Classes
DRF ships ready rules: AllowAny opens a view, IsAuthenticated requires a logged-in user, and IsAdminUser limits it to staff.
Read for All, Write for Members
IsAuthenticatedOrReadOnly is a popular middle ground: anyone can GET, but only logged-in users can POST, PUT, or DELETE.
Setting a Default Globally
Set a project-wide rule in settings.py so every view starts secure unless it opts out.
REST_FRAMEWORK = {
'DEFAULT_PERMISSION_CLASSES': [
'rest_framework.permissions.IsAuthenticated',
],
}Writing a Custom Permission
Need your own rule? Subclass BasePermission and return True or False from has_permission for the request.
from rest_framework.permissions import BasePermission
class IsOwner(BasePermission):
def has_object_permission(self, request, view, obj):
return obj.owner == request.userObject-Level Permissions
Use has_object_permission to check a single record, like letting users edit only the posts they own. 🔒
Now, Throttling
Permissions answer who. Throttling answers how often, capping the number of requests a client may send in a time window.
Anon vs User Throttles
DRF offers AnonRateThrottle for unauthenticated visitors and UserRateThrottle for logged-in accounts, so you can be stricter with strangers.
Configuring Rate Limits
Set the limits in settings with DEFAULT_THROTTLE_RATES, using a count plus a period like second, minute, hour, or day.
REST_FRAMEWORK = {
'DEFAULT_THROTTLE_RATES': {
'anon': '20/hour',
'user': '1000/day',
},
}What Throttling Protects
Throttling shields you from abuse and runaway scripts. When a client goes over, DRF returns a 429 Too Many Requests response. 🛡️
Quick Check
Let us confirm the difference between the two gatekeepers.
Recap: Access and Rate Limits
You can now gate endpoints with permission classes and protect them with throttle rates. Together they keep your API both safe and stable. 🎉
Frequently asked questions
Is the “Permissions and Throttling” lesson free?
Yes — the full text of “Permissions and Throttling” is free to read here on the web, and the Django Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Django Academy course, upgrade to CoddyKit PRO.
What will I learn in “Permissions and Throttling”?
Control who can call your API and how often. You practise Django Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Django Academy?
No prior experience is required. Django Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Permissions and Throttling” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Django Academy lesson?
Yes. Every Django Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- ModelViewSet and Routers
- Permissions and Throttling
- Token and JWT Authentication
- Filtering, Search, and Pagination