The User Model and authenticate()
Verify credentials with the built-in user.
The User Model and authenticate() is a free Django Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Django Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
You Already Have Users
Django ships a full User model out of the box, so you never write account tables by hand. It stores usernames, hashed passwords, and more. 👤
Where the User Lives
The model sits in django.contrib.auth, an app that is enabled in fresh projects. Import it and the whole auth toolkit comes along.
from django.contrib.auth.models import UserKey User Fields
Each user has a username, plus email, first_name, and last_name. These are the everyday fields you read and display in your app.
Passwords Are Never Plain
Django stores a salted hash of every password, never the raw text. Even you, the developer, cannot read a user's actual password. 🔒
Create a User Safely
Use create_user so the password gets hashed for you. Setting the password by hand would store it in the clear.
User.objects.create_user(username="ada", password="secret123")Meet authenticate()
The authenticate() function checks a username and password against the database for you. It is the heart of every login flow.
from django.contrib.auth import authenticateHow authenticate() Works
Pass it the credentials and it returns the matching user object when they are correct. No hashing or lookups for you to write.
user = authenticate(username="ada", password="secret123")When Credentials Fail
If the username or password is wrong, authenticate() returns None. Always check for that before treating the user as logged in.
if user is None:
print("Invalid credentials")Active Users Only
The is_active flag lets you disable accounts. By default authenticate() refuses to return inactive users, blocking banned logins.
Staff and Superusers
Two extra flags matter: is_staff grants admin-site access, and is_superuser grants every permission. Most users have neither.
Authenticate Is Not Login
Remember: authenticate() only verifies identity. It does not start a session, so the user is not yet logged in after this call.
Quick Check
What does authenticate() return when the password is wrong?
Recap: Users and Identity
You met Django's built-in User model and used authenticate() to verify credentials. Passwords stay hashed, and a failed check gives None. ✅
Frequently asked questions
Is the “The User Model and authenticate()” lesson free?
Yes — the full text of “The User Model and authenticate()” is free to read here on the web, and the Django Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Django Academy course, upgrade to CoddyKit PRO.
What will I learn in “The User Model and authenticate()”?
Verify credentials with the built-in user. You practise Django Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Django Academy?
No prior experience is required. Django Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “The User Model and authenticate()” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Django Academy lesson?
Yes. Every Django Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- The User Model and authenticate()
- login, logout, and Auth Views
- Registration with UserCreationForm
- login_required and Protecting Views