Token and JWT Authentication
Authenticate API clients securely.
Token and JWT Authentication is a free Django Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Django Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
APIs Need Stateless Auth
Browsers use sessions, but API clients often have no cookies. Token authentication lets a client prove who it is on every request instead.
How a Token Works
The user logs in once and gets a token string. They send it with each request, and DRF maps it back to the right user.
Enabling TokenAuthentication
Add the authtoken app and turn on TokenAuthentication so DRF knows to read tokens from incoming requests.
INSTALLED_APPS += ['rest_framework.authtoken']
REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': [
'rest_framework.authentication.TokenAuthentication',
],
}Issuing a Token
DRF gives you a built-in obtain_auth_token view. Post a username and password to it, and it returns that user's token.
from rest_framework.authtoken.views import obtain_auth_token
urlpatterns = [
path('api-token-auth/', obtain_auth_token),
]Sending the Token
The client puts the token in the Authorization header, prefixed with the word Token, on every protected call. 🔑
Authorization: Token 9944b09199c62bcf9418ad846dd0e4The Limit of Simple Tokens
A DRF token never expires and is just a database lookup. For larger systems, a JWT adds expiry and self-contained data.
What a JWT Carries
A JSON Web Token is a signed string holding claims like the user id and an expiry time. The server trusts it without a DB hit.
Adding SimpleJWT
Install djangorestframework-simplejwt and register its authentication class to swap tokens for JWTs.
REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': [
'rest_framework_simplejwt.authentication.JWTAuthentication',
],
}Access and Refresh Tokens
SimpleJWT gives two tokens: a short-lived access token for requests and a longer refresh token to get a new access token.
JWT Login Endpoints
Wire up TokenObtainPairView to log in and TokenRefreshView to renew, and your JWT flow is ready.
from rest_framework_simplejwt.views import (
TokenObtainPairView, TokenRefreshView)
urlpatterns = [
path('token/', TokenObtainPairView.as_view()),
path('token/refresh/', TokenRefreshView.as_view()),
]Sending a Bearer Token
JWT clients use the Bearer scheme in the Authorization header instead of the Token word DRF tokens use. 🎟️
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9Quick Check
One key difference separates DRF tokens from JWTs.
Recap: Proving Identity
You learned to authenticate API clients with DRF tokens for simplicity and JWTs for expiry and scale, both sent in the Authorization header. 🎉
Frequently asked questions
Is the “Token and JWT Authentication” lesson free?
Yes — the full text of “Token and JWT Authentication” is free to read here on the web, and the Django Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Django Academy course, upgrade to CoddyKit PRO.
What will I learn in “Token and JWT Authentication”?
Authenticate API clients securely. You practise Django Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Django Academy?
No prior experience is required. Django Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Token and JWT Authentication” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Django Academy lesson?
Yes. Every Django Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- ModelViewSet and Routers
- Permissions and Throttling
- Token and JWT Authentication
- Filtering, Search, and Pagination