Kept rebuilding the same thing across projects: a Django API where more
than one tenant/org calls in with an API key, and I need to know which
tenant and which key made the request — not just “is this a valid key.”
TokenAuthentication doesn’t have an opinion on tenants; djangorestframework-api-key
is a permission gate, not an identity.
So: django-tenant-apikeys. Subclass one abstract model, add a tenant
FK, and request.tenant gets resolved automatically on every authenticated
request (DRF and Django Ninja both supported, sharing the same core).
- Prefix + SHA-256-hashed secret (Stripe/GitHub-style), shown once
- Per-key scopes with wildcards (orders:read, orders:*, *)
- Per-key IP/CIDR allowlists
- Per-key rate limits (cache-backed, race-safe counter)
- rotate()/revoke() as explicit lifecycle, not just a boolean
Docs: django-tenant-apikeys
Repo: GitHub - stackadnan/django-tenant-apikeys: Pluggable multi-tenant API key authentication for Django, with SHA-256 prefix hashing, scope-based permissions, and first-class DRF + Django Ninja support. · GitHub
Still early (v0.4.0), so feedback on the model itself especially if
you’ve hit this problem before and solved it differently is genuinely
useful to me.