# Correct way to let user register/sign up with DRF?

**URL:** <https://forum.djangoproject.com/t/correct-way-to-let-user-register-sign-up-with-drf/1370>\
**Category:** Using Django\
**Created:** [March 4, 2020, 9:01pm UTC](https://forum.djangoproject.com/t/correct-way-to-let-user-register-sign-up-with-drf/1370 "2020-03-04T21:01:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nemecek\_f](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/nemecek_f/32/668_2.png) [@nemecek\_f](https://forum.djangoproject.com/u/nemecek_f)\
**Post date:** [March 4, 2020, 9:01pm UTC](https://forum.djangoproject.com/t/correct-way-to-let-user-register-sign-up-with-drf/1370/1 "2020-03-04T21:01:14Z")

</div>

Hello,

I am building my first Django Rest Framework project as a backend for mobile app and just today I implemented user registration via API. I couldn’t find any definitive tutorial related to registration so I pieced the code together using different SO answers and just wanna ask, whether this is a good approach.

```
class UsersSerializer(serializers.ModelSerializer):
class Meta:
    model = core_models.CustomUser
    fields = ('email', 'username', 'password')

def create(self, validated_data):
    user = super(UsersSerializer, self).create(validated_data)
    user.set_password(validated_data['password'])
    user.save()
    return user

```

And the view is just this:

```
class UserCreate(generics.CreateAPIView):
queryset = CustomUser.objects.all()
serializer_class = UsersSerializer
permission_classes = (AllowAny, )

```

Seems to be working fine when testing with Postman and then trying to log in. As a next step I want to enable Token authentification.

Thanks for help and suggestions!

---

<div class="post-metadata">

**Author:** ![lcannon](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/lcannon/32/766_2.png) [@lcannon](https://forum.djangoproject.com/u/lcannon)\
**Post date:** [March 5, 2020, 12:07am UTC](https://forum.djangoproject.com/t/correct-way-to-let-user-register-sign-up-with-drf/1370/2 "2020-03-05T00:07:43Z")

</div>

Your basic implementation seems fine to me, though I think you’re hitting the database twice unnecessarily. I would probably change create to:

```auto
def create(self, validated_data):
    password = validated_data.pop('password')
    user = core_models.CustomerUser(**validated_data)
    user.set_password(password)
    user.save()
    return user

```

---

<div class="post-metadata">

**Author:** ![nemecek\_f](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/nemecek_f/32/668_2.png) [@nemecek\_f](https://forum.djangoproject.com/u/nemecek_f)\
**Post date:** [March 5, 2020, 8:39am UTC](https://forum.djangoproject.com/t/correct-way-to-let-user-register-sign-up-with-drf/1370/3 "2020-03-05T08:39:45Z")

</div>

Thanks for the tip! I will change it.

Is there anything else you would do differently or maybe add?

I just realized that password field in serializer is mistake right? It does not make sense to send hashed password back…

---

<div class="post-metadata">

**Author:** ![lcannon](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/lcannon/32/766_2.png) [@lcannon](https://forum.djangoproject.com/u/lcannon)\
**Post date:** [March 5, 2020, 11:03pm UTC](https://forum.djangoproject.com/t/correct-way-to-let-user-register-sign-up-with-drf/1370/4 "2020-03-05T23:03:24Z")

</div>

Yeah, in cases like that I normally override to\_representation and return data from a different serializer, or manually delete the fields you don’t want.

e.g.

```auto
def to_representation(self, obj):
    data = super().to_representation(obj)
    del data['password']
    return data

```

---

<div class="post-metadata">

**Author:** ![nemecek\_f](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/nemecek_f/32/668_2.png) [@nemecek\_f](https://forum.djangoproject.com/u/nemecek_f)\
**Post date:** [March 8, 2020, 3:49pm UTC](https://forum.djangoproject.com/t/correct-way-to-let-user-register-sign-up-with-drf/1370/5 "2020-03-08T15:49:37Z")

</div>

Thanks. I dug into a documentation a bit and found another way:

```
extra_kwargs = {'password': {'write_only': True}}

```

In Meta, seems to work fine 🙂