Hi all,
I’ve just released django-reusable-auth, a JWT authentication API for Django REST Framework. I kept rebuilding the same auth endpoints for every project, so I turned them into a package.
It’s built on Simple JWT and Django’s own password hashing and token generators, with no custom cryptography. You add it to INSTALLED_APPS, include the URLs, and get:
- Register, login, logout, refresh and a current-user endpoint
- Email verification (required by default), password reset and password change
- Session management: list active sessions, revoke one, or log out everywhere
- Account deactivation
Most of the work went into the security side, which is the part I usually ended up adding by hand:
- Refresh token reuse detection: if a rotated refresh token is used again, all of that user’s sessions are revoked, since it probably means the token was stolen
- Per-IP rate limiting per endpoint, plus account lockout after repeated failed logins, getting longer each time
- Registration, password reset and verification resend respond the same way whether or not the email exists
- Password change and reset log out every other session
- System checks that warn about risky setup, like a per-process cache in production or token rotation turned off
It supports Python 3.10 to 3.14 and Django 5.2 to 6.1, and it’s tested against PostgreSQL and Redis in CI.
PyPI: Client Challenge
GitHub: GitHub - joeldonkor/django-reusable-auth · GitHub
There’s an example project in the repo with Swagger docs if you want to try it without setting anything up.
One limitation: it ships its own user model, so it’s meant for new projects, since Django can’t easily swap the user model after the first migration.
This is my first published package, so I’d really appreciate feedback, especially on the security choices and anything in the setup that was confusing. Issues and pull requests are welcome.
Thanks!