# django-reusable-auth 1.0: JWT auth for DRF with sessions, lockout and refresh token reuse detection

**URL:** <https://forum.djangoproject.com/t/django-reusable-auth-1-0-jwt-auth-for-drf-with-sessions-lockout-and-refresh-token-reuse-detection/46187>\
**Category:** Show & Tell\
**Created:** [October 14, 2026, 12:17am UTC](https://forum.djangoproject.com/t/django-reusable-auth-1-0-jwt-auth-for-drf-with-sessions-lockout-and-refresh-token-reuse-detection/46187 "2026-10-14T00:17:05Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![sam.joel](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/sam.joel/32/33518_2.png) [@sam.joel](https://forum.djangoproject.com/u/sam.joel)\
**Post date:** [October 14, 2026, 12:17am UTC](https://forum.djangoproject.com/t/django-reusable-auth-1-0-jwt-auth-for-drf-with-sessions-lockout-and-refresh-token-reuse-detection/46187/1 "2026-10-14T00:17:06Z")

</div>

Hi all,

I’ve just released django-reusable-auth, a JWT authentication API for Django REST Framework. I kept rebuilding the same auth endpoints for every project, so I turned them into a package.

It’s built on Simple JWT and Django’s own password hashing and token generators, with no custom cryptography. You add it to INSTALLED\_APPS, include the URLs, and get:

- Register, login, logout, refresh and a current-user endpoint
- Email verification (required by default), password reset and password change
- Session management: list active sessions, revoke one, or log out everywhere
- Account deactivation

Most of the work went into the security side, which is the part I usually ended up adding by hand:

- Refresh token reuse detection: if a rotated refresh token is used again, all of that user’s sessions are revoked, since it probably means the token was stolen
- Per-IP rate limiting per endpoint, plus account lockout after repeated failed logins, getting longer each time
- Registration, password reset and verification resend respond the same way whether or not the email exists
- Password change and reset log out every other session
- System checks that warn about risky setup, like a per-process cache in production or token rotation turned off

It supports Python 3.10 to 3.14 and Django 5.2 to 6.1, and it’s tested against PostgreSQL and Redis in CI.

PyPI: [Client Challenge](https://pypi.org/project/django-reusable-auth/)  
GitHub: [GitHub - joeldonkor/django-reusable-auth · GitHub](https://github.com/joeldonkor/django-reusable-auth)

There’s an example project in the repo with Swagger docs if you want to try it without setting anything up.

One limitation: it ships its own user model, so it’s meant for new projects, since Django can’t easily swap the user model after the first migration.

This is my first published package, so I’d really appreciate feedback, especially on the security choices and anything in the setup that was confusing. Issues and pull requests are welcome.

Thanks!