exc-djangorestframework-api-key 1.0.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (22) hide show
  1. exc_djangorestframework_api_key-1.0.0/CHANGELOG.md +180 -0
  2. exc_djangorestframework_api_key-1.0.0/LICENSE +21 -0
  3. exc_djangorestframework_api_key-1.0.0/MANIFEST.in +4 -0
  4. exc_djangorestframework_api_key-1.0.0/PKG-INFO +300 -0
  5. exc_djangorestframework_api_key-1.0.0/README.md +90 -0
  6. exc_djangorestframework_api_key-1.0.0/pyproject.toml +48 -0
  7. exc_djangorestframework_api_key-1.0.0/setup.cfg +16 -0
  8. exc_djangorestframework_api_key-1.0.0/setup.py +3 -0
  9. exc_djangorestframework_api_key-1.0.0/src/exc_djangorestframework_api_key.egg-info/PKG-INFO +300 -0
  10. exc_djangorestframework_api_key-1.0.0/src/exc_djangorestframework_api_key.egg-info/SOURCES.txt +21 -0
  11. exc_djangorestframework_api_key-1.0.0/src/exc_djangorestframework_api_key.egg-info/dependency_links.txt +1 -0
  12. exc_djangorestframework_api_key-1.0.0/src/exc_djangorestframework_api_key.egg-info/requires.txt +1 -0
  13. exc_djangorestframework_api_key-1.0.0/src/exc_djangorestframework_api_key.egg-info/top_level.txt +1 -0
  14. exc_djangorestframework_api_key-1.0.0/src/rest_framework_api_key/__init__.py +11 -0
  15. exc_djangorestframework_api_key-1.0.0/src/rest_framework_api_key/admin.py +61 -0
  16. exc_djangorestframework_api_key-1.0.0/src/rest_framework_api_key/apps.py +6 -0
  17. exc_djangorestframework_api_key-1.0.0/src/rest_framework_api_key/crypto.py +82 -0
  18. exc_djangorestframework_api_key-1.0.0/src/rest_framework_api_key/migrations/0001_initial.py +31 -0
  19. exc_djangorestframework_api_key-1.0.0/src/rest_framework_api_key/migrations/__init__.py +0 -0
  20. exc_djangorestframework_api_key-1.0.0/src/rest_framework_api_key/models.py +163 -0
  21. exc_djangorestframework_api_key-1.0.0/src/rest_framework_api_key/permissions.py +81 -0
  22. exc_djangorestframework_api_key-1.0.0/src/rest_framework_api_key/py.typed +0 -0
@@ -0,0 +1,180 @@
1
+ # Changelog
2
+
3
+ All notable changes to this project will be documented in this file.
4
+
5
+ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
6
+
7
+ ## 3.1.0 - 2025-04-04
8
+
9
+ ### Added
10
+
11
+ - Add official support for Python 3.12 and 3.13, and Django 5.0 up to 5.2, accomodating changes to `USE_TZ`. (Pull #266)
12
+
13
+ ## 3.0.0 - 2023-09-30
14
+
15
+ ### Changed
16
+
17
+ - Use faster SHA512-based key hasher instead of password hashers. Reduces server load by making API key validation orders of magnitude faster (10x to 30x according to estimations, network latency aside). Hashed key will be transparently upgraded the first time `.is_valid()` is called. (Pull #244, Pull #251)
18
+
19
+ ### Removed
20
+
21
+ - Dropped support for Python 3.7, which has reached EOL. (Pull #247)
22
+ - Drop redundant `.has_object_permission()` implementation on `BaseHasAPIKey` when using DRF 3.14.0 or above. (Pull #240)
23
+
24
+ ### Added
25
+
26
+ - Add official support for Python 3.11. (Pull #247)
27
+
28
+ ## 2.3.0 - 2023-01-19
29
+
30
+ ### Removed
31
+
32
+ - Drop support for Python 3.6, which has reached EOL. (Pull #210)
33
+
34
+ ### Fixed
35
+
36
+ - Fix migration 0004 when run against a non default database. (Pull #215)
37
+
38
+ ## 2.2.0 - 2022-03-11
39
+
40
+ ### Added
41
+
42
+ - Added support for Django config detection for different versions (PR #187)
43
+
44
+ ### Changed
45
+
46
+ - Add official support for Django 3.2 and Python 3.9 and 3.10 (PR #189)
47
+ - Bumped `hashed_key` field's `max_length` from 100 to 150 to address length issue with `argon2-cffi` (PR #193)
48
+
49
+ ## 2.1.0 - 2021-09-24
50
+
51
+ ### Added
52
+
53
+ - Add support for custom API `keyword`. (Pull #175)
54
+
55
+ ## 2.0.0 - 2020-04-07
56
+
57
+ **NOTE**: this release drops compatibility with certain Python and Django versions, but contains no other breaking changes. See [Upgrade to 2.0](https://florimondmanca.github.io/djangorestframework-api-key/upgrade/2.0/) for detailed migration steps.
58
+
59
+ ### Removed
60
+
61
+ - Dropped support for Django 2.0 and Django 2.1. (Pull #126)
62
+ - Dropped support for Python 3.5. (Pull #84)
63
+
64
+ ### Added
65
+
66
+ - Add support for Django 3.0. (Pull #82)
67
+ - Add support for Python 3.8. (Pull #81)
68
+ - Add `BaseAPIKeyManager.get_from_key()` to allow retrieving API keys from views. (Pull #93)
69
+ - Add type annotations, and partial support for `django-stubs` and `djangorestframework-stubs`. (Pull #88, Pull #122)
70
+
71
+ ## 1.4.1 - 2019-08-24
72
+
73
+ ### Added
74
+
75
+ - Now ships with type annotations ([PEP 561](https://www.python.org/dev/peps/pep-0561/)). (Pull #73)
76
+
77
+ ## 1.4.0 - 2019-07-16
78
+
79
+ **NOTE**: this release contains migrations. See [Upgrade to v1.4](https://florimondmanca.github.io/djangorestframework-api-key/upgrade/1.4/) for detailed instructions.
80
+
81
+ ### Added
82
+
83
+ - The `prefix` and `hashed_key` are now stored in dedicated fields on the `APIKey` model. (Pull #62)
84
+
85
+ ## 1.3.0 - 2019-06-28
86
+
87
+ **NOTE**: this release contains migrations. In your Django project, run them using:
88
+
89
+ ```python
90
+ python manage.py migrate rest_framework_api_key
91
+ ```
92
+
93
+ ### Added
94
+
95
+ - Add abstract API key model (`AbstractAPIKey`) and base manager (`BaseAPIKeyManager`). (Pull #36)
96
+ - Add base permissions (`BaseHasAPIKey`). (Pull #46)
97
+
98
+ ### Changed
99
+
100
+ - The `id` field of `APIKey` is now non-`editable`.
101
+ - `APIKeyModelAdmin` does not define `fieldsets` anymore. This allows subclasses to benefit from Django's automatic fieldsets. (Pull #52)
102
+
103
+ ### Fixed
104
+
105
+ - Explicitly use `utf-8` encoding in `setup.py`, which could previously lead to issues when installing on certain systems. (Pull #58)
106
+
107
+ ## 1.2.1 - 2019-06-03
108
+
109
+ ### Fixed
110
+
111
+ - Fixed a critical bug in `APIKeyModelAdmin` that prevented `rest_framework_api_key` from passing Django system checks. (Pull #39)
112
+
113
+ ## 1.2.0 - 2019-05-29
114
+
115
+ **NOTE**: this release contains migrations. In your Django project, run them using:
116
+
117
+ ```python
118
+ python manage.py migrate rest_framework_api_key
119
+ ```
120
+
121
+ ### Added
122
+
123
+ - API keys can now have an optional `expiry_date`. (Pull #33) `HasAPIKey` denies access if the API key has expired, i.e. if `expiry_date`, if set, is in the past.
124
+ - It is now possible to search by `prefix` in the API key admin panel.
125
+ - The `prefix` is now displayed in the edit view of the API key admin panel.
126
+
127
+ ## 1.1.0 - 2019-05-14
128
+
129
+ ### Added
130
+
131
+ - Improve documentation on which password hasher is used.
132
+ - Add tests against the Argon2, BcryptSHA256 and PBKDF2SHA1 hashers. (Pull #32)
133
+
134
+ ### Fixed
135
+
136
+ - Fix support for password hashers that generate hashes that contain dots. (Pull #31)
137
+
138
+ ## 1.0.0 - 2019-04-24
139
+
140
+ **This release is incompatible with 0.x**. See [Upgrade to 1.0](https://florimondmanca.github.io/djangorestframework-api-key/upgrade/1.4/) for migration steps.
141
+
142
+ ### Removed
143
+
144
+ - Remove `HasAPIKeyOrIsAuthenticated` permission class. You should use bitwise composition now, e.g. `HasAPIKey | IsAuthenticated`.
145
+ - Drop the `DRF_API_KEY_*` settings. (Pull #19)
146
+
147
+ ### Changed
148
+
149
+ - Switch to a new API key generation and validation scheme. Clients must now authorize using a single API key header (Pull #19). The header is `Authorization` by default. It can be customized using the `API_KEY_CUSTOM_HEADER` setting (Pull #26). Use the `name` field to identify clients.
150
+
151
+ ### Added
152
+
153
+ - Add support for Django 2.2. (Pull #27)
154
+ - Add programmatic API key creation using `APIKey.objects.create_key()`. (Pull #19)
155
+
156
+ ### Fixed
157
+
158
+ - Improved API key storage using Django's password hashing helpers. (Uses the default Django password hasher.) (Pull #19)
159
+
160
+ ## 0.4.0 - 2019-04-21
161
+
162
+ ### Removed
163
+
164
+ - Drop support for Python 3.4. Only 3.5, 3.6 and 3.7 are supported now.
165
+ - Drop support for Django < 2.0. Only 2.0 and 2.1 are supported now.
166
+
167
+ ### Fixed
168
+
169
+ - `HasAPIKey` now implements `.has_object_permissions()`, which allows to compose it with other permission classes and perform object-level permission checks. (Pull #25)
170
+
171
+ ## 0.3.1 - 2018-11-17
172
+
173
+ _Initial changelog entry._
174
+
175
+ ### Added
176
+
177
+ - `APIKey` model.
178
+ - `HasAPIKey` and `HasAPIKeyOrIsAuthenticated` permission classes.
179
+ - Generate, view and revoke API keys from the Django admin.
180
+ - Authenticate requests using the `Api-Token` and `Api-Secret-Key` headers. Customizable via the `DRF_API_KEY_TOKEN_HEADER` and `DRF_API_KEY_SECRET_KEY_HEADER` settings.
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2018 Florimond Manca
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
@@ -0,0 +1,4 @@
1
+ graft src
2
+ include README.md
3
+ include CHANGELOG.md
4
+ include LICENSE
@@ -0,0 +1,300 @@
1
+ Metadata-Version: 2.1
2
+ Name: exc_djangorestframework_api_key
3
+ Version: 1.0.0
4
+ Summary: API key permissions for the Django REST Framework
5
+ Author-email: Melih Sünbül <m.sunbul@excellence-cloud.com>
6
+ License: MIT
7
+ Project-URL: Homepage, https://github.com/ExcellenceCloudGmbH/djangorestframework-api-key
8
+ Project-URL: Documentation, https://florimondmanca.github.io/djangorestframework-api-key/
9
+ Classifier: Development Status :: 4 - Beta
10
+ Classifier: Operating System :: OS Independent
11
+ Classifier: Intended Audience :: Developers
12
+ Classifier: Programming Language :: Python :: 3 :: Only
13
+ Classifier: Programming Language :: Python :: 3.8
14
+ Classifier: Programming Language :: Python :: 3.9
15
+ Classifier: Programming Language :: Python :: 3.10
16
+ Classifier: Programming Language :: Python :: 3.11
17
+ Classifier: Programming Language :: Python :: 3.12
18
+ Classifier: Programming Language :: Python :: 3.13
19
+ Classifier: Environment :: Web Environment
20
+ Classifier: Topic :: Software Development :: Libraries :: Python Modules
21
+ Classifier: Framework :: Django
22
+ Classifier: Framework :: Django :: 2.2
23
+ Classifier: Framework :: Django :: 3.2
24
+ Classifier: Framework :: Django :: 4.2
25
+ Classifier: Framework :: Django :: 5.2
26
+ Requires-Python: >=3.8
27
+ Description-Content-Type: text/markdown
28
+ License-File: LICENSE
29
+
30
+ # Django REST Framework API Key
31
+
32
+ API key permissions for the [Django REST Framework](https://www.django-rest-framework.org).
33
+
34
+ <div>
35
+ <a href="https://dev.azure.com/florimondmanca/public/_build/latest?definitionId=7&branchName=master">
36
+ <img src="https://dev.azure.com/florimondmanca/public/_apis/build/status/florimondmanca.djangorestframework-api-key?branchName=master" alt="build status"/>
37
+ </a>
38
+ <a href="https://codecov.io/gh/florimondmanca/djangorestframework-api-key">
39
+ <img src="https://codecov.io/gh/florimondmanca/djangorestframework-api-key/branch/master/graph/badge.svg" alt="coverage">
40
+ </a>
41
+ <a href="https://pypi.org/project/djangorestframework-api-key">
42
+ <img src="https://badge.fury.io/py/djangorestframework-api-key.svg" alt="package version"/>
43
+ </a>
44
+ </div>
45
+ <div>
46
+ <img src="https://img.shields.io/pypi/pyversions/djangorestframework-api-key.svg" alt="python versions"/>
47
+ <img src="https://img.shields.io/pypi/djversions/djangorestframework-api-key.svg?colorB=44b78b" alt="django versions"/>
48
+ <img src="https://img.shields.io/badge/drf-3.8+-7f2d2d.svg" alt="drf versions"/>
49
+ </div>
50
+
51
+ ## Introduction
52
+
53
+ **Django REST Framework API Key is a library for allowing server-side clients to safely use your API.** These clients are typically third-party backends and services (i.e. _machines_) which do not have a user account but still need to interact with your API in a secure way.
54
+
55
+ ### Features
56
+
57
+ - ✌️ **Simple to use**: create, view and revoke API keys via the admin site, or use built-in helpers to create API keys programmatically.
58
+ - 🔒 **As secure as possible**: API keys are treated with the same level of care as user passwords. They are only visible at creation and hashed before storing in the database.
59
+ - 🎨 **Customizable**: satisfy specific business requirements by building your own customized API key models, permission classes and admin panels.
60
+
61
+ ### Should I use API keys?
62
+
63
+ There are important security aspects you need to consider before switching to an API key access control scheme. We've listed some of these in [Security caveats](docs/security.md#caveats), including serving your API over HTTPS.
64
+
65
+ Besides, see [Why and when to use API keys](https://cloud.google.com/endpoints/docs/openapi/when-why-api-key#top_of_page) for hints on whether API keys can fit your use case.
66
+
67
+ API keys are ideal in the following situations:
68
+
69
+ - Blocking anonymous traffic.
70
+ - Implementing API key-based [throttling](https://www.django-rest-framework.org/api-guide/throttling/). (Note that Django REST Framework already has may built-in utilities for this use case.)
71
+ - Identifying usage patterns by logging request information along with the API key.
72
+
73
+ They can also present enough security for authorizing internal services, such as your API server and an internal frontend application.
74
+
75
+ > Please note that this package is NOT meant for authentication. You should NOT use this package to identify individual users, either directly or indirectly.
76
+ >
77
+ > If you need server-to-server authentication, you may want to consider OAuth instead. Libraries such as [django-oauth-toolkit](https://django-oauth-toolkit.readthedocs.io/en/latest/index.html) can help.
78
+
79
+ ## Quickstart
80
+
81
+ Install with `pip`:
82
+
83
+ ```bash
84
+ pip install "djangorestframework-api-key==3.*"
85
+ ```
86
+
87
+ _**Note**: It is highly recommended to **pin your dependency** to the latest major version (as depicted above), as breaking changes may and will happen between major releases._
88
+
89
+ Add the app to your `INSTALLED_APPS`:
90
+
91
+ ```python
92
+ # settings.py
93
+
94
+ INSTALLED_APPS = [
95
+ # ...
96
+ "rest_framework",
97
+ "rest_framework_api_key",
98
+ ]
99
+ ```
100
+
101
+ Run the included migrations:
102
+
103
+ ```bash
104
+ python manage.py migrate
105
+ ```
106
+
107
+ To learn how to configure permissions and manage API keys, head to the [Documentation](https://florimondmanca.github.io/djangorestframework-api-key).
108
+
109
+ ## Changelog
110
+
111
+ See [CHANGELOG.md](https://github.com/florimondmanca/djangorestframework-api-key/tree/master/CHANGELOG.md).
112
+
113
+ ## Contributing
114
+
115
+ See [CONTRIBUTING.md](https://github.com/florimondmanca/djangorestframework-api-key/tree/master/CONTRIBUTING.md).
116
+
117
+ ## License
118
+
119
+ MIT
120
+
121
+ # Changelog
122
+
123
+ All notable changes to this project will be documented in this file.
124
+
125
+ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
126
+
127
+ ## 3.1.0 - 2025-04-04
128
+
129
+ ### Added
130
+
131
+ - Add official support for Python 3.12 and 3.13, and Django 5.0 up to 5.2, accomodating changes to `USE_TZ`. (Pull #266)
132
+
133
+ ## 3.0.0 - 2023-09-30
134
+
135
+ ### Changed
136
+
137
+ - Use faster SHA512-based key hasher instead of password hashers. Reduces server load by making API key validation orders of magnitude faster (10x to 30x according to estimations, network latency aside). Hashed key will be transparently upgraded the first time `.is_valid()` is called. (Pull #244, Pull #251)
138
+
139
+ ### Removed
140
+
141
+ - Dropped support for Python 3.7, which has reached EOL. (Pull #247)
142
+ - Drop redundant `.has_object_permission()` implementation on `BaseHasAPIKey` when using DRF 3.14.0 or above. (Pull #240)
143
+
144
+ ### Added
145
+
146
+ - Add official support for Python 3.11. (Pull #247)
147
+
148
+ ## 2.3.0 - 2023-01-19
149
+
150
+ ### Removed
151
+
152
+ - Drop support for Python 3.6, which has reached EOL. (Pull #210)
153
+
154
+ ### Fixed
155
+
156
+ - Fix migration 0004 when run against a non default database. (Pull #215)
157
+
158
+ ## 2.2.0 - 2022-03-11
159
+
160
+ ### Added
161
+
162
+ - Added support for Django config detection for different versions (PR #187)
163
+
164
+ ### Changed
165
+
166
+ - Add official support for Django 3.2 and Python 3.9 and 3.10 (PR #189)
167
+ - Bumped `hashed_key` field's `max_length` from 100 to 150 to address length issue with `argon2-cffi` (PR #193)
168
+
169
+ ## 2.1.0 - 2021-09-24
170
+
171
+ ### Added
172
+
173
+ - Add support for custom API `keyword`. (Pull #175)
174
+
175
+ ## 2.0.0 - 2020-04-07
176
+
177
+ **NOTE**: this release drops compatibility with certain Python and Django versions, but contains no other breaking changes. See [Upgrade to 2.0](https://florimondmanca.github.io/djangorestframework-api-key/upgrade/2.0/) for detailed migration steps.
178
+
179
+ ### Removed
180
+
181
+ - Dropped support for Django 2.0 and Django 2.1. (Pull #126)
182
+ - Dropped support for Python 3.5. (Pull #84)
183
+
184
+ ### Added
185
+
186
+ - Add support for Django 3.0. (Pull #82)
187
+ - Add support for Python 3.8. (Pull #81)
188
+ - Add `BaseAPIKeyManager.get_from_key()` to allow retrieving API keys from views. (Pull #93)
189
+ - Add type annotations, and partial support for `django-stubs` and `djangorestframework-stubs`. (Pull #88, Pull #122)
190
+
191
+ ## 1.4.1 - 2019-08-24
192
+
193
+ ### Added
194
+
195
+ - Now ships with type annotations ([PEP 561](https://www.python.org/dev/peps/pep-0561/)). (Pull #73)
196
+
197
+ ## 1.4.0 - 2019-07-16
198
+
199
+ **NOTE**: this release contains migrations. See [Upgrade to v1.4](https://florimondmanca.github.io/djangorestframework-api-key/upgrade/1.4/) for detailed instructions.
200
+
201
+ ### Added
202
+
203
+ - The `prefix` and `hashed_key` are now stored in dedicated fields on the `APIKey` model. (Pull #62)
204
+
205
+ ## 1.3.0 - 2019-06-28
206
+
207
+ **NOTE**: this release contains migrations. In your Django project, run them using:
208
+
209
+ ```python
210
+ python manage.py migrate rest_framework_api_key
211
+ ```
212
+
213
+ ### Added
214
+
215
+ - Add abstract API key model (`AbstractAPIKey`) and base manager (`BaseAPIKeyManager`). (Pull #36)
216
+ - Add base permissions (`BaseHasAPIKey`). (Pull #46)
217
+
218
+ ### Changed
219
+
220
+ - The `id` field of `APIKey` is now non-`editable`.
221
+ - `APIKeyModelAdmin` does not define `fieldsets` anymore. This allows subclasses to benefit from Django's automatic fieldsets. (Pull #52)
222
+
223
+ ### Fixed
224
+
225
+ - Explicitly use `utf-8` encoding in `setup.py`, which could previously lead to issues when installing on certain systems. (Pull #58)
226
+
227
+ ## 1.2.1 - 2019-06-03
228
+
229
+ ### Fixed
230
+
231
+ - Fixed a critical bug in `APIKeyModelAdmin` that prevented `rest_framework_api_key` from passing Django system checks. (Pull #39)
232
+
233
+ ## 1.2.0 - 2019-05-29
234
+
235
+ **NOTE**: this release contains migrations. In your Django project, run them using:
236
+
237
+ ```python
238
+ python manage.py migrate rest_framework_api_key
239
+ ```
240
+
241
+ ### Added
242
+
243
+ - API keys can now have an optional `expiry_date`. (Pull #33) `HasAPIKey` denies access if the API key has expired, i.e. if `expiry_date`, if set, is in the past.
244
+ - It is now possible to search by `prefix` in the API key admin panel.
245
+ - The `prefix` is now displayed in the edit view of the API key admin panel.
246
+
247
+ ## 1.1.0 - 2019-05-14
248
+
249
+ ### Added
250
+
251
+ - Improve documentation on which password hasher is used.
252
+ - Add tests against the Argon2, BcryptSHA256 and PBKDF2SHA1 hashers. (Pull #32)
253
+
254
+ ### Fixed
255
+
256
+ - Fix support for password hashers that generate hashes that contain dots. (Pull #31)
257
+
258
+ ## 1.0.0 - 2019-04-24
259
+
260
+ **This release is incompatible with 0.x**. See [Upgrade to 1.0](https://florimondmanca.github.io/djangorestframework-api-key/upgrade/1.4/) for migration steps.
261
+
262
+ ### Removed
263
+
264
+ - Remove `HasAPIKeyOrIsAuthenticated` permission class. You should use bitwise composition now, e.g. `HasAPIKey | IsAuthenticated`.
265
+ - Drop the `DRF_API_KEY_*` settings. (Pull #19)
266
+
267
+ ### Changed
268
+
269
+ - Switch to a new API key generation and validation scheme. Clients must now authorize using a single API key header (Pull #19). The header is `Authorization` by default. It can be customized using the `API_KEY_CUSTOM_HEADER` setting (Pull #26). Use the `name` field to identify clients.
270
+
271
+ ### Added
272
+
273
+ - Add support for Django 2.2. (Pull #27)
274
+ - Add programmatic API key creation using `APIKey.objects.create_key()`. (Pull #19)
275
+
276
+ ### Fixed
277
+
278
+ - Improved API key storage using Django's password hashing helpers. (Uses the default Django password hasher.) (Pull #19)
279
+
280
+ ## 0.4.0 - 2019-04-21
281
+
282
+ ### Removed
283
+
284
+ - Drop support for Python 3.4. Only 3.5, 3.6 and 3.7 are supported now.
285
+ - Drop support for Django < 2.0. Only 2.0 and 2.1 are supported now.
286
+
287
+ ### Fixed
288
+
289
+ - `HasAPIKey` now implements `.has_object_permissions()`, which allows to compose it with other permission classes and perform object-level permission checks. (Pull #25)
290
+
291
+ ## 0.3.1 - 2018-11-17
292
+
293
+ _Initial changelog entry._
294
+
295
+ ### Added
296
+
297
+ - `APIKey` model.
298
+ - `HasAPIKey` and `HasAPIKeyOrIsAuthenticated` permission classes.
299
+ - Generate, view and revoke API keys from the Django admin.
300
+ - Authenticate requests using the `Api-Token` and `Api-Secret-Key` headers. Customizable via the `DRF_API_KEY_TOKEN_HEADER` and `DRF_API_KEY_SECRET_KEY_HEADER` settings.
@@ -0,0 +1,90 @@
1
+ # Django REST Framework API Key
2
+
3
+ API key permissions for the [Django REST Framework](https://www.django-rest-framework.org).
4
+
5
+ <div>
6
+ <a href="https://dev.azure.com/florimondmanca/public/_build/latest?definitionId=7&branchName=master">
7
+ <img src="https://dev.azure.com/florimondmanca/public/_apis/build/status/florimondmanca.djangorestframework-api-key?branchName=master" alt="build status"/>
8
+ </a>
9
+ <a href="https://codecov.io/gh/florimondmanca/djangorestframework-api-key">
10
+ <img src="https://codecov.io/gh/florimondmanca/djangorestframework-api-key/branch/master/graph/badge.svg" alt="coverage">
11
+ </a>
12
+ <a href="https://pypi.org/project/djangorestframework-api-key">
13
+ <img src="https://badge.fury.io/py/djangorestframework-api-key.svg" alt="package version"/>
14
+ </a>
15
+ </div>
16
+ <div>
17
+ <img src="https://img.shields.io/pypi/pyversions/djangorestframework-api-key.svg" alt="python versions"/>
18
+ <img src="https://img.shields.io/pypi/djversions/djangorestframework-api-key.svg?colorB=44b78b" alt="django versions"/>
19
+ <img src="https://img.shields.io/badge/drf-3.8+-7f2d2d.svg" alt="drf versions"/>
20
+ </div>
21
+
22
+ ## Introduction
23
+
24
+ **Django REST Framework API Key is a library for allowing server-side clients to safely use your API.** These clients are typically third-party backends and services (i.e. _machines_) which do not have a user account but still need to interact with your API in a secure way.
25
+
26
+ ### Features
27
+
28
+ - ✌️ **Simple to use**: create, view and revoke API keys via the admin site, or use built-in helpers to create API keys programmatically.
29
+ - 🔒 **As secure as possible**: API keys are treated with the same level of care as user passwords. They are only visible at creation and hashed before storing in the database.
30
+ - 🎨 **Customizable**: satisfy specific business requirements by building your own customized API key models, permission classes and admin panels.
31
+
32
+ ### Should I use API keys?
33
+
34
+ There are important security aspects you need to consider before switching to an API key access control scheme. We've listed some of these in [Security caveats](docs/security.md#caveats), including serving your API over HTTPS.
35
+
36
+ Besides, see [Why and when to use API keys](https://cloud.google.com/endpoints/docs/openapi/when-why-api-key#top_of_page) for hints on whether API keys can fit your use case.
37
+
38
+ API keys are ideal in the following situations:
39
+
40
+ - Blocking anonymous traffic.
41
+ - Implementing API key-based [throttling](https://www.django-rest-framework.org/api-guide/throttling/). (Note that Django REST Framework already has may built-in utilities for this use case.)
42
+ - Identifying usage patterns by logging request information along with the API key.
43
+
44
+ They can also present enough security for authorizing internal services, such as your API server and an internal frontend application.
45
+
46
+ > Please note that this package is NOT meant for authentication. You should NOT use this package to identify individual users, either directly or indirectly.
47
+ >
48
+ > If you need server-to-server authentication, you may want to consider OAuth instead. Libraries such as [django-oauth-toolkit](https://django-oauth-toolkit.readthedocs.io/en/latest/index.html) can help.
49
+
50
+ ## Quickstart
51
+
52
+ Install with `pip`:
53
+
54
+ ```bash
55
+ pip install "djangorestframework-api-key==3.*"
56
+ ```
57
+
58
+ _**Note**: It is highly recommended to **pin your dependency** to the latest major version (as depicted above), as breaking changes may and will happen between major releases._
59
+
60
+ Add the app to your `INSTALLED_APPS`:
61
+
62
+ ```python
63
+ # settings.py
64
+
65
+ INSTALLED_APPS = [
66
+ # ...
67
+ "rest_framework",
68
+ "rest_framework_api_key",
69
+ ]
70
+ ```
71
+
72
+ Run the included migrations:
73
+
74
+ ```bash
75
+ python manage.py migrate
76
+ ```
77
+
78
+ To learn how to configure permissions and manage API keys, head to the [Documentation](https://florimondmanca.github.io/djangorestframework-api-key).
79
+
80
+ ## Changelog
81
+
82
+ See [CHANGELOG.md](https://github.com/florimondmanca/djangorestframework-api-key/tree/master/CHANGELOG.md).
83
+
84
+ ## Contributing
85
+
86
+ See [CONTRIBUTING.md](https://github.com/florimondmanca/djangorestframework-api-key/tree/master/CONTRIBUTING.md).
87
+
88
+ ## License
89
+
90
+ MIT
@@ -0,0 +1,48 @@
1
+ [build-system]
2
+ requires = ["setuptools", "setuptools-scm", "wheel"]
3
+ build-backend = "setuptools.build_meta"
4
+
5
+ [project]
6
+ name = "exc_djangorestframework_api_key"
7
+ description = "API key permissions for the Django REST Framework"
8
+ requires-python = ">=3.8"
9
+ license = { text = "MIT" }
10
+ authors = [
11
+ { name = "Melih Sünbül", email = "m.sunbul@excellence-cloud.com" },
12
+ ]
13
+ classifiers = [
14
+ "Development Status :: 4 - Beta",
15
+ "Operating System :: OS Independent",
16
+ "Intended Audience :: Developers",
17
+ "Programming Language :: Python :: 3 :: Only",
18
+ "Programming Language :: Python :: 3.8",
19
+ "Programming Language :: Python :: 3.9",
20
+ "Programming Language :: Python :: 3.10",
21
+ "Programming Language :: Python :: 3.11",
22
+ "Programming Language :: Python :: 3.12",
23
+ "Programming Language :: Python :: 3.13",
24
+ "Environment :: Web Environment",
25
+ "Topic :: Software Development :: Libraries :: Python Modules",
26
+ "Framework :: Django",
27
+ "Framework :: Django :: 2.2",
28
+ "Framework :: Django :: 3.2",
29
+ "Framework :: Django :: 4.2",
30
+ "Framework :: Django :: 5.2",
31
+ ]
32
+ dependencies = [
33
+ "packaging",
34
+ ]
35
+ dynamic = ["version", "readme"]
36
+
37
+ [project.urls]
38
+ "Homepage" = "https://github.com/ExcellenceCloudGmbH/djangorestframework-api-key"
39
+ "Documentation" = "https://florimondmanca.github.io/djangorestframework-api-key/"
40
+
41
+ [tool.setuptools.dynamic]
42
+ version = { attr = "rest_framework_api_key.__version__" }
43
+ readme = { file = ["README.md", "CHANGELOG.md"], content-type = "text/markdown" }
44
+
45
+ [tool.ruff]
46
+ select = ["E", "F", "I"]
47
+ line-length = 88
48
+ src = ["src", "test_project", "tests"]
@@ -0,0 +1,16 @@
1
+ [mypy]
2
+ disallow_untyped_defs = True
3
+ ignore_missing_imports = True
4
+
5
+ [tool:pytest]
6
+ testpaths = tests
7
+ addopts =
8
+ -rxXs
9
+ --cov=src
10
+ --cov-report=term-missing
11
+ --cov-fail-under=100
12
+
13
+ [egg_info]
14
+ tag_build =
15
+ tag_date = 0
16
+
@@ -0,0 +1,3 @@
1
+ from setuptools import setup
2
+
3
+ setup() # Editable installs.