exc-djangorestframework-api-key 1.0.1__py3-none-any.whl

exc_djangorestframework_api_key-1.0.1.dist-info/METADATA

@@ -0,0 +1,320 @@
+Metadata-Version: 2.4
+Name: exc_djangorestframework_api_key
+Version: 1.0.1
+Summary: API key permissions for the Django REST Framework
+Author-email: Melih Sünbül <m.sunbul@excellence-cloud.com>
+License: MIT
+Project-URL: Homepage, https://github.com/ExcellenceCloudGmbH/djangorestframework-api-key
+Project-URL: Documentation, https://florimondmanca.github.io/djangorestframework-api-key/
+Classifier: Development Status :: 4 - Beta
+Classifier: Operating System :: OS Independent
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Environment :: Web Environment
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Framework :: Django
+Classifier: Framework :: Django :: 2.2
+Classifier: Framework :: Django :: 3.2
+Classifier: Framework :: Django :: 4.2
+Classifier: Framework :: Django :: 5.2
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: packaging
+Dynamic: license-file
+
+# Django REST Framework API Key
+
+API key permissions for the [Django REST Framework](https://www.django-rest-framework.org).
+
+<div>
+  <a href="https://dev.azure.com/florimondmanca/public/_build/latest?definitionId=7&branchName=master">
+      <img src="https://dev.azure.com/florimondmanca/public/_apis/build/status/florimondmanca.djangorestframework-api-key?branchName=master" alt="build status"/>
+  </a>
+  <a href="https://codecov.io/gh/florimondmanca/djangorestframework-api-key">
+      <img src="https://codecov.io/gh/florimondmanca/djangorestframework-api-key/branch/master/graph/badge.svg" alt="coverage">
+  </a>
+  <a href="https://pypi.org/project/djangorestframework-api-key">
+      <img src="https://badge.fury.io/py/djangorestframework-api-key.svg" alt="package version"/>
+  </a>
+</div>
+<div>
+  <img src="https://img.shields.io/pypi/pyversions/djangorestframework-api-key.svg" alt="python versions"/>
+  <img src="https://img.shields.io/pypi/djversions/djangorestframework-api-key.svg?colorB=44b78b" alt="django versions"/>
+  <img src="https://img.shields.io/badge/drf-3.8+-7f2d2d.svg" alt="drf versions"/>
+</div>
+
+## Introduction
+
+**Django REST Framework API Key is a library for allowing server-side clients to safely use your API.** These clients are typically third-party backends and services (i.e. _machines_) which do not have a user account but still need to interact with your API in a secure way.
+
+### Features
+
+- ✌️ **Simple to use**: create, view and revoke API keys via the admin site, or use built-in helpers to create API keys programmatically.
+- 🔒 **As secure as possible**: API keys are treated with the same level of care as user passwords. They are only visible at creation and hashed before storing in the database.
+- 🎨 **Customizable**: satisfy specific business requirements by building your own customized API key models, permission classes and admin panels.
+
+### Should I use API keys?
+
+There are important security aspects you need to consider before switching to an API key access control scheme. We've listed some of these in [Security caveats](docs/security.md#caveats), including serving your API over HTTPS.
+
+Besides, see [Why and when to use API keys](https://cloud.google.com/endpoints/docs/openapi/when-why-api-key#top_of_page) for hints on whether API keys can fit your use case.
+
+API keys are ideal in the following situations:
+
+- Blocking anonymous traffic.
+- Implementing API key-based [throttling](https://www.django-rest-framework.org/api-guide/throttling/). (Note that Django REST Framework already has may built-in utilities for this use case.)
+- Identifying usage patterns by logging request information along with the API key.
+
+They can also present enough security for authorizing internal services, such as your API server and an internal frontend application.
+
+> Please note that this package is NOT meant for authentication. You should NOT use this package to identify individual users, either directly or indirectly.
+>
+> If you need server-to-server authentication, you may want to consider OAuth instead. Libraries such as [django-oauth-toolkit](https://django-oauth-toolkit.readthedocs.io/en/latest/index.html) can help.
+
+## Quickstart
+
+Install with `pip`:
+
+```bash
+pip install "djangorestframework-api-key==3.*"
+```
+
+_**Note**: It is highly recommended to **pin your dependency** to the latest major version (as depicted above), as breaking changes may and will happen between major releases._
+
+Add the app to your `INSTALLED_APPS`:
+
+```python
+# settings.py
+
+INSTALLED_APPS = [
+  # ...
+  "rest_framework",
+  "rest_framework_api_key",
+]
+```
+
+Run the included migrations:
+
+```bash
+python manage.py migrate
+```
+
+To learn how to configure permissions and manage API keys, head to the [Documentation](https://florimondmanca.github.io/djangorestframework-api-key).
+
+## Changelog
+
+See [CHANGELOG.md](https://github.com/florimondmanca/djangorestframework-api-key/tree/master/CHANGELOG.md).
+
+## Contributing
+
+See [CONTRIBUTING.md](https://github.com/florimondmanca/djangorestframework-api-key/tree/master/CONTRIBUTING.md).
+
+## License
+
+MIT
+
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [fork] exc_djangorestframework_api_key 1.0.1 - 2026-10-25
+
+### Fixed
+
+- Add the missing migration for the `APIKey.id` and `APIKey.hashed_key` column widths.
+  `models.py` has declared `max_length=150` on both since this fork squashed its migration
+  history into a single `0001_initial`, but that squashed migration still created them as
+  `varchar(100)`. The model and the schema therefore disagreed, and because
+  `KeyGenerator.hash()` returns a 136-character value (Django's default hasher via
+  `make_password`), `id` (145 characters) and `hashed_key` (136) both overflowed the real
+  column. Creating any API key against a database built from `0001` alone failed with
+  `value too long for type character varying(100)`.
+
+  `0002_alter_apikey_hashed_key_alter_apikey_id` is generated by `makemigrations` and brings
+  the schema up to the model. `makemigrations --check` is clean afterwards. No model, runtime
+  or API change; databases already created from this fork's source are unaffected apart from
+  the two columns widening.
+
+## 3.1.0 - 2025-04-04
+
+### Added
+
+- Add official support for Python 3.12 and 3.13, and Django 5.0 up to 5.2, accomodating changes to `USE_TZ`. (Pull #266)
+
+## 3.0.0 - 2023-09-30
+
+### Changed
+
+- Use faster SHA512-based key hasher instead of password hashers. Reduces server load by making API key validation orders of magnitude faster (10x to 30x according to estimations, network latency aside). Hashed key will be transparently upgraded the first time `.is_valid()` is called. (Pull #244, Pull #251)
+
+### Removed
+
+- Dropped support for Python 3.7, which has reached EOL. (Pull #247)
+- Drop redundant `.has_object_permission()` implementation on `BaseHasAPIKey` when using DRF 3.14.0 or above. (Pull #240)
+
+### Added
+
+- Add official support for Python 3.11. (Pull #247)
+
+## 2.3.0 - 2023-01-19
+
+### Removed
+
+- Drop support for Python 3.6, which has reached EOL. (Pull #210)
+
+### Fixed
+
+- Fix migration 0004 when run against a non default database. (Pull #215)
+
+## 2.2.0 - 2022-03-11
+
+### Added
+
+- Added support for Django config detection for different versions (PR #187)
+
+### Changed
+
+- Add official support for Django 3.2 and Python 3.9 and 3.10 (PR #189)
+- Bumped `hashed_key` field's `max_length` from 100 to 150 to address length issue with `argon2-cffi` (PR #193)
+
+## 2.1.0 - 2021-09-24
+
+### Added
+
+- Add support for custom API `keyword`. (Pull #175)
+
+## 2.0.0 - 2020-04-07
+
+**NOTE**: this release drops compatibility with certain Python and Django versions, but contains no other breaking changes. See [Upgrade to 2.0](https://florimondmanca.github.io/djangorestframework-api-key/upgrade/2.0/) for detailed migration steps.
+
+### Removed
+
+- Dropped support for Django 2.0 and Django 2.1. (Pull #126)
+- Dropped support for Python 3.5. (Pull #84)
+
+### Added
+
+- Add support for Django 3.0. (Pull #82)
+- Add support for Python 3.8. (Pull #81)
+- Add `BaseAPIKeyManager.get_from_key()` to allow retrieving API keys from views. (Pull #93)
+- Add type annotations, and partial support for `django-stubs` and `djangorestframework-stubs`. (Pull #88, Pull #122)
+
+## 1.4.1 - 2019-08-24
+
+### Added
+
+- Now ships with type annotations ([PEP 561](https://www.python.org/dev/peps/pep-0561/)). (Pull #73)
+
+## 1.4.0 - 2019-07-16
+
+**NOTE**: this release contains migrations. See [Upgrade to v1.4](https://florimondmanca.github.io/djangorestframework-api-key/upgrade/1.4/) for detailed instructions.
+
+### Added
+
+- The `prefix` and `hashed_key` are now stored in dedicated fields on the `APIKey` model. (Pull #62)
+
+## 1.3.0 - 2019-06-28
+
+**NOTE**: this release contains migrations. In your Django project, run them using:
+
+```python
+python manage.py migrate rest_framework_api_key
+```
+
+### Added
+
+- Add abstract API key model (`AbstractAPIKey`) and base manager (`BaseAPIKeyManager`). (Pull #36)
+- Add base permissions (`BaseHasAPIKey`). (Pull #46)
+
+### Changed
+
+- The `id` field of `APIKey` is now non-`editable`.
+- `APIKeyModelAdmin` does not define `fieldsets` anymore. This allows subclasses to benefit from Django's automatic fieldsets. (Pull #52)
+
+### Fixed
+
+- Explicitly use `utf-8` encoding in `setup.py`, which could previously lead to issues when installing on certain systems. (Pull #58)
+
+## 1.2.1 - 2019-06-03
+
+### Fixed
+
+- Fixed a critical bug in `APIKeyModelAdmin` that prevented `rest_framework_api_key` from passing Django system checks. (Pull #39)
+
+## 1.2.0 - 2019-05-29
+
+**NOTE**: this release contains migrations. In your Django project, run them using:
+
+```python
+python manage.py migrate rest_framework_api_key
+```
+
+### Added
+
+- API keys can now have an optional `expiry_date`. (Pull #33) `HasAPIKey` denies access if the API key has expired, i.e. if `expiry_date`, if set, is in the past.
+- It is now possible to search by `prefix` in the API key admin panel.
+- The `prefix` is now displayed in the edit view of the API key admin panel.
+
+## 1.1.0 - 2019-05-14
+
+### Added
+
+- Improve documentation on which password hasher is used.
+- Add tests against the Argon2, BcryptSHA256 and PBKDF2SHA1 hashers. (Pull #32)
+
+### Fixed
+
+- Fix support for password hashers that generate hashes that contain dots. (Pull #31)
+
+## 1.0.0 - 2019-04-24
+
+**This release is incompatible with 0.x**. See [Upgrade to 1.0](https://florimondmanca.github.io/djangorestframework-api-key/upgrade/1.4/) for migration steps.
+
+### Removed
+
+- Remove `HasAPIKeyOrIsAuthenticated` permission class. You should use bitwise composition now, e.g. `HasAPIKey | IsAuthenticated`.
+- Drop the `DRF_API_KEY_*` settings. (Pull #19)
+
+### Changed
+
+- Switch to a new API key generation and validation scheme. Clients must now authorize using a single API key header (Pull #19). The header is `Authorization` by default. It can be customized using the `API_KEY_CUSTOM_HEADER` setting (Pull #26). Use the `name` field to identify clients.
+
+### Added
+
+- Add support for Django 2.2. (Pull #27)
+- Add programmatic API key creation using `APIKey.objects.create_key()`. (Pull #19)
+
+### Fixed
+
+- Improved API key storage using Django's password hashing helpers. (Uses the default Django password hasher.) (Pull #19)
+
+## 0.4.0 - 2019-04-21
+
+### Removed
+
+- Drop support for Python 3.4. Only 3.5, 3.6 and 3.7 are supported now.
+- Drop support for Django < 2.0. Only 2.0 and 2.1 are supported now.
+
+### Fixed
+
+- `HasAPIKey` now implements `.has_object_permissions()`, which allows to compose it with other permission classes and perform object-level permission checks. (Pull #25)
+
+## 0.3.1 - 2018-11-17
+
+_Initial changelog entry._
+
+### Added
+
+- `APIKey` model.
+- `HasAPIKey` and `HasAPIKeyOrIsAuthenticated` permission classes.
+- Generate, view and revoke API keys from the Django admin.
+- Authenticate requests using the `Api-Token` and `Api-Secret-Key` headers. Customizable via the `DRF_API_KEY_TOKEN_HEADER` and `DRF_API_KEY_SECRET_KEY_HEADER` settings.

exc_djangorestframework_api_key-1.0.1.dist-info/RECORD

@@ -0,0 +1,15 @@
+exc_djangorestframework_api_key-1.0.1.dist-info/licenses/LICENSE,sha256=nyXOn1Sbn1D5fSkFR5uhWjZQxGgEpsjK2gULbbNB8Jc,1072
+rest_framework_api_key/__init__.py,sha256=aP4cXxNPfxDe5Cfu3fLOjslzKbIn0E7Aa9sl1-a78Hk,287
+rest_framework_api_key/admin.py,sha256=vtqAAWEsjapUOup9PJujgQX1gBSWxTVcsVAWL8j5J3A,1631
+rest_framework_api_key/apps.py,sha256=DyjUGi532pZQbM3WGK3pvnnrhgSzg9UGtj0izWDfTd4,157
+rest_framework_api_key/crypto.py,sha256=J6wLNa_XOBdpExB6TzDQc3QKzwlSUqJ0cXNhWRi2N8M,2662
+rest_framework_api_key/models.py,sha256=fXG_nlDsJwGnw0av7btlimWkXzN0Y5Eu7pwuk53HbVA,5062
+rest_framework_api_key/permissions.py,sha256=9G4bAz5NsgUwxWN01SIld4fxNTj1GNjW7FOqNg5ymp8,2786
+rest_framework_api_key/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+rest_framework_api_key/migrations/0001_initial.py,sha256=cF-AMHqa6yjabaXi71jfBSbgKJI5cdVcVUTCgnN9B9w,1398
+rest_framework_api_key/migrations/0002_alter_apikey_hashed_key_alter_apikey_id.py,sha256=6JOcb9TdYamOzzD__BnrbxindpuMnT1xaDhNHCL2jlc,625
+rest_framework_api_key/migrations/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+exc_djangorestframework_api_key-1.0.1.dist-info/METADATA,sha256=fmWhZya9kEz5SX1mLuW2_5y_j78WR4Dcu7V0ZunSh4E,12508
+exc_djangorestframework_api_key-1.0.1.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+exc_djangorestframework_api_key-1.0.1.dist-info/top_level.txt,sha256=8kBfKhYyv2-t77c6-nIyrSe96btxb6p_uuoxgyAmphA,23
+exc_djangorestframework_api_key-1.0.1.dist-info/RECORD,,

exc_djangorestframework_api_key-1.0.1.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

exc_djangorestframework_api_key-1.0.1.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2018 Florimond Manca
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

exc_djangorestframework_api_key-1.0.1.dist-info/top_level.txt

@@ -0,0 +1 @@
+rest_framework_api_key

rest_framework_api_key/__init__.py

@@ -0,0 +1,11 @@
+try:
+    import django
+except ImportError:  # pragma: no cover
+    pass
+else:
+    if django.VERSION < (3, 2):  # pragma: no cover
+        default_app_config = "rest_framework_api_key.apps.RestFrameworkApiKeyConfig"
+
+__version__ = "1.0.1"
+
+__all__ = ["__version__", "default_app_config"]

rest_framework_api_key/admin.py

@@ -0,0 +1,61 @@
+import typing
+
+from django.contrib import admin, messages
+from django.db import models
+from django.http.request import HttpRequest
+from django.utils.translation import gettext_lazy as _
+
+from .models import AbstractAPIKey, APIKey
+
+
+class APIKeyModelAdmin(admin.ModelAdmin):
+    model: typing.Type[AbstractAPIKey]
+
+    list_display = (
+        "prefix",
+        "name",
+        "created",
+        "expiry_date",
+        "_has_expired",
+        "revoked",
+    )
+    list_filter = ("created",)
+    search_fields = ("name", "prefix")
+
+    def get_readonly_fields(
+        self, request: HttpRequest, obj: models.Model = None
+    ) -> typing.Tuple[str, ...]:
+        obj = typing.cast(AbstractAPIKey, obj)
+        fields: typing.Tuple[str, ...]
+
+        fields = ("prefix",)
+        if obj is not None and obj.revoked:
+            fields = fields + ("name", "revoked", "expiry_date")
+
+        return fields
+
+    def save_model(
+        self,
+        request: HttpRequest,
+        obj: AbstractAPIKey,
+        form: typing.Any = None,
+        change: bool = False,
+    ) -> None:
+        created = not obj.pk
+
+        if created:
+            key = self.model.objects.assign_key(obj)
+            obj.save()
+            message = _(
+                "The API key for {} is: {}. ".format(obj.name, key)
+                + "Please store it somewhere safe: "
+                + "you will not be able to see it again."
+            )
+            messages.add_message(request, messages.WARNING, message)
+        else:
+            obj.save()
+
+
+admin.site.register(APIKey, APIKeyModelAdmin)
+
+APIKeyAdmin = APIKeyModelAdmin  # Compatibility with <1.3

rest_framework_api_key/apps.py

@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class RestFrameworkApiKeyConfig(AppConfig):
+    name = "rest_framework_api_key"
+    verbose_name = "API Key Permissions"

rest_framework_api_key/crypto.py

@@ -0,0 +1,82 @@
+import hashlib
+import typing
+
+from django.contrib.auth.hashers import (
+    BasePasswordHasher,
+    check_password,
+    make_password,
+)
+from django.utils.crypto import constant_time_compare, get_random_string
+
+
+def concatenate(left: str, right: str) -> str:
+    return "{}.{}".format(left, right)
+
+
+def split(concatenated: str) -> typing.Tuple[str, str]:
+    left, _, right = concatenated.partition(".")
+    return left, right
+
+
+class Sha512ApiKeyHasher(BasePasswordHasher):
+    """
+    An API key hasher using the sha512 algorithm.
+
+    This hasher should *NEVER* be used in Django's `PASSWORD_HASHERS` setting.
+    It is insecure for use in hashing passwords, but is safe for hashing
+    high entropy, randomly generated API keys.
+    """
+
+    algorithm = "sha512"
+
+    def salt(self) -> str:
+        """No need for a salt on a high entropy key."""
+        return ""
+
+    def encode(self, password: str, salt: str) -> str:
+        if salt != "":
+            raise ValueError("salt is unnecessary for high entropy API tokens.")
+        hash = hashlib.sha512(password.encode()).hexdigest()
+        return "%s$$%s" % (self.algorithm, hash)
+
+    def verify(self, password: str, encoded: str) -> bool:
+        encoded_2 = self.encode(password, "")
+        return constant_time_compare(encoded, encoded_2)
+
+
+class KeyGenerator:
+    preferred_hasher = Sha512ApiKeyHasher()
+
+    def __init__(self, prefix_length: int = 8, secret_key_length: int = 32):
+        self.prefix_length = prefix_length
+        self.secret_key_length = secret_key_length
+
+    def get_prefix(self) -> str:
+        return get_random_string(self.prefix_length)
+
+    def get_secret_key(self) -> str:
+        return get_random_string(self.secret_key_length)
+
+    def hash(self, value: str) -> str:
+        return make_password(value, hasher=self.preferred_hasher)
+
+    def generate(self) -> typing.Tuple[str, str, str]:
+        prefix = self.get_prefix()
+        secret_key = self.get_secret_key()
+        key = concatenate(prefix, secret_key)
+        hashed_key = self.hash(key)
+        return key, prefix, hashed_key
+
+    def verify(self, key: str, hashed_key: str) -> bool:
+        if self.using_preferred_hasher(hashed_key):
+            # New simpler hasher
+            result = self.preferred_hasher.verify(key, hashed_key)
+        else:
+            # Slower password hashers from Django
+            # If verified, these will be transparently updated to the preferred hasher
+            result = check_password(key, hashed_key)
+
+        return result
+
+    def using_preferred_hasher(self, hashed_key: str) -> bool:
+        return hashed_key.startswith(f"{self.preferred_hasher.algorithm}$$")

rest_framework_api_key/migrations/0001_initial.py

@@ -0,0 +1,31 @@
+# Generated by Django 3.0.14 on 2022-02-15 20:00
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    initial = True
+
+    dependencies = [
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='APIKey',
+            fields=[
+                ('id', models.CharField(editable=False, max_length=100, primary_key=True, serialize=False, unique=True)),
+                ('prefix', models.CharField(editable=False, max_length=8, unique=True)),
+                ('hashed_key', models.CharField(editable=False, max_length=100)),
+                ('created', models.DateTimeField(auto_now_add=True, db_index=True)),
+                ('name', models.CharField(default=None, help_text='A free-form name for the API key. Need not be unique. 50 characters max.', max_length=50)),
+                ('revoked', models.BooleanField(blank=True, default=False, help_text='If the API key is revoked, clients cannot use it anymore. (This cannot be undone.)')),
+                ('expiry_date', models.DateTimeField(blank=True, help_text='Once API key expires, clients cannot use it anymore.', null=True, verbose_name='Expires')),
+            ],
+            options={
+                'verbose_name': 'API key',
+                'verbose_name_plural': 'API keys',
+                'ordering': ('-created',),
+                'abstract': False,
+            },
+        ),
+    ]

rest_framework_api_key/migrations/0002_alter_apikey_hashed_key_alter_apikey_id.py

@@ -0,0 +1,23 @@
+# Generated by Django 6.0.8 on 2026-10-25 15:37
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('rest_framework_api_key', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='apikey',
+            name='hashed_key',
+            field=models.CharField(editable=False, max_length=150),
+        ),
+        migrations.AlterField(
+            model_name='apikey',
+            name='id',
+            field=models.CharField(editable=False, max_length=150, primary_key=True, serialize=False, unique=True),
+        ),
+    ]

rest_framework_api_key/models.py

@@ -0,0 +1,163 @@
+import typing
+
+from django.core.exceptions import ValidationError
+from django.db import models
+from django.utils import timezone
+from django.utils.translation import gettext_lazy as _
+
+from .crypto import KeyGenerator, concatenate, split
+
+
+class BaseAPIKeyManager(models.Manager):
+    key_generator = KeyGenerator()
+
+    def assign_key(self, obj: "AbstractAPIKey") -> str:
+        try:
+            key, prefix, hashed_key = self.key_generator.generate()
+        except ValueError:  # Compatibility with < 1.4
+            generate = typing.cast(
+                typing.Callable[[], typing.Tuple[str, str]], self.key_generator.generate
+            )
+            key, hashed_key = generate()
+            pk = hashed_key
+            prefix, hashed_key = split(hashed_key)
+        else:
+            pk = concatenate(prefix, hashed_key)
+
+        obj.id = pk
+        obj.prefix = prefix
+        obj.hashed_key = hashed_key
+
+        return key
+
+    def create_key(self, **kwargs: typing.Any) -> typing.Tuple["AbstractAPIKey", str]:
+        # Prevent from manually setting the primary key.
+        kwargs.pop("id", None)
+        obj = self.model(**kwargs)
+        key = self.assign_key(obj)
+        obj.save()
+        return obj, key
+
+    def get_usable_keys(self) -> models.QuerySet:
+        return self.filter(revoked=False)
+
+    def get_from_key(self, key: str) -> "AbstractAPIKey":
+        prefix, _, _ = key.partition(".")
+        queryset = self.get_usable_keys()
+
+        try:
+            api_key = queryset.get(prefix=prefix)
+        except self.model.DoesNotExist:
+            raise  # For the sake of being explicit.
+
+        if not api_key.is_valid(key):
+            raise self.model.DoesNotExist("Key is not valid.")
+        else:
+            return api_key
+
+    def is_valid(self, key: str) -> bool:
+        try:
+            api_key = self.get_from_key(key)
+        except self.model.DoesNotExist:
+            return False
+
+        if api_key.has_expired:
+            return False
+
+        return True
+
+
+class APIKeyManager(BaseAPIKeyManager):
+    pass
+
+
+class AbstractAPIKey(models.Model):
+    objects = APIKeyManager()
+
+    id = models.CharField(max_length=150, unique=True, primary_key=True, editable=False)
+    prefix = models.CharField(max_length=8, unique=True, editable=False)
+    hashed_key = models.CharField(max_length=150, editable=False)
+    created = models.DateTimeField(auto_now_add=True, db_index=True)
+    name = models.CharField(
+        max_length=50,
+        blank=False,
+        default=None,
+        help_text=(
+            _(
+                "A free-form name for the API key. "
+                "Need not be unique. "
+                "50 characters max."
+            )
+        ),
+    )
+    revoked = models.BooleanField(
+        blank=True,
+        default=False,
+        help_text=(
+            _(
+                "If the API key is revoked, clients cannot use it anymore. "
+                "(This cannot be undone.)"
+            )
+        ),
+    )
+    expiry_date = models.DateTimeField(
+        blank=True,
+        null=True,
+        verbose_name=_("Expires"),
+        help_text=_("Once API key expires, clients cannot use it anymore."),
+    )
+
+    class Meta:  # noqa
+        abstract = True
+        ordering = ("-created",)
+        verbose_name = "API key"
+        verbose_name_plural = "API keys"
+
+    def __init__(self, *args: typing.Any, **kwargs: typing.Any):
+        super().__init__(*args, **kwargs)
+        # Store the initial value of `revoked` to detect changes.
+        self._initial_revoked = self.revoked
+
+    def _has_expired(self) -> bool:
+        if self.expiry_date is None:
+            return False
+        return self.expiry_date < timezone.now()
+
+    _has_expired.short_description = "Has expired"  # type: ignore
+    _has_expired.boolean = True  # type: ignore
+    has_expired = property(_has_expired)
+
+    def is_valid(self, key: str) -> bool:
+        key_generator = type(self).objects.key_generator
+        valid = key_generator.verify(key, self.hashed_key)
+
+        # Transparently update the key to use the preferred hasher
+        # if it is using an outdated hasher.
+        if valid and not key_generator.using_preferred_hasher(self.hashed_key):
+            # Note that since the PK includes the hashed key,
+            # they will be internally inconsistent following this upgrade.
+            # See: https://github.com/florimondmanca/djangorestframework-api-key/issues/128
+            self.hashed_key = key_generator.hash(key)
+            self.save()
+
+        return valid
+
+    def clean(self) -> None:
+        self._validate_revoked()
+
+    def save(self, *args: typing.Any, **kwargs: typing.Any) -> None:
+        self._validate_revoked()
+        super().save(*args, **kwargs)
+
+    def _validate_revoked(self) -> None:
+        if self._initial_revoked and not self.revoked:
+            raise ValidationError(
+                _("The API key has been revoked, which cannot be undone.")
+            )
+
+    def __str__(self) -> str:
+        return str(self.name)
+
+
+class APIKey(AbstractAPIKey):
+    pass

rest_framework_api_key/permissions.py

@@ -0,0 +1,81 @@
+import typing
+
+import packaging.version
+from django.conf import settings
+from django.http import HttpRequest
+from rest_framework import __version__ as __drf_version__
+from rest_framework import permissions
+
+from .models import AbstractAPIKey, APIKey
+
+_drf_version = packaging.version.parse(__drf_version__)
+_3_14_0 = packaging.version.parse("3.14.0")
+
+
+class KeyParser:
+    keyword = "Api-Key"
+
+    def get(self, request: HttpRequest) -> typing.Optional[str]:
+        custom_header = getattr(settings, "API_KEY_CUSTOM_HEADER", None)
+
+        if custom_header is not None:
+            return self.get_from_header(request, custom_header)
+
+        return self.get_from_authorization(request)
+
+    def get_from_authorization(self, request: HttpRequest) -> typing.Optional[str]:
+        authorization = request.META.get("HTTP_AUTHORIZATION", "")
+
+        if not authorization:
+            return None
+
+        keyword, found, key = authorization.partition(" ")
+
+        if not found:
+            return None
+
+        if keyword.lower() != self.keyword.lower():
+            return None
+
+        return key
+
+    def get_from_header(self, request: HttpRequest, name: str) -> typing.Optional[str]:
+        return request.META.get(name) or None
+
+
+class BaseHasAPIKey(permissions.BasePermission):
+    model: typing.Optional[typing.Type[AbstractAPIKey]] = None
+    key_parser = KeyParser()
+
+    def get_key(self, request: HttpRequest) -> typing.Optional[str]:
+        return self.key_parser.get(request)
+
+    def has_permission(self, request: HttpRequest, view: typing.Any) -> bool:
+        assert self.model is not None, (
+            "%s must define `.model` with the API key model to use"
+            % self.__class__.__name__
+        )
+        key = self.get_key(request)
+        if not key:
+            return False
+        return self.model.objects.is_valid(key)
+
+    def has_object_permission(
+        self, request: HttpRequest, view: typing.Any, obj: AbstractAPIKey
+    ) -> bool:
+        if _drf_version < _3_14_0:  # pragma: no cover
+            # Before DRF 3.14.0 (released in Sept 2022), bitwise OR would skip
+            # .has_permision() and only call .has_object_permission(), resulting in
+            # API key permissions not being checked unless we implemented
+            # .has_object_permission().
+            # Since 3.14.0, DRF appropriately checks for both .has_permission() and
+            # .has_object_permission() when checking object permissions of a bitwise OR.
+            # We kept the old redundant behavior to avoid regressions for users who have
+            # not updated their DRF yet.
+            return self.has_permission(request, view)
+
+        return super().has_object_permission(request, view, obj)
+
+
+class HasAPIKey(BaseHasAPIKey):
+    model = APIKey