BackendAuthentication
JWT Tokens
JSON Web Token configuration and usage.
Configuration
SIMPLE_JWT = {
"AUTH_HEADER_TYPES": ("JWT",),
"ACCESS_TOKEN_LIFETIME": timedelta(hours=100),
"REFRESH_TOKEN_LIFETIME": timedelta(days=14),
"BLACKLIST_AFTER_ROTATION": True,
}| Setting | Value | Description |
|---|---|---|
AUTH_HEADER_TYPES | ("JWT",) | Use Authorization: JWT <token> header |
ACCESS_TOKEN_LIFETIME | 100 hours | How long an access token is valid |
REFRESH_TOKEN_LIFETIME | 14 days | How long a refresh token is valid |
BLACKLIST_AFTER_ROTATION | True | Old refresh tokens are invalidated after use |
Endpoints
All JWT endpoints are under /auth/:
Obtain Token
POST /auth/jwt/create/Request:
{
"email": "user@example.com",
"password": "your-password"
}Response:
{
"access": "eyJ0eXAiOiJKV1Q...",
"refresh": "eyJ0eXAiOiJKV1Q..."
}Refresh Token
POST /auth/jwt/refresh/Request:
{
"refresh": "eyJ0eXAiOiJKV1Q..."
}Response:
{
"access": "eyJ0eXAiOiJKV1Q..."
}Verify Token
POST /auth/jwt/verify/Request:
{
"token": "eyJ0eXAiOiJKV1Q..."
}Returns 200 OK if valid, 401 Unauthorized if expired or invalid.
Usage
Include the JWT in the Authorization header for all API requests:
curl -H "Authorization: JWT eyJ0eXAiOiJKV1Q..." \
http://localhost:8000/api/workspaces/