Using Django AllAuth with a REST API and JWT Authentication

I need to clarify that Django AllAuth is primarily designed for traditional server-rendered applications, not REST APIs. For a REST-only mobile application, you should consider using django-rest-auth or dj-rest-auth (the maintained fork) along with django-allauth for the authentication backend.

Recommended Approach

For a REST API with JWT authentication, I recommend the following setup:

1. Use dj-rest-auth with django-allauth for authentication endpoints
2. Use djangorestframework-simplejwt for JWT token handling

Installation

BASHCopied
pip install dj-rest-auth django-allauth djangorestframework-simplejwt

Configuration

Add these to your INSTALLED_APPS:

PYTHONCopied
INSTALLED_APPS = [
    # Django apps
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.sites',
    
    # Third-party apps
    'rest_framework',
    'rest_framework.authtoken',
    'dj_rest_auth',
    'allauth',
    'allauth.account',
    'allauth.socialaccount',
    'dj_rest_auth.registration',
]

# Site ID is required for django-allauth
SITE_ID = 1

# REST Framework settings
REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework_simplejwt.authentication.JWTAuthentication',
    ),
}

# dj-rest-auth settings
REST_AUTH = {
    'USE_JWT': True,
    'JWT_AUTH_COOKIE': 'auth',
    'JWT_AUTH_REFRESH_COOKIE': 'refresh-token',
}

# AllAuth settings
ACCOUNT_EMAIL_REQUIRED = True
ACCOUNT_UNIQUE_EMAIL = True
ACCOUNT_EMAIL_VERIFICATION = 'mandatory'
ACCOUNT_AUTHENTICATION_METHOD = 'email'

URL Configuration

PYTHONCopied
from django.urls import path, include

urlpatterns = [
    # dj-rest-auth endpoints
    path('auth/', include('dj_rest_auth.urls')),
    path('auth/registration/', include('dj_rest_auth.registration.urls')),
]

Customizing JWT Response

To customize the JWT token response, you can create a custom view that extends the login view from dj-rest-auth:

PYTHONCopied
from dj_rest_auth.views import LoginView
from rest_framework.response import Response

class CustomLoginView(LoginView):
    def get_response(self):
        response = super().get_response()
        # You can add additional data to the response here
        return response

Then update your URLs:

PYTHONCopied
from .views import CustomLoginView

urlpatterns = [
    # Other URLs
    path('auth/login/', CustomLoginView.as_view(), name='rest_login'),
    # Other auth URLs
    path('auth/', include('dj_rest_auth.urls')),
    path('auth/registration/', include('dj_rest_auth.registration.urls')),
]

Email Verification Flow

For email verification in a mobile app:

1. User registers through the registration endpoint
2. Server sends verification email with a token
3. User clicks the link in the email which opens your mobile app via deep linking
4. Your app extracts the verification key and sends it to your API
5. API confirms the email verification

You'll need to implement a custom endpoint to handle the verification key from your mobile app:

PYTHONCopied
from allauth.account.models import EmailConfirmation, EmailConfirmationHMAC
from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework import status

class VerifyEmailView(APIView):
    def post(self, request):
        key = request.data.get('key', '')
        
        # Verify the key
        confirmation = EmailConfirmationHMAC.from_key(key)
        if confirmation:
            confirmation.confirm(request)
            return Response({'detail': 'Email successfully verified'}, status=status.HTTP_200_OK)
        
        return Response({'detail': 'Invalid verification key'}, status=status.HTTP_400_BAD_REQUEST)

Summary

For a REST API with mobile clients:

1. Use dj-rest-auth with django-allauth for authentication endpoints
2. Configure JWT token authentication
3. Customize the login response to include any additional data needed by your mobile app
4. Implement a custom email verification flow that works with mobile deep linking

This approach gives you the benefits of AllAuth's robust authentication system while providing the REST API endpoints needed for mobile applications.