¶

A session-backed, fully-typed authentication library for Django Ninja, powered by PyJWT.

Stateful JWTs

Every token maps to a Session row in the database. You get token-based auth plus instant revocation and per-session state.
Built-in device management

Each user gets a session list with IP address, browser, and location. Users can sign out one device or all devices. Geolocation providers are pluggable, and a free one is included.
Fully typed

Protected routes receive an AuthedRequest with typed request.auth.user and request.auth.session. OpenAPI schemas include typed error responses.
Three refresh-token transports

JSON body, HttpOnly cookie, or both. Refresh tokens rotate on every use.
Complete

Seven auth endpoints, a Django admin page, a pluggable payload class for custom claims, a pluggable authenticator for non-password login flows, and a pluggable geolocation provider for the session list.

At a glance¶

Protect a route and get typed access to the user and session:

from ninja import Router
from jwt_ninja import AuthedRequest, JWTAuth

router = Router()


@router.get("/profile/", auth=JWTAuth())
def profile(request: AuthedRequest):
    user = request.auth.user  # the Django User
    session = request.auth.session  # the jwt_ninja Session
    return {"username": user.username, "session_id": session.id}

Give every user a "where am I signed in?" screen with GET /auth/sessions/:

[
  {
    "id": "8dKt2…",
    "ip_address": "203.0.113.42",
    "browser": "Chrome on macOS",
    "location": { "city": "Amsterdam", "country": "Netherlands" },
    "is_current": true
  }
]

Users sign out one device with DELETE /auth/sessions/{id}/, or all devices with POST /auth/logout/all/.

Get started Sessions & devices Endpoint reference