Django REST Framework Authentication & Permissions: A Simple Guide

Md. Nisan Hossain — Sun, 16 Aug 2026 12:18:46 +0000

Django REST Framework Authentication & Permissions: A Simple Guide

If you're building APIs with Django REST Framework (DRF), authentication and permissions are two of the most important things to understand.

In this guide, I'll explain them in a simple and practical way with examples you can use in real Django projects.

Authentication vs Permissions

Let's make it simple.

Authentication answers:

Who is this user?

Permissions answer:

What is this user allowed to do?

For example, imagine an e-commerce API:

Customer → Can view products and create orders
Seller   → Can manage products
Admin    → Can manage users, products and orders

Authentication identifies the user.

Permissions decide what that user can access.

Setting Up Django REST Framework

First, install Django REST Framework:

pip install djangorestframework

Then add it to your Django project:

INSTALLED_APPS = [
    ...
    "rest_framework",
]

Now you can start building your REST API.

Using `IsAuthenticated`

One of the most useful DRF permissions is IsAuthenticated.

from rest_framework.permissions import IsAuthenticated
from rest_framework.viewsets import ModelViewSet

class OrderViewSet(ModelViewSet):
    permission_classes = [IsAuthenticated]

    queryset = Order.objects.all()
    serializer_class = OrderSerializer

Now only logged-in users can access this API.

This is useful for endpoints such as:

/api/profile/
/api/orders/
/api/wishlist/
/api/cart/

Public vs Private APIs

Not every endpoint needs authentication.

For example, anyone might be allowed to view products:

from rest_framework.permissions import AllowAny

class ProductViewSet(ModelViewSet):
    permission_classes = [AllowAny]

    queryset = Product.objects.all()
    serializer_class = ProductSerializer

A simple API can therefore look like this:

Public
 ├── Product List
 └── Product Details

Authenticated
 ├── Profile
 ├── Orders
 └── Wishlist

Admin
 ├── User Management
 └── Product Management

This makes your API easier to understand and maintain.

Using `IsAdminUser`

DRF also provides IsAdminUser.

from rest_framework.permissions import IsAdminUser

class UserManagementViewSet(ModelViewSet):
    permission_classes = [IsAdminUser]

    queryset = User.objects.all()
    serializer_class = UserSerializer

Now only admin users can access this endpoint.

This is useful for dashboards and administrative APIs.

Creating a Custom Permission

Real applications often need more specific rules.

For example:

Anyone can view products, but only staff users can create or delete them.

We can create a custom permission:

from rest_framework.permissions import BasePermission

class IsStaffOrReadOnly(BasePermission):

    def has_permission(self, request, view):
        if request.method in ["GET", "HEAD", "OPTIONS"]:
            return True

        return (
            request.user.is_authenticated
            and request.user.is_staff
        )

Then use it:

class ProductViewSet(ModelViewSet):
    permission_classes = [IsStaffOrReadOnly]

    queryset = Product.objects.all()
    serializer_class = ProductSerializer

Now the behavior is:

GET     → Anyone
HEAD    → Anyone
OPTIONS → Anyone

POST    → Staff only
PUT     → Staff only
PATCH   → Staff only
DELETE  → Staff only

This is a simple but very useful pattern.

Object-Level Permissions

This is where things become really important.

Imagine this API:

GET /api/orders/25/

A user is authenticated, but that doesn't automatically mean they should be able to see every order.

A customer should normally see only their own orders.

We can create an object-level permission:

from rest_framework.permissions import BasePermission

class IsOrderOwner(BasePermission):

    def has_object_permission(self, request, view, obj):
        return obj.user == request.user

Then:

class OrderDetailView(RetrieveAPIView):
    permission_classes = [
        IsAuthenticated,
        IsOrderOwner,
    ]

    queryset = Order.objects.all()
    serializer_class = OrderSerializer

Now the API checks:

Is the user authenticated?
        ↓
Does this order belong to the user?
        ↓
Yes → Allow
No  → Deny

This type of authorization is extremely important when working with private user data.

Role-Based Access Control

As an application grows, you may need different roles.

For example:

Admin
Seller
Support
Customer

Each role can have different permissions.

A simple custom permission could check Django Groups:

from rest_framework.permissions import BasePermission

class IsSeller(BasePermission):

    def has_permission(self, request, view):
        return (
            request.user.is_authenticated
            and request.user.groups.filter(
                name="Seller"
            ).exists()
        )

Then:

class SellerProductViewSet(ModelViewSet):
    permission_classes = [IsSeller]

    queryset = Product.objects.all()
    serializer_class = ProductSerializer

This gives you a simple foundation for Role-Based Access Control (RBAC).

A Common Mistake

One mistake I see in APIs is trusting the user ID sent by the client.

For example:

user = User.objects.get(id=request.data["user"])

For user-owned resources, this can create security problems.

Instead, when appropriate, use the authenticated user:

user = request.user

The server should determine ownership instead of blindly trusting the client.

Another Important Mistake

This:

permission_classes = [IsAuthenticated]

only tells us that the user is authenticated.

It does not automatically mean that the user can access every object.

For example:

User A
 └── Order #10

User B
 └── Order #20

User A should not automatically be able to access Order #20.

That's why object-level permissions and proper queryset filtering are important.

Simple DRF Permission Strategy

For many projects, you can start with something like this:

Public API
    ↓
AllowAny

Private API
    ↓
IsAuthenticated

Admin API
    ↓
IsAdminUser

Role-based API
    ↓
Custom Permission

User-owned resources
    ↓
Object-level Permission

You don't need a complicated authorization system from day one.

Start simple and make it more specific as your application grows.

Best Practices

When building a Django REST API, keep these points in mind:

Use authentication for private APIs.
Use permissions for authorization.
Don't trust user ownership data from the client.
Use object-level permissions when necessary.
Keep permission logic reusable.
Don't expose sensitive information through serializers.
Use HTTPS in production.
Keep secret keys and credentials out of source code.
Test both authorized and unauthorized requests.
Keep your API structure simple and consistent.

Final Thoughts

Authentication and permissions are fundamental parts of a secure Django REST Framework API.

The easiest way to remember them is:

Authentication → Who are you?

Permission → What can you do?

Object Permission → Can you access this specific object?

Start with DRF's built-in permissions such as AllowAny, IsAuthenticated, and IsAdminUser. As your application becomes more complex, you can introduce custom permissions, roles, and object-level authorization.

A simple permission system that is well designed is usually better than a complicated system that is difficult to maintain.

About Me

I'm Md. Nisan Hossain, a Backend Software Engineer focused on Python, Django, and Django REST Framework.

I enjoy building REST APIs, database-driven applications, authentication systems, and scalable backend solutions.

GitHub: nisan24

Portfolio: nisan24.vercel.app

If you're also learning Django or backend development, I hope this guide helps you build better APIs.

— Nisan Hossain | nisan24

DEV Community: Md. Nisan Hossain

Django REST Framework Authentication & Permissions: A Simple Guide

Django REST Framework Authentication & Permissions: A Simple Guide

Authentication vs Permissions

Setting Up Django REST Framework

Using IsAuthenticated

Public vs Private APIs

Using IsAdminUser

Creating a Custom Permission

Object-Level Permissions

Role-Based Access Control

A Common Mistake

Another Important Mistake

Simple DRF Permission Strategy

Best Practices

Final Thoughts

About Me

Using `IsAuthenticated`

Using `IsAdminUser`