So what is tokin authentication?
Basically, what token authentication is, is let's say that I as a user, Nick, want to use the zappy
code API rather than sending my username and password every time, which we talked about before.
You could be exposed if it's not over HDD.
Yes, but even if it is, it's, you know, maybe not going to be stored in the exact right place inside
of somebodies app rather than that.
What we can do is I can make a quote unquote log in.
You are Reller.
Maybe we should call it the token generator, whatever it is.
But at one time the user can pass via the API, their username and password, and they get back from
the server, a token, which is just a random string of letters and numbers.
It's not exactly random, but it's a specific string of letters and numbers assigned to that user that
says any time someone wants to interact with the API, if they give us a token, we'll take that token
lookup who it belongs to, and then we will do things in behalf of that particular user, in my opinion.
It's a much better way to roll, because if, you know, some hacker somehow finds that token, yes,
they could do things for that user in their behalf.
But then you, as the owner of the Django project, you could, you know, shut down that particular
token if you realize that it's been stolen.
But, you know, a token gets the user at a hacker access to an API.
It does not give them that user's password, which if that user has used that same password for maybe
their email or other services, could really get into a tricky situation.
So in my opinion, this is just the better way to work with API authentication.
So a def for me blabbing about this, let's talk about how we can appellee actually implement this to
the project.
So let's go to our settings K and let's go ahead and scroll down to our installed apps.
We are adding yet another.
So copy the rest framework and just to add after rest framework.
Dot, auth, token.
OK.
So we're gonna go ahead and save the settings file with this.
This does add a new item into our database and that's basically a place to store these tokens.
So let's go ahead and go to our terminal.
Let's go to the tab where our server is running and you'll notice.
Hey, look, you have some migration's you've got to do so.
We're going to do a control C to stop the server.
And then I'm gonna say that I want to migrate.
OK.
Does those migrations for me and I'm gonna go back to running the server.
And in fact, so that you'll be able to see what this looks like.
Let's go ahead and create a super user.
So I'm going to do managed a pie.
Create super user.
And I'm going to make a user name of admen.
And we don't need an email.
We'll do our classic password.
That's very common.
Yes, that's OK.
So now we have the super user, so on the admin side, we can go see what one of these token looks like.
OK.
So we've got that.
Let's go back to running the server here.
Awesome.
OK, let's go to our settings dot py file.
We have to add a little bit more here.
So we're going to do an all caps rest underscore framework.
OK.
And we're going to say that this is equal to curly brackets and inside the curly brackets here.
We're gonna tab over.
Let's do a string that.
Stay with me.
We're gonna do a bit of typing here.
We want all caps.
Default.
Underscore authentication, underscore classes.
And then we are going to do a colon and then inside of these or for that, we are going to do a list
here.
But we're only providing one object.
And inside of here it is reste underscore framework, dot authentication, dot capital tokin authentication.
Just like that.
And we'll do our trailing comma.
So basically this says the default for any of these, you know, calls here.
We want to use token authentication to make sure that this is an actual user.
If someone's going to require, for example, if you go to our views here, anywhere that we say that
we want to make sure that someone is authenticated, it's going to be using the token authentication,
which is perfect for us.
Okay, so now that we have this in place, it would be great when someone signs up that we actually
go ahead and pass them a token rather than just this random one that I created here would be great to
do the real one.
Right.
So what we need to do is import the code for our token.
So we're gonna go ahead and scroll up a little bit here.
We're going to do from and we want to do reste underscore framework.
Dot Earth Tolkin dot models.
And then we want to import Capital Tolkan.
So once we have that in place, after we've saved our particular user, let's go ahead and create a
token object by saying token is equal to capital token.
And this is where we want to do dot objects, dot create.
And we just want to say that the user object is equal to that user that we just created here.
So this will do all the work for us of, you know, properly saving this forest, whatnot.
And with this token, we can pass it back via the API and we just have to convert it to a string.
So we're going to s tr token just like that.
So really, that's all that we'd need in order to generate these tokens and assign them to a particular
user.
So are going to go ahead and save what we have here.
All right.
And let's go ahead and go back to our terminal and let's go make a new user.
So let's go ahead and add a completely new user, like let's do Nick six, for example, and look at
that.
When we say token, we get back this really long string of letters and numbers.
And if we go, I think this is what makes this really cool.
If we go check out the admin side of our projects are going to do local host slash admen.
And I have to log in as an admen user.
Is that password that we created?
Right.
This is the one that we did.
Remember, we did create super user.
And we did the password and all that good stuff.
Right.
If we look now, we have these tokens here.
And if we look at that look, there's that big long token and we see that this belongs to this user.
So this is all that stored inside of the database.
The token or the key, whatever you want to call it here.
What user it belongs to in when it was created.
That's it.
That's everything that's stored for this particular token thing.
It's very simple, but it's very powerful because someone can pass us this random string of letters,
numbers, and we know that it's connected with Nick six, like it has to be connected with them.
So let's go ahead and test and see if we can get this working in the next lecture.