Authentication

Passwords

Storing a password means storing something an attacker can't reverse even with your whole database in hand. Rustango gives you that in two calls — hash on…

Sessions

A session keeps a user logged in across requests by handing the browser an opaque ID in a cookie and keeping everything else server-side. Rustango's…

Auth backends

An auth backend answers one question: given an incoming request, who is the user? Rustango lets you stack several — HTTP Basic, API key, JWT — into a…

Access decorators

Once a user is authenticated, you gate routes. Rustango ships Django's @loginrequired family as composable axum layers: attach one to a router and…

JWT (standalone)

A JSON Web Token is a stateless credential: a signed, self-contained string the client sends on every request, that your server verifies with a secret —…

JWT auth API

The standalone JWT module signs and verifies one token. A real API needs the whole lifecycle: a short-lived access token, a long-lived refresh token…

API keys

An API key is a long-lived credential for machines — CI jobs, scripts, server-to-server calls — that can't present a login form or carry a session cookie…

HMAC request signing

HMAC signing proves both who sent a request and that it wasn't altered in flight. The client signs each request with a shared secret; the server…

Account flows (reset, verify, magic link)

The flows every app needs around the edges of login: password reset, email verification, and magic-link (passwordless) login. All three are the same shape…

SSO (OpenID Connect / social login)

Sign in with an external identity provider — Google, Microsoft / Azure AD, GitHub, GitLab, Discord, or any OpenID Connect provider (Okta, Auth0, Keycloak…