> ## Documentation Index > Fetch the complete documentation index at: https://mintlify.com/pennersr/django-allauth/llms.txt > Use this file to discover all available pages before exploring further. # Overview > Understanding django-allauth's architecture and core concepts ## What is django-allauth? django-allauth is a comprehensive, integrated authentication solution for Django applications. It provides a complete authentication framework that handles regular accounts (username/email + password) as well as social authentication from providers like Google, GitHub, and dozens of others. django-allauth is designed to be **secure by default**, with built-in protections against enumeration attacks, rate limiting, and comprehensive email verification flows. ## Core Features Complete user registration, login, password reset, and email management Flexible email verification with both link-based and code-based flows Pre-built integrations with 50+ OAuth providers Built-in rate limiting to protect against brute force and abuse ## Architecture django-allauth follows a modular architecture with clear separation of concerns: ```mermaid theme={null} graph TB A[Views] --> B[Forms] B --> C[Adapter] C --> D[Models] A --> E[Flows] E --> C E --> D F[Stages] --> E G[Signals] -.-> E style A fill:#e1f5ff style B fill:#fff4e6 style C fill:#e8f5e9 style D fill:#fce4ec style E fill:#f3e5f5 ``` ### Key Components Handle HTTP request/response cycle for authentication actions. Each view corresponds to a user-facing action like login, signup, or email verification. ```python theme={null} # Example: Login view from allauth.account.views import LoginView urlpatterns = [ path('accounts/login/', LoginView.as_view(), name='account_login'), ] ``` Validate and clean user input. Forms are customizable through the `ACCOUNT_FORMS` setting. ```python theme={null} # settings.py ACCOUNT_FORMS = { 'login': 'myapp.forms.CustomLoginForm', 'signup': 'myapp.forms.CustomSignupForm', } ``` The adapter pattern allows you to customize core behaviors without modifying allauth code. Override adapter methods to tailor functionality to your needs. ```python theme={null} from allauth.account.adapter import DefaultAccountAdapter class MyAccountAdapter(DefaultAccountAdapter): def is_open_for_signup(self, request): # Close signups during maintenance return not request.site.is_in_maintenance_mode() ``` Core data models including `EmailAddress` for managing multiple email addresses per user, and `EmailConfirmation` for verification tokens. ```python theme={null} from allauth.account.models import EmailAddress # Check if user's email is verified email = EmailAddress.objects.get_primary(user) if email and email.verified: print("Email is verified!") ``` Internal orchestration logic that coordinates between different components. Flows handle complex multi-step processes like signup with email verification. Login stages allow for multi-step login processes. Examples include email verification stage, MFA stage, and password reset stage. Django signals are dispatched at key points allowing you to hook into authentication events. ```python theme={null} from allauth.account.signals import user_signed_up from django.dispatch import receiver @receiver(user_signed_up) def on_user_signup(request, user, **kwargs): # Send welcome email, create profile, etc. send_welcome_email(user) ``` ## Authentication Methods django-allauth supports multiple authentication methods that can be configured independently: Traditional authentication using a username and password. ```python theme={null} # settings.py ACCOUNT_LOGIN_METHODS = {"username"} ACCOUNT_SIGNUP_FIELDS = ['username*', 'password1*', 'password2*'] ``` Modern approach using email address as the primary identifier. ```python theme={null} # settings.py ACCOUNT_LOGIN_METHODS = {"email"} ACCOUNT_SIGNUP_FIELDS = ['email*', 'password1*', 'password2*'] ACCOUNT_EMAIL_VERIFICATION = "mandatory" ``` Flexible approach allowing users to log in with either. ```python theme={null} # settings.py ACCOUNT_LOGIN_METHODS = {"email", "username"} ACCOUNT_SIGNUP_FIELDS = ['username*', 'email*', 'password1*', 'password2*'] ``` Passwordless authentication via one-time codes sent to email. ```python theme={null} # settings.py ACCOUNT_LOGIN_BY_CODE_ENABLED = True ACCOUNT_LOGIN_BY_CODE_TIMEOUT = 180 # 3 minutes ACCOUNT_LOGIN_BY_CODE_MAX_ATTEMPTS = 3 ``` ## Configuration Philosophy django-allauth is designed to be **secure and usable by default**. Key configuration principles: Rate limiting, enumeration prevention, and email verification are enabled by default to protect your application and users. Start with sensible defaults and customize only what you need. Most apps can get started with minimal configuration. Use the adapter pattern instead of forking code. Override specific methods to change behavior while maintaining compatibility with updates. ## Common Configuration Patterns ### Basic Email-Based Authentication ```python theme={null} # settings.py INSTALLED_APPS = [ # ... 'django.contrib.sites', 'allauth', 'allauth.account', ] SITE_ID = 1 # Authentication methods ACCOUNT_LOGIN_METHODS = {"email"} ACCOUNT_EMAIL_REQUIRED = True ACCOUNT_USERNAME_REQUIRED = False # Email verification ACCOUNT_EMAIL_VERIFICATION = "mandatory" ACCOUNT_EMAIL_CONFIRMATION_EXPIRE_DAYS = 3 # Security ACCOUNT_PREVENT_ENUMERATION = True ACCOUNT_RATE_LIMITS = { "login_failed": "5/5m/key", "signup": "20/m/ip", } ``` ### Username-Based with Optional Email ```python theme={null} # settings.py ACCOUNT_LOGIN_METHODS = {"username"} ACCOUNT_SIGNUP_FIELDS = ['username*', 'email', 'password1*', 'password2*'] ACCOUNT_EMAIL_VERIFICATION = "optional" ACCOUNT_USERNAME_MIN_LENGTH = 3 ACCOUNT_USERNAME_BLACKLIST = ['admin', 'root', 'system'] ``` ## Email Verification Methods Users cannot log in until email is verified. Most secure option. ```python theme={null} ACCOUNT_EMAIL_VERIFICATION = "mandatory" ``` Verification email sent but login allowed. Balances security and UX. ```python theme={null} ACCOUNT_EMAIL_VERIFICATION = "optional" ``` No verification emails sent. Use only for testing or closed systems. ```python theme={null} ACCOUNT_EMAIL_VERIFICATION = "none" ``` ## Request Lifecycle Understanding how an authentication request flows through allauth: ```mermaid theme={null} sequenceDiagram participant User participant View participant Form participant Adapter participant Flow participant Model User->>View: POST login credentials View->>Form: Validate input Form->>Adapter: Authenticate user Adapter->>Model: Query database Model-->>Adapter: User object Adapter->>Flow: Perform login Flow->>Flow: Check stages (MFA, email verify) Flow-->>View: HTTP Response View-->>User: Redirect to next page ``` Each step in this flow can be customized through settings, adapter methods, or by connecting to signals. ## Model Relationships ```mermaid theme={null} erDiagram User ||--o{ EmailAddress : has EmailAddress ||--o{ EmailConfirmation : "verified by" User ||--o{ Login : performs User { int id string username string email string password } EmailAddress { int id int user_id string email bool verified bool primary } EmailConfirmation { int id int email_address_id string key datetime created datetime sent } Login { string state int user_id string email bool signup } ``` ## Security Features Prevents attackers from discovering which email addresses are registered by giving identical responses for existing and non-existing accounts. Protects against brute force attacks with configurable rate limits per IP, user, and custom keys. Email verification uses stateless HMAC tokens instead of database records, improving security and scalability. Configurable session duration and "Remember Me" functionality with secure cookie settings. ## Next Steps Learn about user registration, profile management, and email handling Understand login, signup, and password reset processes Deep dive into email verification strategies and configuration Configure rate limits to protect your application ## Key Takeaways django-allauth provides a complete, secure authentication solution out of the box The adapter pattern allows deep customization without forking code Multiple authentication methods can coexist in the same application Security features like rate limiting and enumeration prevention are enabled by default Flows and stages orchestrate complex multi-step authentication processes