A Django app to support phone number verification using the security code sent via SMS.
- Let's devs verify phone numbers via SMS.
- Extensibility to provide tokens with varying lengths.
- Comes with Twilio already integrated.
- Set expiration time on tokens.
- Provides an interface for writing custom SMS sending backend for easy extensibility.
- Does not mess up with existing
AUTH_USER_MODEL
at all. - Can be used for several potential use-cases, and not just auth.
- Provides ready endpoints for sending SMS and verification (See api_endpoints.rst).
pip install django-phone-verify
- Add app to INSTALLED_APPS
# In settings.py:
# Add app to `INSTALLED_APPS`
INSTALLED_APPS = [
...
"phone_verify",
]
- Add settings for Phone Verify as you desire:
# In settings.py
# Add settings for phone_verify to work
PHONE_VERIFICATION = {
"BACKEND": "phone_verify.backends.twilio.TwilioBackend",
"OPTIONS": {
"SID": "fake",
"SECRET": "fake",
"FROM": "+14755292729",
"SANDBOX_TOKEN": "123456",
},
"TOKEN_LENGTH": 6,
"MESSAGE": "Welcome to {app}! Please use security code {security_code} to proceed.",
"APP_NAME": "Phone Verify",
"SECURITY_CODE_EXPIRATION_TIME": 3600, # In seconds only
"VERIFY_SECURITY_CODE_ONLY_ONCE": False, # If False, then a security code can be used multiple times for verification
}
- To explore more about how to use, integrate and leverage the existing functionality of
Django Phone Verify
, have a look at usage.rst
Note: Django Phone Verify
also provides Nexmo
as a backend service other than Twilio
. To switch to Nexmo
, replace BACKEND
within your PHONE_VERIFICATION
setting with phone_verify.backends.nexmo.NexmoBackend
and define KEY
within OPTIONS
of PHONE_VERIFICATION
setting, with your Nexmo API key, in place of already available SID
.
- Python 3.6+
- Django 2.1+
- Django REST Framework 3.9+
No code is bug-free and I'm sure this app will have bugs. If you find any bugs, please create an issue on GitHub.
GPLv3
- Support for Django 4.x.
- Support for Django 3.2.
- Method
phone_verify.backends.nexmo.NexmoBackend.send_sms
changes parameter name fromnumbers
tonumber
to be consistent with rest of the inherited classes.
- Support for Python 3.8 & Python 3.9.
- CI tests for Py{36,37,38,39}-Django{20,21,22,30,31}.
- Fixed issue
generate_session_token
to handle cases in Py38, Py39 when thesession_token
is alreadystring
instead ofbytes
.
NOTE: The previous version of this library provided the security_code
in the JWT session_token
. You would have to re-verify phone_numbers
in this version to ensure they are authentically verified.
- Tests added to provide 100% coverage on the package.
- Add
nexmo.errors.ClientError
as exception class inphone_verify.backends.nexmo.NexmoBackend
&phone_verify.backends.nexmo.NexmoSandboxBackend
.
- Method signature changed for
phone_verify.backends.BaseBackend.generate_session_token
. It now accepts onlyphone_number
instead of combination ofphone_number
andsecurity_code
. - Remove the
security_code
from JWTsession_token
to avoid leaking information. - Add nonce in
session_token
to generate unique tokens for eachphone_number
. - Fixes call to
phone_verify.backends.nexmo.NexmoBackend.send_sms
method.
- Support
Nexmo
as a backend service along withTwilio
. - Add docs for writing a custom backend.
- Update
backends.base.BaseBackend.validate_security_code
to usesave()
instead ofupdate()
to allow Django to emit itspost_save()
signal.
- Add coverage report through
coveralls
. - Support for One-Time Passwords (OTP) using
VERIFY_SECURITY_CODE_ONLY_ONCE
asTrue
in the settings. - Script to support makemigrations for development.
BaseBackend
status now haveSECURITY_CODE_VERIFIED
andSESSION_TOKEN_INVALID
status to support new states.
- Rename
TWILIO_SANDBOX_TOKEN
toSANDBOX_TOKEN
. - Fix signature for
send_bulk_sms
method inTwilioBackend
andTwilioSandboxBackend
. - Response for
/api/phone/register
contains keysession_token
instead ofsession_code
. - Request payload for
/api/phone/verify
now expectssession_token
key instead ofsession_code
. - Response for
/api/phone/verify
now sends additional response ofSecurity code is already verified
in caseVERIFY_SECURITY_CODE_ONLY_ONCE
is set toTrue
. - Rename
otp
tosecurity_code
in code and docs to be more consistent. - Rename
BaseBackend
status fromVALID
,INVALID
,EXPIRED
toSECURITY_CODE_VALID
,SECURITY_CODE_INVALID
, andSECURITY_CODE_EXPIRED
respectively. - Rename
session_code
tosession_token
to be consistent in code and naming across the app. - Rename service
send_otp_and_generate_session_code
tosend_security_code_and_generate_session_token
. - Rename method
BaseBackend.generate_token
toBaseBackend.generate_security_code
. - Rename method
create_otp_and_session_token
tocreate_security_code_and_session_token
. - Rename method
BaseBackend.validate_token
toBaseBackend.validate_security_code
with an additional parameter ofsession_token
.
pre-commit-config
to maintain code quality using black and other useful tools.- Docs for integration and usage in usage.rst.
- Tox for testing on py{37}-django{20,21,22}.
- Travis CI for testing builds.
- Convert
*.md
docs to reST Markup. - Fix issue with installing required package dependencies via
install_requires
.
- README and documentation of API endpoints.
setup.cfg
to manage coverage.phone_verify
app including backends, requirements, tests.- Initial app setup.