---
updatedAt: 2026-10-13T18:57:45.000Z
agentTools:
  projectIndex: https://docs.wristband.dev/llms.txt
---

# Install Auth SDK

Learn how to configure the Wristband SDK for your Django application.

## Installation

Install Wristband's <Anchor target="_blank" href="https://github.com/wristband-dev/django-auth">Django Auth SDK</Anchor> using your preferred package manager:

```shell pip
pip install wristband-django-auth
```
```shell poetry
poetry add wristband-django-auth
```
```shell pipenv
pipenv install wristband-django-auth
```

***

## Configuration

### Prerequisites

Before you can configure the SDK, you'll need to make sure you have the following values:

* WRISTBAND\_APPLICATION\_VANITY\_DOMAIN
* WRISTBAND\_CLIENT\_ID
* WRISTBAND\_CLIENT\_SECRET

If you went through the [Set Up a Wristband Application](https://docs.wristband.dev/docs/quick-start-create-a-wristband-application) guide, you should have been presented with these three values after the application was provisioned. If you don't have the above values on hand, you can retrieve them from the Wristband dashboard by following the steps in this [guide](https://docs.wristband.dev/docs/quick-start-create-a-wristband-application#manually-retrieving-sdk-configuration-values).

### Configure Wristband Settings

Add your Wristband auth configuration to your Django settings file (`src/your_project/settings.py`):

<Callout icon="far fa-circle-info" theme="info">
  ### Disabling Secure Cookies in Local Development

  By default, the SDK creates secure cookies (for tracking login state), meaning they are only sent over HTTPS connections. Most browsers make an exception for `localhost` and allow secure cookies to be sent over HTTP (e.g., `http://localhost`). However, some browsers, such as Safari, enforce stricter rules and never send secure cookies over HTTP, even for `localhost`.

  If you need to disable the secure cookies for local development, set `"dangerously_disable_secure_cookies": True`. However, be sure to re-enable secure cookies before deploying to production.
</Callout>

```python Wristband Auth Settings With Secure Cookies
# your_project/settings.py

# ...your other settings...

WRISTBAND_AUTH = {
    "client_id": "<WRISTBAND_CLIENT_ID>",
    "client_secret": "<WRISTBAND_CLIENT_SECRET>",
    "wristband_application_vanity_domain": "<WRISTBAND_APPLICATION_VANITY_DOMAIN>"
}
```
```python Wristband Auth Settings With Secure Cookies
# your_project/settings.py

# ...your other settings...

WRISTBAND_AUTH = {
    "client_id": "<WRISTBAND_CLIENT_ID>",
    "client_secret": "<WRISTBAND_CLIENT_SECRET>",
    "wristband_application_vanity_domain": "<WRISTBAND_APPLICATION_VANITY_DOMAIN>",
    "dangerously_disable_secure_cookies": True
}
```

### Initialize The SDK

Create an instance of `WristbandAuth` in a dedicated module within your Django app (e.g., `src/your_app/wristband.py`). Update the `AuthConfig` properties with the values from your settings:

```python Wristband Auth Config
# your_app/wristband.py

from django.conf import settings
from wristband.django_auth import AuthConfig, WristbandAuth

# Initialize Wristband SDK
wristband_auth = WristbandAuth(AuthConfig(**settings.WRISTBAND_AUTH))

__all__ = ['wristband_auth']
```

### Add Session Auth Decorator

You'll also need to create an auth decorator to verify that incoming requests have a valid authenticated session. You can do this using the `wristband_auth.create_auth_decorator()` factory method. Later, you'll use this decorator to protect views that require authentication.

After adding the auth decorator, the file should look like the following:

```python Create Auth Decorator
# your_app/wristband.py

from django.conf import settings
from wristband.django_auth import (
    AuthConfig,
    AuthStrategy,
    UnauthenticatedBehavior,
    WristbandAuth,
)

wristband_auth = WristbandAuth(AuthConfig(**settings.WRISTBAND_AUTH))

# NEW: Create require_session auth decorator
require_session = wristband_auth.create_auth_decorator(
    strategies=[AuthStrategy.SESSION],
    on_unauthenticated=UnauthenticatedBehavior.REDIRECT,
)

__all__ = ['wristband_auth', 'require_session'] # <-- UPDATE: Add 'require_session'
```

<br />

<HTMLBlock>{`
<style>
.UpdatedAt {
  display: none;
}
</style>
`}</HTMLBlock>