# Session Tokens

## Introduction

When using allauth headless in non-browser contexts, such as mobile apps, a session token is used to keep track of the authentication state. This session token is handed over by the app by providing the `X-Session-Token` request header.

If you do not have any requirements that prescribe a specific token strategy, the simplest way forward is to use the `X-Session-Token` authentication mechanism for your own APIs as well. In order to do so, integration with Django Ninja and Django REST framework is offered out of the box.

## Securing Your API Endpoints

### Django Ninja

For Django Ninja, the following security class is available:

class allauth.headless.contrib.ninja.security.XSessionTokenAuth

  This security class uses the X-Session-Token that django-allauth is using for authentication purposes.

  get_session_token(request: HttpRequest) → str | None

    Returns the session token for the given request, by looking up the `X-Session-Token` header. Override this if you want to extract the token from e.g. the `Authorization` header.

An example on how to use that security class in your own code is listed below:

    from allauth.headless.contrib.ninja.security import x_session_token_auth
    from ninja import NinjaAPI

    api = NinjaAPI()

    @api.get("/your/own/api", auth=[x_session_token_auth])
    def your_own_api(request):
        ...

### Django REST framework

For Django REST framework, the following authentication class is available:

class allauth.headless.contrib.rest_framework.authentication.XSessionTokenAuthentication

  This authentication class uses the X-Session-Token that django-allauth is using for authentication purposes.

  authenticate(request: HttpRequest)

    Authenticate the request and return a two-tuple of (user, token).

  get_session_token(request: HttpRequest) → str | None

    Returns the session token for the given request, by looking up the `X-Session-Token` header. Override this if you want to extract the token from e.g. the `Authorization` header.

An example on how to use that authentication class in your own code is listed below:

    from allauth.headless.contrib.rest_framework.authentication import (
        XSessionTokenAuthentication,
    )
    from rest_framework import permissions
    from rest_framework.views import APIView

    class YourOwnAPIView(APIView):

        authentication_classes = [
            XSessionTokenAuthentication,
        ]
        permission_classes = [permissions.IsAuthenticated]

        def get(self, request):
            ...