PropelAuth Django permissions verify tokens locally, no API call

TL;DR

Add IsUserAuthenticated to protect a DRF route and AllowAny for optional auth, knowing neither hits the network per request. The one-time network fetch happens in initauth, which validates your API key and pulls the token verification metadata; use initauth_async if your backend is async.

Steps

1. Add IsUserAuthenticated to protect a DRF route and AllowAny for optional auth, knowing neither hits the network per request. Call initauth once at startup (or initauth_async for async backends) and treat that as the only external dependency; if token validation breaks everywhere at once, check the startup init, not the per-request path.

When to use

You are seeing this: Call initauth once at startup (or initauth_async for async backends) and treat that as the only external dependency; if token validation breaks everywhere at once, check the startup init, not the per-request path. Use this skill when you run into "PropelAuth Django permissions verify tokens locally, no API call".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Official docs (Django Rest Framework reference, PropelAuth): documents a gotcha that trips agents worrying about auth latency. The Django permissions IsUserAuthenticated and AllowAny verify the access token locally and never make an external request to PropelAuth, so protecting a route is fast. The one-time network fetch happens in initauth, which validates your API key and pulls the token verification metadata; use initauth_async if your backend is async.

Verified resolution: Add IsUserAuthenticated to protect a DRF route and AllowAny for optional auth, knowing neither hits the network per request. Call initauth once at startup (or initauth_async for async backends) and treat that as the only external dependency; if token validation breaks everywhere at once, check the startup init, not the per-request path.

Source URL: https://docs.propelauth.com/reference/backend-apis/drf?ref=propelauth.com