Currently, ninja-api-key uses settings.PASSWORD_HASHERS
to hash and verify API keys. It couples API key hashing with Django's password authentication system.
There are scenarios where a developer may want to use a faster (but less secure) hasher only for API keys without weakening password security for user authentication.
Proposal: Introduce support for a separate setting: API_KEY_HASHERS
. When defined, ninja-api-key should use settings.API_KEY_HASHERS
; if not defined, it falls back to settings.PASSWORD_HASHERS
to maintain current behavior and backward compatibility.