How to set up React-only API?

Question

Django

Good afternoon.

I am writing my own Django-React application. React makes requests - Django returns information. It seems to be simple.

But I want only React and only React to be able to make API requests. Read about Token/rest_framework.authentication.

But all examples come down to logging in the user and creating a Token for him.

How do I create a Token, just for a React app, and then secure the View?

Answer 1

It is impossible to protect the backend - one way or another you give the client application all the necessary data to send requests, and if a person really needs it, he can easily repeat any scheme.