DRF Authentication & Permissions

DRF authentication identifies the API caller (via token, session, or JWT), and permission classes decide whether that caller may perform the request.