How do we disable an authentication scheme?

[tiholic]

I want to disable Session authentication scheme from schema and shown only Token Authentication

[tfranzel]

this is currently not supported

[drien]

For anyone coming through here, I had a need for this (an API with auth classes used only by internal clients and not relevant to external consumers) and hacked together a basic solution by subclassing drf_spectacular.openapi.AutoSchema and overriding the get_auth() method with a small change.

This library has been much better than the other drf openapi tools I've used in the past...if this is functionality you'd ever consider making part of the core library I'd be happy to work up a PR with tests/docs/etc.

from drf_spectacular.openapi import * # noqa


class EnumeratedAuthOnlyAutoSchema(AutoSchema):

    def get_auth(self):
        """
        Copy-pasted from parent class with a small change to allow enumerating the specific authentication classes we want to
        expose to users rather than everything we actually have enabled in the django rest framework config.
        """
        allowed_auths = set(settings.SPECTACULAR_SETTINGS.get('ALLOWED_AUTH_CLASSES', []))

        auths = []
        for authenticator in self.view.get_authenticators():
            if f'{authenticator.__module__}.{authenticator.__class__.__name__}' not in allowed_auths:
                continue
        ...

[tfranzel]

this is now supported 😄

[drien]

🎉 Thank you!