APIs & frontends for Django in production

Set it up

Guides that take this from nothing to running in production.

• Deploy a Django REST Framework API to Production

  Prepare a Django REST Framework API for production: safe defaults, throttling, pagination, CORS, proxy headers, Gunicorn sizing, and API checks.

• Serve Django and a React SPA on the Same Domain

  Serve a React SPA and a Django API from one domain with Nginx: routing fallback, API proxying, cache headers, and CSRF-safe session auth.

• Deploy a Django GraphQL API to Production

  Prepare a Django GraphQL API (Strawberry or Graphene) for production: disable the IDE and introspection, limit depth and aliases, mask errors, batch queries, and log operations.

• Serve Django API and Admin on Separate Subdomains

  Serve one Django project on www, api, and admin subdomains: per-host URLconfs, host-only cookies, CORS and CSRF settings, Nginx server blocks, and restricting admin access by network.

• Handle Stripe Webhooks in Production Django

  Handle Stripe webhooks reliably in a production Django app: verify signatures with the raw body, exempt only the webhook view from CSRF, respond fast and process in Celery, make handlers idempotent with event IDs, and monitor failed deliveries.

• Deploy a Django API With a Next.js Frontend

  Deploy a Django REST or Ninja API with a separate Next.js frontend: same-domain routing versus subdomains, CORS and CSRF for cookie auth, server-side fetches from Next.js to Django, environment URLs, and where each part should be hosted.

• Deploy a Django Ninja API to Production

  Take a Django Ninja API to production: choose WSGI or ASGI for sync and async endpoints, lock down the interactive docs, configure authentication, CORS, throttling, and error handling, and validate schemas in CI.

Run it well

Tuning, reliability, and operations once it works.

• Speed Up Django REST Framework APIs

  Make Django REST Framework APIs faster in production: eliminate N+1 queries with select_related and prefetch_related, slim serializers, paginate everything, cache expensive endpoints, use values() for read-heavy lists, and measure with profiling.

• Configure Django REST Framework Throttling for Production

  Set up Django REST Framework throttling that works in production: shared Redis cache, AnonRateThrottle and UserRateThrottle defaults, ScopedRateThrottle per endpoint, correct client IPs behind proxies with NUM_PROXIES, Retry-After headers, and custom throttles per API key.

• Process Incoming Webhooks Reliably in Django

  Build reliable webhook endpoints in Django: verify signatures, store the raw event first, return 2xx quickly, process asynchronously with Celery, deduplicate by event ID, handle out-of-order delivery, and replay failed events safely.

• Speed Up Django JSON Responses With orjson

  Use orjson to make Django and Django REST Framework JSON serialization faster: an orjson renderer and parser for DRF, an ORJSONResponse for plain views, handling of datetimes, Decimals, and UUIDs, and when JSON encoding is actually your bottleneck.

• Use ETags and Conditional Requests in Django

  Cut bandwidth and server work with HTTP conditional requests in Django: ConditionalGetMiddleware, the condition, etag, and last_modified decorators, cheap ETag functions, 304 Not Modified responses for APIs, and how ETags interact with CDNs and compression.

• Rate Limit Django Views With django-ratelimit

  Add application-level rate limiting to Django views with django-ratelimit: protect login, signup, password reset, and search, key limits by IP, user, or field, use a shared Redis cache, get the real client IP behind proxies, and return helpful 429 responses.

Check it

Review lists to run before launch or after a change.

• Django REST API Production Checklist

  Review a Django REST API before production: authentication, permissions, throttling, pagination, validation, versioning, errors, CORS, docs, and observability.

• Django Mobile App Backend Production Checklist

  A production checklist for Django APIs serving iOS and Android apps: token auth with refresh and revocation, API versioning for old app versions, push notifications through Celery, rate limiting, upload handling, minimum supported versions, and monitoring per app version.

Fix it

Errors and symptoms, each traced to a cause and a fix.

• Fix CORS Errors with a Django API in Production

  Fix browser CORS errors calling a Django API: django-cors-headers setup, middleware order, preflight requests, credentials, and errors without CORS headers.

• Fix Django Authorization Header Missing Behind Apache, Nginx, or a Proxy

  Fix Django REST Framework returning authentication credentials were not provided because the Authorization header never reaches Django: enable WSGIPassAuthorization in mod_wsgi, check Nginx and load balancer header forwarding, and test with curl at each hop.

Related topics