When should token be generated using oAuth
<p>I am striving to understand oAuth2 to implement in my REST API. I am using DRF in my backend and react native for building mobile app. I can create user registration and login in DRF but when and where should i actually create a token. Do i have to create token when user registers or when user logins ? I might get negative voting but i know some expert will enlighten me. </p>

<p>The usecase is i have a mobile app called foodie where user can create their account and login. User can login and create account from web too.</p>

<p>Where should i actually implement oAuth token in my code? </p>

<p><strong>serializers.py</strong></p>

<pre><code>class UserCreateSerializer(ModelSerializer):
    class Meta:
        model = User
        fields = [
            'username',
            'email',
            'first_name',
            'last_name',
            'password',
            'confirm_password'          
        ]
        extra_kwargs = {"password": {"write_only": True}}

    def create(self, validated_data):
        username = validated_data['username']
        first_name = validated_data['first_name']
        last_name = validated_data['last_name']
        email = validated_data['email']
        password = validated_data['password']
        confirm_password = validated_data['password']
        user_obj = User(
                username = username,
                first_name = first_name,
                last_name = last_name,
                email = email
            )
        user_obj.set_password(password)
        user_obj.save()
        return validated_data



class UserLoginSerializer(ModelSerializer):
    # token = CharField(allow_blank=True, read_only=True)
    username = CharField()
    class Meta:
        model = User
        fields = [
            'username',
            'password',
            # 'token',
        ]
        extra_kwargs = {"password":{"write_only": True}}
    def validate(self, data):
        return data
</code></pre>

<p><strong>views.py</strong></p>

<pre><code>class UserCreateAPI(CreateAPIView):
    serializer_class = UserCreateSerializer
    queryset = User.objects.all()
    permission_classes = [AllowAny]

class UserLoginAPI(APIView):
    permission_classes = [AllowAny]
    serializer_class = UserLoginSerializer

    def post(self, request, *args, **kwargs):
        # access_token = AccessToken.objects.get(token=request.data.get('token'), expires__gt=timezone.now())
        data = request.data
        serializer = UserLoginSerializer(data=data)
        if serializer.is_valid(raise_exception=True):
            new_data = serializer.data
            return Response(new_data, status=status.HTTP_200_OK)
        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
</code></pre>

<p>Probably, The question you should be asking is will a simple encrypted cookie not suffice which you pass to the server when you try to access the protected URLs/Resources. Now, If you want to still produce the token then after login hook the code to respond back with token in either header or in response payload. Once token is there, you pass the token in http header as Authorization: Bearer  to the resource server which processes the token and gives the access.</p>

python django python-3.x oauth django-rest-framework