How to create a user without being authenticated/signed in as admin?

[casper-hansen]

First Check

• I added a very descriptive title here.
• I used the GitHub search to find a similar question and didn't find it.
• I searched in the documentation/README.
• I already searched in Google "How to do X" and didn't find any information.
• I already read and followed all the tutorial in the docs/README and didn't find an answer.

Commit to Help

• I commit to help with one of those options 👆

Example Code

curl -X 'POST' \
  'http://127.0.0.1:8000/api/v1/users/' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "email": "test@test.com",
  "is_active": true,
  "is_superuser": false,
  "full_name": "Casper",
  "password": "test1234"
}'

Description

I have tried to use the backend API to create a user. How do you create a user without being authenticated as an admin?

Operating System

Linux, macOS

Operating System Details

Running locally on macOS or Linux has been tried.

Python Version

Python 3.10.13

Additional Context

No response

[DaveCLowe]

By design, you can't. Only superusers can create new users.

[casper-hansen]

That is what I understood as well. My question is more about how we can modify the code to allow this? It seems everything is gated by an auth token, so calling any of the endpoints will give a 401 Unauthorized

[PhilippWu]

Maybe you want that a new User can Register by hisself?

For that i would recommend you to build new Endpoints with the Logic to Register as new User. Including Email approvement etc.

The current Endpoints are not for User Self Registration so it makes sense that only Superuser can create new Users.

[casper-hansen]

Yes, I want the users to register their own accounts. Are there any recommended way of implementing a signup for users that is still secure enough?

[alejsdev]

Hi there! while the frontend doesn't currently support this feature, we've already implemented the backend endpoint register_user. To enable user registration, simply set USERS_OPEN_REGISTRATION to True in the .env file. After making this change, remember to restart the Docker containers using docker-compose up -d to apply the new environment variables.

[casper-hansen]

That sounds great. How do you protect this endpoint against potential abuse/spam?

[alejsdev]

Hmm, that depends more on the specific application, but having email verification may help because this would require users to verify their email addresses before allowing full access to the app

[alejsdev]

I will update the docs to include this 😄
#1191