DjangoAuthTagger

A helper that turns an anonymous caller away before anything lets it through: if not request.user.is_authenticated: return False.

Whatever an anonymous request.user fails: AnonymousUser is never authenticated, active, staff or superuser, and holds no permissions.

key = self.get_key(request) (or request.headers.get(...)), then if not key: return False at the same level (not under a verb or other branch), or a top-level return request.headers.get("X-Api-Key") == settings.KEY, with no truthy return before it but one under a plain SAFE_METHODS test (only reached for safe verbs) or a return True a setting gates (the caller notes the setting): the class turns away a caller who brings no credential (Read the Docs' HasBuildAPIKey). The variable or compared field must name a credential, or the value it is compared to be a setting or the environment: anyone can send X-Requested-With: XMLHttpRequest, and a debug = request.GET.get("debug") flag decides nothing.

Django spells the refusal of an anonymous caller its own way too: the 403 response class, a 401/403 status, PermissionDenied, or the login redirect.

djangorestframework-api-key's HasAPIKey / BaseHasAPIKey refuse a request without a valid key. A project class of the same name is judged by its own definition instead.

DRF permissions that demand an authenticated caller for every method, and the ...OrReadOnly ones that only do for unsafe methods.

A DRF view: APIView / GenericAPIView / ListCreateAPIView / any ViewSet. Only these read permission_classes.

Whether permission class name refuses an anonymous caller method, as permissions_refusal reports it. A project class is judged by its has_permission (or, when that hands on to super(), its bases'), and a DjangoModelPermissions subclass by the authenticated_users_only it sets: False lets anonymous through, a setting makes it conditional.

A framework view whose dispatch serves the request without calling super() (Django's View and its generic views, DRF's APIView and viewsets): classes after it in the MRO never see the request.

Django 5.1's LoginRequiredMiddleware makes every view login-only; these opt out. The built-in login and password-reset views (and subclasses) are marked login_not_required by Django itself.

Refusing an anonymous caller by sending it to the login page.

@method_decorator(login_required) on a method, or @method_decorator([never_cache, login_required], name="dispatch") on the class. Its argument runs to the next decorator.

AccessMixin.handle_no_permission sends the caller to the login page or raises PermissionDenied.

Test settings and docs configure throwaway projects.

A statement that writes before the check runs, so an anonymous caller gets it done even though the response is refused.

The per-endpoint shape: look at each endpoint, tag in place, hand the array back. Taggers declare only check_endpoint; those that need a pass over the whole set first (a project pre-scan, mcp's legacy prefixes) override perform and call super or loop themselves.