Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/rahul-baberwal/django-var-cms/llms.txt

Use this file to discover all available pages before exploring further.

django-var-cms ships a complete, self-contained authentication layer for its control panel. Every route — login, OTP verification, forgot-password, and password reset — is rendered inside the same glassmorphic dark-mode shell as the rest of the panel, so your team never leaves the CMS experience to manage their credentials.

​
Login Interface

The custom login page is available at /var-cms/login/ the moment you mount the URLs. Point Django’s built-in LOGIN_URL setting at it so unauthenticated requests are redirected there automatically. 
# settings.py
LOGIN_URL = "/var-cms/login/"
LOGIN_REDIRECT_URL = "/var-cms/"
The view uses Django’s AuthenticationForm to validate credentials. On success it redirects to the dashboard index (var_cms_index). If the user is already authenticated, visiting /var-cms/login/ redirects straight to the dashboard — no double-login prompt.

​
Optional OTP Two-Factor Authentication

By default, a correct username/password immediately logs the user in. When you enable OTP 2FA, a successful credential check instead sends a 6-digit one-time code to the user’s email address and redirects to the verification screen at /var-cms/otp-verify/. The user must enter the correct code to complete the login. Session keys used during the OTP flow: var_cms_pre_otp_user_id (authenticated user’s ID) and var_cms_otp (the 6-digit code). Both keys are removed from the session once the user successfully verifies.
1

Enable OTP in settings.py

# settings.py
VAR_CMS_ENABLE_OTP = True
2

Configure Django's email backend

# settings.py
EMAIL_BACKEND = "django.core.mail.backends.smtp.EmailBackend"
EMAIL_HOST = "smtp.example.com"
EMAIL_PORT = 587
EMAIL_USE_TLS = True
EMAIL_HOST_USER = "noreply@example.com"
EMAIL_HOST_PASSWORD = "your-smtp-password"
3

(Optional) Set via var_cms_site directly

You can also toggle OTP programmatically in var_cms_admin.py, which overrides the settings value at startup:
# myapp/var_cms_admin.py
from var_cms.registry import var_cms_site

var_cms_site.enable_otp = True
Development tip — no SMTP required. If email sending fails (e.g. SMTP is not configured), the library falls back gracefully and prints the OTP directly to your terminal:
[VAR CMS OTP]: 847291 for user admin
This means you are never locked out during local development even without a working mail server.
VAR_CMS_ENABLE_OTP defaults to False. OTP is entirely opt-in — you only need email configured if you enable it.
OTP codes are stored in Django’s session framework (request.session). Make sure SESSION_ENGINE and your session middleware are properly configured before enabling OTP in production. The default database-backed session engine works out of the box.

​
Forgot Password Flow

A Forgot Password link on the login screen lets users recover access without admin intervention. The flow lives at /var-cms/forgot-password/.
1

Enter username or email

The user submits their Django USERNAME_FIELD value or email address. The view queries both fields (when the model has an email field and USERNAME_FIELD is not email), so either works.
2

Receive a reset OTP

A 6-digit reset code is emailed to the account’s registered email address. If the matched user has no email address set, the view returns the error: “This user does not have an email address configured.”As with the login OTP, if SMTP is unavailable the code is printed to the terminal:
[VAR CMS RESET OTP]: 384729 for user admin
The session stores the reset code as var_cms_reset_otp and the user’s ID as var_cms_reset_user_id, then redirects to /var-cms/forgot-password/verify/.
3

Set a new password

The user enters the OTP plus their new password (confirmed twice). New passwords must be at least 6 characters. On success the session keys are cleared and the user is redirected to the login page.
If the matched user account has no email address configured in Django, the view displays the error: “This user does not have an email address configured.” Make sure every staff account has an email set in Django admin or your user management interface.

​
In-Dashboard Password Reset

Logged-in users can update their own password without leaving the control panel. The change-password form is at /var-cms/change-password/ and is accessible via the User Profile Badge → Reset Password menu item. The form enforces three rules before saving:
RuleBehaviour
Old password must be correctShows “Current password is incorrect.”
New password must match confirmationShows “New passwords do not match.”
New password must be ≥ 6 charactersShows “New password must be at least 6 characters.”
After a successful change, update_session_auth_hash is called automatically — the user stays logged in without needing to re-authenticate.

​
Logout

Visiting /var-cms/logout/ (or clicking Logout in the user menu) clears the Django session and redirects the browser back to /var-cms/login/.

​
Quick-Reference Settings

# settings.py

# ── Authentication routing ─────────────────────────────────────────────────
LOGIN_URL = "/var-cms/login/"
LOGIN_REDIRECT_URL = "/var-cms/"

# ── Optional OTP 2FA ──────────────────────────────────────────────────────
VAR_CMS_ENABLE_OTP = True   # default: False

# ── Email backend (required when OTP is enabled) ──────────────────────────
EMAIL_BACKEND = "django.core.mail.backends.smtp.EmailBackend"
EMAIL_HOST = "smtp.example.com"
EMAIL_PORT = 587
EMAIL_USE_TLS = True
EMAIL_HOST_USER = "noreply@example.com"
EMAIL_HOST_PASSWORD = "your-smtp-password"

​
URL Reference

URLDescription
/var-cms/login/Glassmorphic login form (uses AuthenticationForm; redirects to dashboard on success)
/var-cms/otp-verify/OTP entry screen (only reached after valid credentials when OTP is enabled)
/var-cms/forgot-password/Enter username or email to start password recovery
/var-cms/forgot-password/verify/Enter reset OTP and choose a new password
/var-cms/change-password/In-dashboard password reset (requires login)
/var-cms/logout/Clears session, redirects to login

Build docs developers (and LLMs) love

Get started for freeTalk to us