Django DRF创建Razorpay订单时出现401认证凭证未提供错误

在Django DRF中编写创建Razorpay订单的视图时，尽管Razorpay的KeyId和KeySecret正确（在Razorpay全局API中可正常使用），但调用接口时持续收到401错误，返回内容为{"detail":"Authentication credentials were not provided."}。使用Postman和Curl请求均出现相同问题，尝试移除认证配置、在Postman中添加认证等操作后仍无法解决。

Curl请求示例 #

curl -X POST -H "Content-Type: application/json" -H "Authorization: Basic cnpwX3Rlc3RfNGZTSXNRaWdoeTZnU3o6Y1pZT3pvbnRWOFlEM1V1bzFneVlYalVF" -d "{\"amount\": 10000, \"currency\": \"INR\", \"receipt\": \"order_receipt\"}" http://127.0.0.1:8000/api/orders/create-razorpay-order/
{"detail":"Authentication credentials were not provided."}

URL路由配置 #

path('create-razorpay-order/', views.create_razorpay_order, name="create_razorpay_order"),

视图函数代码 #

def create_razorpay_order(request):    
 
    razorpay_key = 'KEYID'
    razorpay_secret = 'RAZORPAYKEYSECRET'
    
    # Concatenating the API key and secret with a colon
    key_id_secret = f'{razorpay_key}:{razorpay_secret}'
    
    # Base64 encode the concatenated string
    base64_encoded_key_id_secret = base64.b64encode(key_id_secret.encode()).decode()

    # Endpoint for creating an order on Razorpay's server
    razorpay_order_url = 'https://api.razorpay.com/v1/orders'
    
    # Amount in paise (e.g., 10000 represents ₹100.00)
    amount = 10000
    
    # Data to be sent in the request body
    data = {
        'amount': amount,
        'currency': 'INR',  # Currency code (e.g., INR for Indian Rupees)
        'receipt': 'order_receipt1',  # Unique identifier for the order (optional)
        
    }
    
    # Headers for the request
    headers = {
        'Content-Type': 'application/json',
        'Authorization': f'Basic {base64_encoded_key_id_secret}',
    }
    
    # Make a POST request to create the order on Razorpay's server
    response = requests.post(razorpay_order_url, data=json.dumps(data), headers=headers)
    
    
    if response.status_code == 200:
        # order_id = order_data.get('id')
        return Response(response.json())
    else:
        # If the request fails, return an error response
        return JsonResponse({'error': 'Failed to create order'}, status=response.status_code)

中间件配置 #

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    #cors header middleware
    "corsheaders.middleware.CorsMiddleware",
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
   
]

核心问题 #

你看到的401错误是Django DRF的认证拦截导致的，不是Razorpay API返回的错误——DRF默认会对使用其响应类的视图做认证检查，而你的接口不需要用户登录认证。

具体修复步骤 #

1. 给视图添加DRF装饰器，关闭认证检查
   用@api_view标记视图为DRF接口，并设置permission_classes=[AllowAny]允许匿名访问：

   from rest_framework.decorators import api_view, permission_classes
   from rest_framework.permissions import AllowAny
   from rest_framework.response import Response
   import requests
   import base64
   import json
   
   @api_view(['POST'])
   @permission_classes([AllowAny])
   def create_razorpay_order(request):    
       # 替换为真实的Razorpay密钥
       razorpay_key = '你的KeyId'
       razorpay_secret = '你的KeySecret'
       
       key_id_secret = f'{razorpay_key}:{razorpay_secret}'
       base64_encoded = base64.b64encode(key_id_secret.encode()).decode()
   
       razorpay_url = 'https://api.razorpay.com/v1/orders'
       
       # 从请求体获取参数，更灵活
       data = {
           'amount': request.data.get('amount', 10000),
           'currency': request.data.get('currency', 'INR'),
           'receipt': request.data.get('receipt', 'order_receipt1'),
       }
       
       headers = {
           'Content-Type': 'application/json',
           'Authorization': f'Basic {base64_encoded}',
       }
       
       # 用requests的json参数自动序列化，无需手动json.dumps
       response = requests.post(razorpay_url, json=data, headers=headers)
       
       if response.status_code == 200:
           return Response(response.json())
       else:
           return Response({'error': '创建订单失败'}, status=response.status_code)
   

2. 替换占位符密钥
   必须把代码中'KEYID'和'RAZORPAYKEYSECRET'替换为Razorpay控制台获取的真实密钥（测试环境用测试密钥，生产环境用生产密钥）。

3. 修正前端请求的认证头
   你的Curl请求里的Authorization头是发给Django后端的，完全多余，直接移除：

   curl -X POST -H "Content-Type: application/json" -d "{\"amount\": 10000, \"currency\": \"INR\", \"receipt\": \"order_receipt\"}" http://127.0.0.1:8000/api/orders/create-razorpay-order/
   

4. 检查DRF全局配置（可选）
   如果项目settings.py里有全局认证配置，确认该接口是否被覆盖：

   REST_FRAMEWORK = {
       'DEFAULT_AUTHENTICATION_CLASSES': [
           # 你的全局认证类
       ],
   }
   

   只要视图上添加了@permission_classes([AllowAny])，就会覆盖全局配置，无需修改全局设置。

内容的提问来源于stack exchange，提问作者chocpooh