Let me show you my code first:
You seem to be mixing up authentication and authorization.
By using the
@permission_classes decorator on your view, you have overridden the default authorization from settings. But you still have the default authentication classes from settings.
Try adding also to your view another decorator, to bypass the
Note that if you put this on a
POST endpoint, your app is now vulnerable to nasty stuff like Cross-Site Request Forgery.