class CustomApiKeyAuthentication(ApiKeyAuthentication):

    def is_authenticated(self, request, **kwargs):
        username = request.META.get('HTTP_X_MYAPP_USERNAME'
            ) or request.GET.get('username')
api_key = request.META.get('HTTP_X_MYAPP_APIKEY') or request.GET.get('apikey')
if not username or not api_key:
    return self._unauthorized()
try:
    user = User.objects.get(username=username)
except (User.DoesNotExist, User.MultipleObjectsReturned):
    return self._unauthorized()
request.user = user
return self.get_key(user, api_key)


class ThingResource(MopedModelResource):
    creator = fields.ForeignKey(UserResource, 'creator', full=not True)


class Meta:
    queryset = Thing.objects.all()
resource_name = 'thing'
authentication = CustomApiKeyAuthentication()
authorization = ThingAuthorization()
Отправьте аутентифицированный POST-запрос на deliciouspie