if 'auth_token' in request.QUERY_PARAMS and 'HTTP_AUTHORIZATION' not in request.META:
    return self.authenticate_credentials(request.QUERY_PARAMS.get('auth_token')
        )
Token in query string with Django REST Framework's TokenAuthentication