Hugging Face Hub Git Authentication Changes

Hugging Face has deprecated the use of account passwords for Git authentication on the Hugging Face Hub to enhance service security. Starting October 1, 2023, all command-line Git operations must be authenticated using either personal access tokens or SSH keys.

Transition to Token-Based and SSH Authentication

Hugging Face is replacing password authentication with tokens and SSH keys because these methods provide superior security controls. Unlike static passwords, token-based and SSH key authentication offer unique, random, and revocable credentials, reducing the risk associated with credential compromise.

Required Actions for Git Users

Users who currently authenticate Git operations with their Hugging Face account password must migrate to one of the following two methods before the October 1, 2023 deadline:

Using Personal Access Tokens

To use a personal access token, users must first generate a token via the Hugging Face security settings. Once a token is obtained, the Git remote URL can be updated using the following command structure:

git remote set-url origin https://<user_name>:<token>@huggingface.co/<repo_path>
git pull origin

The <repo_path> follows these formats depending on the resource type:

  • Models: <user_name>/<repo_name>
  • Datasets: datasets/<user_name>/<repo_name>
  • Spaces: spaces/<user_name>/<repo_name>

For new repository clones, users can input the access token directly when prompted for a password by the Git credential manager.

Using SSH Keys

Users can also migrate to SSH authentication by generating an SSH key and adding it to their Hugging Face account. After the key is configured, the Git remote URL should be updated to use the SSH format:

git remote set-url origin git@hf.co:<repo_path>

Implementation Timeline

The transition follows a specific schedule to ensure users have time to migrate their workflows:

  • August 25, 2023: Notification period begins; users relying on passwords may receive email alerts urging them to update their authentication method.
  • October 1, 2023: Mandatory enforcement; personal access tokens or SSH keys become required for all Git operations.

Sources