Hugging Face Hub to Drop Password Authentication for Git: Switch to Tokens or SSH by October 1

Hugging Face is tightening security on its Hub platform by deprecating password-based authentication for Git operations. Starting October 1, 2023, users must switch to either a personal access token or an SSH key to authenticate command-line Git interactions.

Background

In recent months, Hugging Face has rolled out several security enhancements, including sign-in alerts and SSH key support for Git. Despite these measures, users could still authenticate using their username and password. To eliminate this vulnerability, the platform is moving exclusively to token-based or SSH key authentication, which offers unique, revocable, and random credentials that improve security and control.

Action Required Today

If you currently use your Hugging Face account password for Git authentication, you need to update your method before October 1, 2023. Here’s how:

Switching to a Personal Access Token

1. Generate a token by following the guide at https://huggingface.co/docs/hub/security-tokens#user-access-tokens.
2. Update your existing Git repository with:

git remote set-url origin https://<user_name>:<token>@huggingface.co/<repo_path>
git pull origin

Replace /repo_path> with:

• <user_name>/<repo_name> for models
• datasets/<user_name>/<repo_name> for datasets
• spaces/<user_name>/<repo_name> for Spaces

For new clones, simply enter the token when prompted for a password.

Switching to SSH Keys

1. Follow the SSH key guide at https://huggingface.co/docs/hub/security-git-ssh to generate a key and add it to your account.
2. Update your Git remote:

git remote set-url origin git@hf.co:<repo_path>

Timeline

• Today: Users still using password authentication will receive email reminders to update.
• October 1, 2023: Personal access tokens or SSH keys become mandatory for all Git operations.

For questions or concerns, contact Hugging Face Support at website@huggingface.co.