Because we’re committed to improving the safety of our services, we’re making changes to the best way you authenticate when interacting with the Hugging Face Hub through Git.
Ranging from October 1st, 2023, we are going to not accept passwords as a option to authenticate your command-line Git operations. As an alternative, we recommend using safer authentication methods, resembling replacing the password with a private access token or using an SSH key.
Background
In recent months, now we have implemented various security enhancements, including sign-in alerts and support for SSH keys in Git. Nevertheless, users have still been capable of authenticate Git operations using their username and password. To further improve security, we at the moment are transitioning to token-based or SSH key authentication.
Token-based and SSH key authentication offer several benefits over traditional password authentication, including unique, revocable, and random features that enhance security and control.
Motion Required Today
For those who currently use your HF account password to authenticate with Git, please switch to using a private access token or SSH keys before October 1st, 2023.
Switching to private access token
You will have to generate an access token in your account; you’ll be able to follow https://huggingface.co/docs/hub/security-tokens#user-access-tokens to generate one.
After generating your access token, you’ll be able to update your Git repository using the next commands:
$: git distant set-url origin https://:@huggingface.co/
$: git pull origin
where
/ datasets/for datasets/ spaces/for Spaces/
For those who clone a brand new repo, you’ll be able to just input a token instead of your password when your Git credential manager asks you in your authentication credentials.
Switching to SSH keys
Follow our guide to generate an SSH key and add it to your account: https://huggingface.co/docs/hub/security-git-ssh
You then’ll find a way to update your Git repository using:
$: git distant set-url origin git@hf.co:
Timeline
Here’s what you’ll be able to expect in the approaching weeks:
- Today: Users counting on passwords for Git authentication may receive emails urging them to update their authentication method.
- October 1st: Personal access tokens or SSH keys will likely be mandatory for all Git operations.
For more details, reach out to HF Support to handle any questions or concerns at website@huggingface.co
