As we work to improve the security of our service, we are changing the way you authenticate when interacting with Hugging Face Hub through Git. Starting October 1, 2023, we will no longer accept passwords as a method to authenticate command-line Git operations. Instead, we recommend using more secure authentication methods, such as replacing passwords with personal access tokens or using SSH keys.
background
Over the past few months, we’ve implemented a variety of security enhancements, including sign-in alerts and support for SSH keys in Git. However, users can still authenticate Git operations using their username and password. To further improve security, we are currently moving to token-based or SSH key authentication. Token-based and SSH key authentication have several advantages over traditional password authentication, including a unique revocable random feature that increases security and control.
Action needed now
If you currently use your HF account password to authenticate with Git, please switch to using a personal access token or SSH key by October 1, 2023.
Switching to personal access tokens
You need to generate an access token for your account. You can generate one according to https://huggingface.co/docs/hub/security-tokens#user-access-tokens.
After generating an access token, you can update your Git repository using the following command:
$: git remote set-url origin https://:@huggingface.co/ $: git pull origin
where is of the form:
/ For Model Datasets // For Dataset Spaces // For Spaces
When you clone a new repository, you just need to enter your token instead of your password when Git Credential Manager prompts you for authentication credentials.
Switching to SSH keys
Follow the guide to generate an SSH key and add it to your account: https://huggingface.co/docs/hub/security-git-ssh
You will then be able to update your Git repository using:
$: git remote set-url origin git@hf.co:
timeline
Here’s what to expect in the coming weeks.
Currently: Users who rely on passwords for Git authentication may receive an email prompting them to update their authentication method. October 1: A personal access token or SSH key is required for all Git operations.
Please contact HF Support for more information. If you have any questions or concerns, please contact us at website@huggingface.co.
