Copy page

Hugging Face

Twin of the Hugging Face Hub API.

Twin of the Hugging Face Hub API, sign-in flows included.

Covers	huggingface.co
Auth	User access tokens (read, write, fine-grained), OAuth 2.0 tokens
Webhooks	No
Operations	129

Coverage

Models, datasets and Spaces with their revisions and file trees, repository writes and settings, collections, discussions, gated access requests and Space secrets.

The Hub runs its own OAuth 2.0 and OpenID Connect issuer on the same host, under /oauth: authorize, token, device, client registration, userinfo, JWKS and the discovery document. So your code can present an hf_ token or run the sign-in flow, whichever it does in production.

Credentials

Any well-formed hf_ token authenticates by default, and so does an access token from the twin’s own issuer at /oauth. Set auth.mode to enforced to accept only the tokens the world knows. See Credentials.

Grants carry scopes. A grant missing read-repos sees a repository 404; missing write-repos, manage-repos or contribute-repos is a 403.

Vendor specific details

• A trailing slash redirects rather than failing. /api/models/ answers 302 with a plain-text body naming the absolute unslashed URL, query preserved.
• A token the Hub cannot resolve is ignored on a public read. You quietly become anonymous instead of getting a 401, and the refusal only arrives where identity is actually required.
• A private or gated repository you may not see returns the same 404 as one that does not exist, so your code cannot tell missing from hidden.
• Paths fold case. /API/MODELS serves like /api/models.

Its own notes

Once a sandbox is running, this twin serves its own operating notes at {control_url}/veris/manual: the credentials it accepts, the API versions it serves, and the fault statuses you can arm against it. They are generated from the same source as its behaviour, so they cannot drift.