Skip to content

Hugging Face Access Token

Service Name: Hugging Face

Service Description: Hugging Face is an AI company that provides tools, models, and datasets for natural language processing (NLP) and machine learning. Their platform hosts thousands of pre-trained models and datasets for various AI tasks.

Service Address: https://huggingface.co/

Validation Type: API Auth

IP Allow list: Does not exist

Secret Access Scope: Grants access to Hugging Face API, allowing users to download models, upload models, and interact with the Hugging Face Hub.

Secret Revokement URL: https://huggingface.co/settings/tokens

Secret Example: hf_api_org_abcdefghijklmnopqrstuvwxyz1234567890

Suspicious Activity Investigation Instructions:

  • Check Hugging Face account for unauthorized model uploads or downloads
  • Review API usage logs for unusual patterns or high volume requests
  • Verify if the token has been used to access or modify private repositories
  • Check for unusual inference API calls or usage spikes

Mitigation Instructions:

  • Immediately revoke the compromised token through the Hugging Face settings page
  • Generate a new token with appropriate permissions
  • Review and update access controls for any affected models or datasets
  • Enable two-factor authentication on your Hugging Face account if not already enabled
  • Audit your repositories for any unauthorized changes