Skip to content

clarify org-scoped oauth token access #2409

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Pierrci merged 1 commit into from
Apr 20, 2026
Merged

clarify org-scoped oauth token access #2409

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/hub/oauth.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,7 +252,7 @@ curl -X POST "https://huggingface.co/oauth/token" \

Tokens issued via Token Exchange have built-in security restrictions:

- **Organization-scoped**: Tokens can only access resources within your organization (models, datasets, Spaces owned by the org), plus any public gated repos outside the org that the user has been individually granted access to (read-only).
- **Organization-scoped**: Tokens can only access resources within your organization (models, datasets, Spaces, and collections owned by the org). Outside the org, access is read-only and limited to: public collections from any user or organization, and public gated repos the user has been individually granted access to.
- **No personal access**: Tokens cannot access the user's personal private repositories or private repos from other organizations.
- **Short-lived**: Tokens expire after 8 hours by default. Organization administrators can configure the token duration (up to 30 days) in the OAuth app settings. No refresh tokens are provided.
- **Auditable**: All token exchanges are logged and visible in your organization's [audit logs](./audit-logs).
Expand Down
Loading