From 6038c750ccfaef0ea515d759dd5e7f2d5263b0ee Mon Sep 17 00:00:00 2001 From: huggingface-doc-bot Date: Thu, 11 Jun 2026 07:01:15 +0000 Subject: [PATCH 1/4] Document organization service accounts (Enterprise) Add a new Service Accounts page under the Team & Enterprise section covering creating service accounts, managing their fine-grained access tokens (create/update/rotate/delete), and billing behavior. Cross-link from the Tokens Management page and add the page to the navigation. --- docs/hub/_toctree.yml | 2 ++ docs/hub/enterprise-service-accounts.md | 37 ++++++++++++++++++++++++ docs/hub/enterprise-tokens-management.md | 4 +++ 3 files changed, 43 insertions(+) create mode 100644 docs/hub/enterprise-service-accounts.md diff --git a/docs/hub/_toctree.yml b/docs/hub/_toctree.yml index ad476f17a2..c57aba3a33 100644 --- a/docs/hub/_toctree.yml +++ b/docs/hub/_toctree.yml @@ -21,6 +21,8 @@ title: Advanced Security - local: enterprise-tokens-management title: Tokens Management + - local: enterprise-service-accounts + title: Service Accounts - local: publisher-analytics title: Publisher Analytics - local: enterprise-gating-group-collections diff --git a/docs/hub/enterprise-service-accounts.md b/docs/hub/enterprise-service-accounts.md new file mode 100644 index 0000000000..f8afc93841 --- /dev/null +++ b/docs/hub/enterprise-service-accounts.md @@ -0,0 +1,37 @@ +# Service Accounts + +> [!WARNING] +> This feature is part of the Team & Enterprise plans. + +Service accounts are organization-owned identities designed for programmatic access to your organization's resources, such as CI/CD pipelines, automation scripts, and backend integrations. Unlike a personal member account, a service account is not tied to an individual person: it belongs to the organization and is managed by its administrators. + +Because a service account is decoupled from any individual, it keeps automated workflows running even as people join or leave the organization, and it lets you scope and rotate credentials without affecting any member's personal tokens. + +## Creating a Service Account + +As an organization administrator, go to the **Service Accounts** section of your organization settings to create and manage service accounts. + +When creating a service account, you provide: + +- A **name** to identify the service account. +- An optional **description** to document what the service account is used for. + +Service accounts do not have a password and cannot sign in interactively — they are accessed exclusively through the access tokens you issue for them. They are also hidden from the organization's public member list and are managed only from the **Service Accounts** settings, not from the **Members** settings. + +## Managing Access Tokens + +A service account's access to your organization is defined entirely by the fine-grained access tokens you issue to it. For each token, you choose a name and a set of fine-grained permissions, so you can grant only the access a given workflow needs. + +From the service account's page, administrators can: + +- **Create** a new access token with a chosen name and fine-grained permissions. +- **Update** an existing token's name or permissions. +- **Rotate** a token to replace it with a new value. The previous token stops working immediately, which is useful if a credential may have been exposed. +- **Delete** a token to permanently revoke its access. + +> [!WARNING] +> An access token is only displayed once, at the time it is created or rotated. Store it securely — it cannot be retrieved later. If you lose it, rotate the token to generate a new value. + +## Billing + +Service accounts are not counted as billable members of your organization, so creating them does not consume a paid seat in your subscription. diff --git a/docs/hub/enterprise-tokens-management.md b/docs/hub/enterprise-tokens-management.md index d4b80a2763..232064c924 100644 --- a/docs/hub/enterprise-tokens-management.md +++ b/docs/hub/enterprise-tokens-management.md @@ -121,3 +121,7 @@ An administrator cannot revoke their own token (`LEAKED_HF_TOKEN` cannot have th ## Programmatic Token Issuance For organizations that need to programmatically issue access tokens for their members (e.g., for internal platforms, CI/CD pipelines, or custom integrations), see [OAuth Token Exchange](./oauth#token-exchange-for-organizations-rfc-8693). This Enterprise plan feature allows your backend services to issue scoped tokens for organization members without requiring interactive user consent. + +## Service Accounts + +For automated access that is owned by the organization rather than an individual member, administrators can create [Service Accounts](./enterprise-service-accounts) and issue fine-grained tokens scoped to your organization's resources. From b55bc1c1e1651b40bb9b101404ee28aa2dc79b45 Mon Sep 17 00:00:00 2001 From: Alexandre Nicolas Date: Thu, 11 Jun 2026 17:26:36 +0200 Subject: [PATCH 2/4] Add screenshots --- docs/hub/enterprise-service-accounts.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/hub/enterprise-service-accounts.md b/docs/hub/enterprise-service-accounts.md index f8afc93841..b0c6b49a7f 100644 --- a/docs/hub/enterprise-service-accounts.md +++ b/docs/hub/enterprise-service-accounts.md @@ -11,6 +11,11 @@ Because a service account is decoupled from any individual, it keeps automated w As an organization administrator, go to the **Service Accounts** section of your organization settings to create and manage service accounts. +
+ Creating a new service account from the organization settings. + +
+ When creating a service account, you provide: - A **name** to identify the service account. @@ -22,6 +27,11 @@ Service accounts do not have a password and cannot sign in interactively — the A service account's access to your organization is defined entirely by the fine-grained access tokens you issue to it. For each token, you choose a name and a set of fine-grained permissions, so you can grant only the access a given workflow needs. +
+ Creating a new access token with fine-grained permissions for a service account. + +
+ From the service account's page, administrators can: - **Create** a new access token with a chosen name and fine-grained permissions. From ddb992c4fdcdab1be02a10b9501efb3dff160159 Mon Sep 17 00:00:00 2001 From: Alexandre Nicolas Date: Fri, 12 Jun 2026 07:56:28 +0200 Subject: [PATCH 3/4] Update min required plan --- docs/hub/enterprise-service-accounts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/hub/enterprise-service-accounts.md b/docs/hub/enterprise-service-accounts.md index b0c6b49a7f..bca504b0fb 100644 --- a/docs/hub/enterprise-service-accounts.md +++ b/docs/hub/enterprise-service-accounts.md @@ -1,7 +1,7 @@ # Service Accounts > [!WARNING] -> This feature is part of the Team & Enterprise plans. +> This feature is part of the Enterprise and Enterprise Plus plans. Service accounts are organization-owned identities designed for programmatic access to your organization's resources, such as CI/CD pipelines, automation scripts, and backend integrations. Unlike a personal member account, a service account is not tied to an individual person: it belongs to the organization and is managed by its administrators. From 0ac6b28ac3f51618f90ada48d7b3dd8e0022d955 Mon Sep 17 00:00:00 2001 From: Alexandre Nicolas Date: Fri, 12 Jun 2026 08:11:38 +0200 Subject: [PATCH 4/4] Reword member-list note & fix billing wording & add plan warnings --- docs/hub/enterprise-service-accounts.md | 4 ++-- docs/hub/enterprise-tokens-management.md | 6 ++++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/docs/hub/enterprise-service-accounts.md b/docs/hub/enterprise-service-accounts.md index bca504b0fb..028a0677d4 100644 --- a/docs/hub/enterprise-service-accounts.md +++ b/docs/hub/enterprise-service-accounts.md @@ -21,7 +21,7 @@ When creating a service account, you provide: - A **name** to identify the service account. - An optional **description** to document what the service account is used for. -Service accounts do not have a password and cannot sign in interactively — they are accessed exclusively through the access tokens you issue for them. They are also hidden from the organization's public member list and are managed only from the **Service Accounts** settings, not from the **Members** settings. +Service accounts do not have a password and cannot sign in interactively — they are accessed exclusively through the access tokens you issue for them. Unlike regular users, they also don't have an HF profile page, aren't part of the organization's member list, and are managed only through the **Service Accounts** settings. ## Managing Access Tokens @@ -44,4 +44,4 @@ From the service account's page, administrators can: ## Billing -Service accounts are not counted as billable members of your organization, so creating them does not consume a paid seat in your subscription. +Service accounts are not counted as billable members of your organization, so creating them does not consume a paid seat in your plan. diff --git a/docs/hub/enterprise-tokens-management.md b/docs/hub/enterprise-tokens-management.md index 232064c924..894fb32d34 100644 --- a/docs/hub/enterprise-tokens-management.md +++ b/docs/hub/enterprise-tokens-management.md @@ -120,8 +120,14 @@ An administrator cannot revoke their own token (`LEAKED_HF_TOKEN` cannot have th ## Programmatic Token Issuance +> [!WARNING] +> This feature is part of the Enterprise plan and above. + For organizations that need to programmatically issue access tokens for their members (e.g., for internal platforms, CI/CD pipelines, or custom integrations), see [OAuth Token Exchange](./oauth#token-exchange-for-organizations-rfc-8693). This Enterprise plan feature allows your backend services to issue scoped tokens for organization members without requiring interactive user consent. ## Service Accounts +> [!WARNING] +> This feature is part of the Enterprise plan and above. + For automated access that is owned by the organization rather than an individual member, administrators can create [Service Accounts](./enterprise-service-accounts) and issue fine-grained tokens scoped to your organization's resources.