Hugging Face

Overview

Use Hugging Face credentials to make authenticated API calls through Alter Vault without exposing API keys in code.

Property	Value
Template ID	huggingface
Category	AI
Credential Type	Access Token

Step 1: Get Credentials

Log in to Hugging Face

Log in to Hugging Face at huggingface.co.

Navigate to Access Tokens

Navigate to Settings > Access Tokens at huggingface.co/settings/tokens.

Create a token

Click Create new token and choose a role (fine-grained, read, or write).

Copy the token

Copy the token (starts with hf_) — it is only shown once.

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Hugging Face

Go to Managed Secrets > Add Provider > Hugging Face.

Enter credentials

Paste the Access Token into the credential field.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

response = await alter_app.request(
    HttpMethod.GET,
    "https://huggingface.co/api/whoami-v2",
    grant_id="YOUR_GRANT_ID",
)

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path	Notes
get:/api/whoami-v2	read	GET	/api/whoami-v2	—
post:/api/repos/create	write	POST	/api/repos/create	—
post:/api/repos/move	write	POST	/api/repos/move	—
get:/api/models/{namespace}/{repo}/commits/{rev}	read	GET	/api/models/{namespace}/{repo}/commits/{rev}	—
get:/api/models/{namespace}/{repo}/refs	read	GET	/api/models/{namespace}/{repo}/refs	—
get:/api/models/{namespace}/{repo}/tree/{rev}/{path}	read	GET	/api/models/{namespace}/{repo}/tree/{rev}/{path}	—
post:/api/models/{namespace}/{repo}/commit/{rev}	delete, write	POST	/api/models/{namespace}/{repo}/commit/{rev}	—
post:/api/models/{namespace}/{repo}/branch/{rev}	write	POST	/api/models/{namespace}/{repo}/branch/{rev}	—
delete:/api/models/{namespace}/{repo}/branch/{rev}	delete	DELETE	/api/models/{namespace}/{repo}/branch/{rev}	—
post:/api/models/{namespace}/{repo}/tag/{rev}	write	POST	/api/models/{namespace}/{repo}/tag/{rev}	—
delete:/api/models/{namespace}/{repo}/tag/{rev}	delete	DELETE	/api/models/{namespace}/{repo}/tag/{rev}	—
put:/api/models/{namespace}/{repo}/settings	admin	PUT	/api/models/{namespace}/{repo}/settings	—
delete:/api/models/{namespace}/{repo}/lfs-files/{sha}	delete	DELETE	/api/models/{namespace}/{repo}/lfs-files/{sha}	—
get:/api/datasets/{namespace}/{repo}/tree/{rev}/{path}	read	GET	/api/datasets/{namespace}/{repo}/tree/{rev}/{path}	—
post:/api/datasets/{namespace}/{repo}/commit/{rev}	delete, write	POST	/api/datasets/{namespace}/{repo}/commit/{rev}	—
delete:/api/datasets/{namespace}/{repo}/branch/{rev}	delete	DELETE	/api/datasets/{namespace}/{repo}/branch/{rev}	—
put:/api/datasets/{namespace}/{repo}/settings	admin	PUT	/api/datasets/{namespace}/{repo}/settings	—
post:/api/spaces/{namespace}/{repo}/commit/{rev}	delete, write	POST	/api/spaces/{namespace}/{repo}/commit/{rev}	—
put:/api/spaces/{namespace}/{repo}/settings	admin	PUT	/api/spaces/{namespace}/{repo}/settings	—
get:/api/spaces/{namespace}/{repo}/secrets	read	GET	/api/spaces/{namespace}/{repo}/secrets	—
post:/api/spaces/{namespace}/{repo}/secrets	admin	POST	/api/spaces/{namespace}/{repo}/secrets	—
delete:/api/spaces/{namespace}/{repo}/secrets	admin, delete	DELETE	/api/spaces/{namespace}/{repo}/secrets	—
get:/api/spaces/{namespace}/{repo}/variables	read	GET	/api/spaces/{namespace}/{repo}/variables	—
post:/api/spaces/{namespace}/{repo}/variables	write	POST	/api/spaces/{namespace}/{repo}/variables	—
delete:/api/spaces/{namespace}/{repo}/variables	delete	DELETE	/api/spaces/{namespace}/{repo}/variables	—
get:/api/collections	read	GET	/api/collections	—
get:/api/collections/{namespace}/{slug}	read	GET	/api/collections/{namespace}/{slug}	—
post:/api/collections	write	POST	/api/collections	—
patch:/api/collections/{namespace}/{slug}	write	PATCH	/api/collections/{namespace}/{slug}	—
delete:/api/collections/{namespace}/{slug}	delete	DELETE	/api/collections/{namespace}/{slug}	—
post:/api/collections/{namespace}/{slug}/items	write	POST	/api/collections/{namespace}/{slug}/items	—
post:/api/organizations/{name}/service-accounts/{serviceAccountId}/tokens	admin	POST	/api/organizations/{name}/service-accounts/{serviceAccountId}/tokens	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
post:/api/organizations/{name}/service-accounts/{serviceAccountId}/tokens/{tokenId}/rotate	admin	POST	/api/organizations/{name}/service-accounts/{serviceAccountId}/tokens/{tokenId}/rotate	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)