[ Token Analyzer ]Docsdevanghacks.in

HuggingFace

Create a token
hf_

HuggingFace reports a token's role directly, so read, write and administrative tokens are graded without guesswork. Fine-grained tokens list the exact resources they name, which is where the interesting detail is.

What it asks for

  • GET /api/whoami-v2the token's role, name, expiry, scopes and the account it belongs to
  • GET /api/models?author=models the account owns
  • GET /api/datasets?author=datasets the account owns
  • GET /api/spaces?author=spaces the account owns
  • GET /api/{models,datasets,spaces}/{id}repositories a fine-grained token names that the account does not own

What it cannot tell you

  • A fine-grained scope naming a user or an organization covers every repository under it, including ones created after the token was issued. That is reported as covering the whole account rather than as one resource.
  • Listings follow the Hub's cursor header, which a browser cannot always read. When one stops early the count carries a + and the page says so.
  • Organization security policies such as MFA or SSO can refuse requests, which makes a listing incomplete. That is reported as a finding rather than left to look like an empty result.