Hugging Face Tokens

Many useful repositories are gated — you accept a licence on the hub — or private. Without a token, downloading one fails in a way that looks like a network problem and is not.

Add a token

1. On the hub: Settings → Access Tokens → New token. read scope is enough.
2. In Lifeboat: HuggingFace Tokens → Add Token. Name it something you will recognise, paste, save.
3. Accept the model’s licence on the hub, with the same account. Lifeboat cannot do this for you, and a token without the acceptance still fails.

Step 3 is the one that gets skipped, and it produces exactly the same error as having no token at all.

Storage

Tokens are encrypted at rest and never shown again after saving. The console displays only enough to tell two apart.

Which token is used

A token can be pinned to a model, which is what you want when repositories belong to different accounts or teams. Unpinned, Lifeboat uses the available token.

A single-tenant deployment can skip the vault entirely and set HF_TOKEN in the environment.

It still fails

In order of likelihood:

1. The licence has not been accepted for that repository by the token’s account.
2. The token was revoked on the hub. The stored copy cannot know; add a new one.
3. The repository is private to an organisation the account is not in.
4. No outbound network — the expected state on an air-gapped host. Register from a local path instead.

Rotation

Add the new token, confirm a download works, then remove the old one. Deleting first leaves a window where downloads fail.

Air-gapped

There is nothing to authenticate to, so this whole page is moot — register models from local paths. See Air-gapped install.

Sources and references

• Download failures: Downloading models
• Registering local weights: Model registry