Hugging Face is done with password-based Git authentication. The company announced that starting October 1st, 2023, anyone pushing or pulling to the Hub must use a personal access token or an SSH key — the username-and-password combo that’s quietly persisted despite recent security upgrades is being retired for good.

The reasoning is straightforward. Tokens and SSH keys are unique, revocable, and randomly generated, which makes them substantially harder to brute-force or reuse across services. Hugging Face has been layering on security improvements for months — sign-in alerts arrived first, then SSH key support for Git — but password auth remained the weakest link. Now it’s being cut entirely.

If you’re still authenticating with a password, the migration path is simple. For tokens, you generate one from your account settings, then update your remote URL to embed the token: git remote set-url origin https://<user_name>:@huggingface.co/<repo_path>. For SSH, you generate a key pair and add the public key to your account, then swap the remote to git@hf.co:<repo_path>. The repo_path format differs by type — models use <user_name>/<repo_name>, datasets prefix with datasets/, and Spaces prefix with spaces/.

The company says affected users may get emails starting today, and the hard cutoff lands October 1st. This mirrors what GitHub did back in 2021 when it killed password auth for Git operations — a move that briefly broke countless CI pipelines before teams adjusted. Hugging Face’s timeline is tighter, and given how many ML researchers treat the Hub as infrastructure rather than a service they actively manage, expect a fair amount of scrambling in the first week of October. The email support address is website@huggingface.co for anyone who hits migration issues.