How to Secure Your Hugging Face Account and Rotate API Tokens

How to rotate Hugging Face API keys

On September 14, 2026, Hugging Face confirmed a security incident that potentially compromised user tokens. If you host models or run code on the platform, your primary defense is an immediate rotation of all existing API keys. This prevents unauthorized actors from using your credentials to access private repositories or compute resources. You should also audit your account activity for any unfamiliar logins or unexpected model updates. This walkthrough covers the exact steps to secure your account while the team investigates the full scope of the breach. Taking these actions now keeps your private data safe. It is a necessary precaution to protect your intellectual property.

What happened in the Hugging Face security incident?

Start by visiting your account settings page. Navigate to the access tokens section where your current keys are listed. You will see a list of every active token you have generated. Click the delete or revoke button next to each one. Do not stop until every token is gone. Once they are deleted, generate new ones for your current projects. Update your environment variables or local configuration files to reflect these new keys immediately. If you leave an old key active, you leave a door open for an attacker. It only takes a few minutes to complete this process.

How to enable two-factor authentication on Hugging Face

Go to your account dashboard and look for the activity history. This section displays recent logins, IP addresses, and specific actions performed on your repositories. Look for any logins from locations you do not recognize or at times you were not using the platform. If you see a repository change that you did not authorize, note the time and the specific file affected. You should report these findings to the Hugging Face support team through their official security channel. Documentation is your friend here. Keeping a record helps the team identify the breach pattern.

Should I change my password?

Yes, changing your password is a standard best practice after any security incident. Choose a unique passphrase that you do not use on any other service. If you use a password manager, generate a random string of at least 20 characters. This adds a layer of protection if your credentials were part of the exposed data. But do not rely on a password alone. Two-factor authentication is the most effective way to prevent future unauthorized logins. You can set this up in the security tab of your account settings.

What if I use third-party integrations?

Many users connect external tools to their Hugging Face account. These integrations often use their own tokens or OAuth permissions. Check your settings to see which applications have access to your account data. If you see an app you no longer recognize or use, remove its access immediately. Some integrations might need to be reconnected with fresh tokens after you rotate your primary keys. This step is often overlooked, but it is critical for total security. Don't skip it just because it feels tedious.

Why you should rotate your Hugging Face tokens immediately

The main risk is that an attacker could use your stolen tokens to access private models or compute credits. They might steal proprietary code or run expensive tasks on your bill. Some attackers use compromised accounts to distribute malicious code to other users. You could inadvertently become a source of malware if your repositories are altered. Acting now reduces the window of opportunity for anyone trying to exploit your assets. Security is a series of small, consistent actions rather than one big fix.