Link your Hugging Face account

Console sidebar → Hugging Face, then Connect. That authorises your own hub account against the platform.

tp export my-grpo \
  --checkpoint checkpoints/step_500 --checkpoint-format nemo-dcp \
  --push-repo myorg/my-model

The server injects your token for that push. Nobody shares a team token.

What linking gets you

	Without a link	With one
A gated repository, such as the Llama family	Submission fails partway through the job, when the download is refused	Submission preflight checks your access and refuses immediately, naming the repo
Pushing an export	Not possible	`tp export --push-repo` uses your identity
Audit	A shared token, so a push is attributable to nobody	The push is attributable to you

Scopes

The default authorisation is read-only: openid, profile, email, read-repos, gated-repos. Pushing needs a write scope, which is behind a second switch the deployment controls. Once an administrator sets TUNEPLANE_HF_OAUTH_WRITE_ENABLED=true, re-authorise on the same page to pick up the push scope. Until then, --push-repo is refused rather than failing at upload time.

Check it worked

The Hugging Face page shows your linked account and the scopes you granted. Then submit a job that references a gated repository:

tp submit my-sft --profile h200:8 --model meta-llama/Llama-3.1-8B

A gated repo you are not approved for is refused at submission, naming the repository. That is the preflight working. Without a link, the same job would queue, start, and die downloading weights. --push-repo is validated as namespace/name, so nothing you type there can become an extra argument. A failed push leaves the local export artifact alone.

For an administrator

The whole integration is off until you configure it:

TUNEPLANE_HF_OAUTH_ENABLED=true
TUNEPLANE_HF_OAUTH_CLIENT_ID=<from your Hugging Face OAuth app>
TUNEPLANE_HF_OAUTH_CLIENT_SECRET=<from the same app>
TUNEPLANE_HF_OAUTH_WRITE_ENABLED=false      # turn on only when people need to push

The sidebar entry is hidden while TUNEPLANE_HF_OAUTH_ENABLED is false, so an unconfigured deployment shows no dead link. TUNEPLANE_HF_OAUTH_BASE_URL points at a mirror on a network that cannot reach huggingface.co.

Pipelines for the export step · Datasets · Air-gapped deployments

Get started

Core concepts

Train a model

Evaluate and serve

Agent environments

Extend the platform

Collaborate

Integrations

Reference

Help

Link your Hugging Face account

What linking gets you

Scopes

Check it worked

For an administrator

Next

​What linking gets you

​Scopes

​Check it worked

​For an administrator

​Next

What linking gets you

Scopes

Check it worked

For an administrator

Next