> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tuneplane.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Link your Hugging Face account

> Use your own hub identity for gated models and for pushing an export, instead of a shared team token.

Console sidebar → **Hugging Face**, then **Connect**. That authorises your own hub account
against the platform.

```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
tp export my-grpo \
  --checkpoint checkpoints/step_500 --checkpoint-format nemo-dcp \
  --push-repo myorg/my-model
```

The server injects **your** token for that push. Nobody shares a team token.

## What linking gets you

| | Without a link | With one |
| - | - | - |
| A gated repository, such as the Llama family | Submission fails partway through the job, when the download is refused | Submission preflight checks your access and refuses immediately, naming the repo |
| Pushing an export | Not possible | `tp export --push-repo` uses your identity |
| Audit | A shared token, so a push is attributable to nobody | The push is attributable to you |

## Scopes

The default authorisation is read-only: `openid`, `profile`, `email`, `read-repos`,
`gated-repos`.

Pushing needs a write scope, which is behind a second switch the deployment controls. Once an
administrator sets `TUNEPLANE_HF_OAUTH_WRITE_ENABLED=true`, re-authorise on the same page to pick
up the push scope. Until then, `--push-repo` is refused rather than failing at upload time.

## Check it worked

The Hugging Face page shows your linked account and the scopes you granted. Then submit a job
that references a gated repository:

```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
tp submit my-sft --profile h200:8 --model meta-llama/Llama-3.1-8B
```

A gated repo you are not approved for is refused at submission, naming the repository. That is
the preflight working. Without a link, the same job would queue, start, and die downloading
weights.

`--push-repo` is validated as `namespace/name`, so nothing you type there can become an extra
argument. A failed push leaves the local export artifact alone.

## For an administrator

The whole integration is off until you configure it:

```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
TUNEPLANE_HF_OAUTH_ENABLED=true
TUNEPLANE_HF_OAUTH_CLIENT_ID=<from your Hugging Face OAuth app>
TUNEPLANE_HF_OAUTH_CLIENT_SECRET=<from the same app>
TUNEPLANE_HF_OAUTH_WRITE_ENABLED=false      # turn on only when people need to push
```

The sidebar entry is hidden while `TUNEPLANE_HF_OAUTH_ENABLED` is false, so an unconfigured
deployment shows no dead link. `TUNEPLANE_HF_OAUTH_BASE_URL` points at a mirror on a network
that cannot reach `huggingface.co`.

## Next

[Pipelines](https://docs.tuneplane.ai/en/guides/pipelines.md) for the export step · [Datasets](https://docs.tuneplane.ai/en/guides/datasets.md) ·
[Air-gapped deployments](https://docs.tuneplane.ai/en/ops/airgapped.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.