Integrations

Link a Hugging Face account so jobs can read gated models and push exports.

Hugging Face

Linking an account does two things a job cannot otherwise do: read a gated or private model, and push an export back to the Hub.

1. Link

   Authorise through Hugging Face OAuth. The token is encrypted at rest with the deployment’s FORGE_SECRET_ENC_KEY.

2. Submit a job that needs it

   Preflight checks that the model your config names is reachable and that you are authorised for it — before the job is queued, rather than after it has waited and started downloading.

3. Push an export

   sf export my-grpo --checkpoint checkpoints/step_500 \
     --checkpoint-format nemo-dcp --push-repo alice/qwen-support-v3
   

Write scopes are off by default (FORGE_HF_OAUTH_WRITE_ENABLED). The safe default is that nothing is ever uploaded; an administrator opts the deployment in before --push-repo can work.

On an air-gapped network

There is no Hugging Face to link to, and there does not need to be. An internal mirror is configured deployment-wide with FORGE_HF_ENDPOINT and every job uses it without anyone linking anything. See air-gapped deployments.