{
  "slug": "hf-auth-login-uses-browser-oauth-and-json-events-05c9b853e48c",
  "title": "hf auth login uses browser OAuth and JSON events",
  "tools": [
    "hf"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-06-18T12:20:07.000Z",
  "announced_at": "2026-06-18T12:20:07.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When authenticating from an agent, run the JSON login flow and relay the device URL and code; wait for the terminal success or error event. Use `get_token()` to retrieve and transparently refresh a stored OAuth token, and `hf auth list` to inspect stored tokens.",
    "examples": [
      "hf auth login --format json",
      "from huggingface_hub import login\nlogin()",
      "from huggingface_hub import get_token\ntoken = get_token()"
    ],
    "gotchas": [
      "Version: v1.20.0",
      "--format json: Select JSON output for agent login events; `device_code` contains the verification URL and user code, followed by an authentication terminal event.",
      "login(token=None): Omitting `token` uses browser OAuth; in a terminal, the user can choose browser login or paste a token.",
      "login(add_to_git_credential=False): Save the supplied token as a Git credential; ignored for browser login.",
      "login(skip_if_logged_in=True): Skip prompting if already logged in; set false to force re-login.",
      "Prerequisite: Install `huggingface_hub` to use its `hf` CLI and Python login API.",
      "Prerequisite: Browser login requires completing authorization at the displayed URL with the displayed code.",
      "OAuth tokens expire after 30 days.",
      "Token refresh occurs when less than a day of validity remains.",
      "The interactive terminal offers the arrow-key choice menu; agent execution does not prompt and instead streams structured events.",
      "Docs conflict: The later v1.20.1 CLI guide says `hf auth login` does not support `--format json` or `--format quiet` and shows `--format agent` instead. This differs from the v1.20.0 release note; do not apply the later syntax to v1.20.0. https://huggingface.co/docs/huggingface_hub/v1.20.1/en/guides/cli"
    ]
  },
  "why_it_matters": "Authenticate the CLI or Python client from an interactive terminal or coding agent and keep an OAuth token usable for long-running work.",
  "before": "For CLI login, copy-paste a token; in Python, use the prior `login()` behavior.",
  "sources": [
    "https://github.com/huggingface/huggingface_hub/releases/tag/v1.20.0",
    "https://github.com/huggingface/huggingface_hub/blob/v1.20.0/src/huggingface_hub/cli/auth.py",
    "https://github.com/huggingface/huggingface_hub/blob/v1.20.0/src/huggingface_hub/_login.py",
    "https://github.com/huggingface/huggingface_hub/blob/v1.20.0/src/huggingface_hub/utils/_auth.py",
    "https://huggingface.co/docs/huggingface_hub/package_reference/authentication"
  ],
  "rank": 0.94054,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2b-20261017",
    "verdict_id": "wave2b-20261017:wave2b-20261017-ac29a010b048e6ce-0:gate",
    "evidence_hash": "64d7c847d81a80acde3f78a092ff3a98bf45cf2fa31b11f2ca84260cfd15ccbc"
  },
  "review": {
    "draft_hash": "c8c7491bf3fd84c30ca830550ce2a03176b5822d817374903272ef42517188ac",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2b-20261017:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.94 >= 0.9; 2 needed) and Jev gave 0.77 (>= 0.6 needed)."
  }
}