> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Hugging Face > Connect your Hugging Face organization to Oleria to see who can reach every model, dataset, Space, and collection, and the tokens and secrets that can act on them. Hugging Face is a platform for hosting and sharing machine learning models, datasets, and apps (Spaces). Connect your Hugging Face organization to Oleria to see who can reach each of your organization's models, datasets, Spaces, and collections, and how. Oleria reads identity and access data from the Hugging Face Hub API with an access token, so you can find over-exposed repositories and take action directly from Oleria. ## What Oleria discovers Once connected, Oleria continuously discovers and maps the following from your Hugging Face organization: * **Accounts** - every organization member, with their username, full name, organization role, and account creation date. On Team and Enterprise plans, Oleria also reads each member's two-factor authentication status, verified email, and last activity. * **Outside users** - people who aren't organization members but were granted access to one of your public gated models or datasets. They appear as external accounts. * **Public access** - an **Anyone (public Hugging Face access)** account that represents read access to your public models, datasets, collections, and the apps of protected Spaces. * **Roles** - the five organization roles (**Admin**, **Write**, **Contributor**, **Read**, and **No access**) and the member who holds each one. * **Resource groups** - on Team and Enterprise plans, each resource group, its members, and each member's role in the group. * **Resources** - your organization and every model, dataset, Space, and collection it owns, with their visibility (public, private, or protected) and gating. * **Effective access** - who can reach each resource, and why. Access comes from the organization role, a resource-group role, an approved gated-access request, or public visibility. Oleria combines them into one entry per person and resource. * **Non-human identities** - the Oleria connection's access token and, with the optional **Write contents/settings of repos in selected orgs** permission, the names of the secrets stored on your Spaces (secret values are never read). On Team and Enterprise plans, Oleria also discovers every access token that can reach the organization, with its scopes, owner, and last use, and on Enterprise plans, your service accounts. * **Activity** - on Team and Enterprise plans, organization audit log events such as member and role changes, repository changes, SSO logins, and token approvals. Oleria uses this data for access reviews, over-privileged and dormant account detection, and non-human identity discovery, refreshed on Oleria's [regular sync schedule](/integrations/overview.md#sync-model). ## Prerequisites * Admin access on the Oleria platform to add a new integration. * The **Admin** role in your Hugging Face organization, so you can grant the access token the organization permissions below. * Some data requires a paid Hugging Face plan: | Data | Free | Team | Enterprise | | :- | :-: | :-: | :-: | | Members, roles, resources, effective access | Yes | Yes | Yes | | Space secret names (needs the optional repository write permission) | Yes | Yes | Yes | | Two-factor status, verified emails, last activity | - | Yes | Yes | | Resource groups, access-token inventory, audit log | - | Yes | Yes | | Service accounts | - | - | Yes | On a lower plan, Oleria skips what the plan doesn't include and syncs everything else. ## Create a Hugging Face access token **1. Create a fine-grained token** In Hugging Face, go to **Settings** -> **Access Tokens** -> **Create new token**. Select the **Fine-grained** token type, enter a **Token name** such as `Oleria`, and select the **Custom** preset. ![Hugging Face Create new Access Token form with the Fine-grained token type selected and the token name Oleria](https://mintcdn.com/oleria/pP5dpjn02PH0Pa1_/images/integrations/huggingface/step-1.png?fit=max\&auto=format\&n=pP5dpjn02PH0Pa1_\&q=85\&s=4d27f0cfb27d25af237409b8ab2e3dd3) **2. Grant organization permissions** Under **Org permissions**, search for and select the organization you want to connect, then select these boxes: | Permission | Needed for | | :- | :- | | **Read org settings** | Members, roles, and resource groups, and on Team and Enterprise plans the access-token inventory | | **Read contents of repos in selected orgs** | Private models, datasets, and Spaces | | **View access requests for gated repos in selected orgs** | Approved access requests on gated models and datasets | | **Read collections in selected orgs** | Private collections | | **Export the orgs' audit log** | The audit log and member last activity (Team and Enterprise plans) | | **Read the orgs' service accounts** | Service accounts (Enterprise plans) | | **Write contents/settings of repos in selected orgs** | Optional. The names of the secrets stored on your Spaces. Hugging Face has no read-only permission for them, and this permission also lets the token change repository contents and settings. | To let Oleria take remediation actions, also select: | Permission | Needed for | | :- | :- | | **Write org settings / member management** | Changing a member's organization role and removing all of their organization access | | **Write contents/settings of repos in selected orgs** | Revoking access to a gated model or dataset, and making a public repository private | | **Write to resource groups in selected orgs** | Adding and removing resource-group members | ![Hugging Face fine-grained token Org permissions section with Repositories, Org settings, Collections, Resource Groups, Audit log, and Service accounts permissions](https://mintcdn.com/oleria/pP5dpjn02PH0Pa1_/images/integrations/huggingface/step-2.png?fit=max\&auto=format\&n=pP5dpjn02PH0Pa1_\&q=85\&s=031b46ce8fa9fc4aad717f221366135d) **3. Copy the token** Select **Create token** and copy the token. > [!NOTE] > > Hugging Face shows the token value only once, when you create it. Copy it now and store it securely. ## Connect Hugging Face to Oleria **1. Open the integration** Go to your Oleria workspace, select **Integrations**, then select the **Hugging Face** tile. **2. Complete the connection form** Fill in the connection form: | Field | Notes | | :- | :- | | Organization | Required. Your organization's handle, as in `huggingface.co/`. | | Access token | Required. The token you created in the previous section. | **3. Confirm the connection** Select **Authenticate**. Oleria checks that the token is valid, that its owner belongs to the organization, and that it can read the organization's members, and rejects the connection otherwise. ## Verify the integration Confirm the organization appears on the **Connected** tab of your Oleria **Integrations** page. After the first sync completes, you can review the discovered accounts, roles, resources, and access in your Oleria workspace. > [!NOTE] > > Hugging Face access tokens don't expire. If you revoke or replace the token in Hugging Face, update **Access token** in Oleria by editing the integration. A connection can't be moved to a different organization - create a new integration instead. ## Remediation actions Oleria can take these actions in Hugging Face when the token has the matching remediation permission: | Action | What it does in Hugging Face | Plan | Reversible? | | :- | :- | :- | :- | | Disable user | Sets the member's organization role to **No access** and removes them from every resource group | Team or Enterprise | Yes - restores the previous role and resource groups. If Hugging Face doesn't confirm the resource groups after the change, the action or its undo is reported as failed; check the member's resource groups by hand. | | Enable user | Sets a member with **No access** to **Read** | Team or Enterprise | Yes - sets them back to **No access** | | Add to role | Changes the member's organization role. It never lowers a higher role. | Team or Enterprise | Yes - restores the previous role | | Remove from role | Lowers the member's role to **Read**, or **Read** to **No access** | Team or Enterprise | Yes - restores the previous role | | Add to group / Remove from group | Adds a member to a resource group with the **Read** role, or removes them | Team or Enterprise | Yes | | Revoke access to a resource | Rejects a user's approved access request on a gated model or dataset | Any | Yes - re-approves the request | | Revoke public access | Makes a public model, dataset, or Space private | Any | Yes - restores public or protected visibility | Oleria never removes or lowers the access of the user who owns the connection's token, and never lowers the organization's last admin. If a user's state already matches the action, Oleria makes no change. > [!NOTE] > > Oleria doesn't offer to disable access tokens, service accounts, or Space secrets. Hugging Face can only revoke or delete them permanently, so the action couldn't be undone. ## Known limitations * **Plan-dependent data.** Two-factor status, emails, last activity, resource groups, the access-token inventory, and the audit log need a Team or Enterprise plan, and service accounts need Enterprise. On a lower plan these fields report as unavailable or empty. * **Emails only for verified domains.** Hugging Face shows a member's email to admins only on Team and Enterprise plans, and only when it matches the organization's verified domain or SSO configuration. * **No login history.** Hugging Face doesn't expose a last-login time. Last activity is the latest of the member's token use and audit log activity, so it's available on Team and Enterprise plans only. * **Authentication methods and password changes aren't available.** The Hub API doesn't expose them. * **Contributor write access is shown as read.** A member with the **Contributor** role can write to the repositories they created. Hugging Face doesn't record who created a repository, so Oleria shows contributor access as read. * **Audit log depth.** Hugging Face exports at most the last 100,000 audit events. Older events aren't available. ## Contact us For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.