|
1 | 1 | # Tokens Management |
2 | 2 |
|
3 | 3 | <Tip warning={true}> |
4 | | -This feature is part of the <a href="https://huggingface.co/enterprise" target="_blank">Enterprise Hub</a>. |
| 4 | +This feature is part of the <a href="https://huggingface.co/enterprise">Enterprise Hub</a>. |
5 | 5 | </Tip> |
6 | 6 |
|
7 | | -Tokens Management allows organization administrators to control access tokens within their organization, ensuring that only authorized users have access to organization resources. |
8 | | - |
| 7 | +Tokens Management enables organization administrators to oversee access tokens within their organization, ensuring secure access to organization resources. |
9 | 8 |
|
10 | 9 | ## Viewing and Managing Access Tokens |
11 | 10 |
|
12 | | -The token listing feature provides a view of all access tokens within your organization. Administrators can: |
| 11 | +The token listing feature displays all access tokens within your organization. Administrators can: |
13 | 12 |
|
14 | 13 | - Monitor token usage and identify or prevent potential security risks: |
15 | | - - unauthorized access to private resources ("leak") |
16 | | - - scopes of access that are too wide |
17 | | - - improvable token hygienics (tokens that have not been rotated in a long time, for example) |
18 | | -- Identify inactive or unused tokens that can be revoked |
| 14 | + - Unauthorized access to private resources ("leaks") |
| 15 | + - Overly broad access scopes |
| 16 | + - Suboptimal token hygiene (e.g., tokens that have not been rotated in a long time) |
| 17 | +- Identify and revoke inactive or unused tokens |
19 | 18 |
|
20 | 19 | <div class="flex justify-center"> |
21 | 20 | <img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/tokens-management-list.png" /> |
22 | 21 | <img class="hidden dark:block" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/tokens-management-list-dark.png" /> |
23 | 22 | </div> |
24 | 23 |
|
25 | | - |
26 | | -Fine-grained tokens can be reviewed to see their permissions: |
| 24 | +Fine-grained tokens display their specific permissions: |
27 | 25 |
|
28 | 26 | <div class="flex justify-center"> |
29 | 27 | <img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/tokens-management-detail.png" /> |
30 | 28 | <img class="hidden dark:block" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/tokens-management-detail-dark.png" /> |
31 | 29 | </div> |
32 | 30 |
|
| 31 | +## Token Policy |
33 | 32 |
|
34 | | -## Token policy |
35 | | - |
36 | | -With Tokens Management, Enterprise org admins can decide which of the following policies they want to enforce: |
37 | | - |
38 | | -| **Policy** | **Unscoped (Read/Write) Access Tokens** | **Fine-Grained Tokens** | |
39 | | -| --- | --- | --- | |
40 | | -| **Allow access via User Access Tokens (default)** | Authorized | Authorized | |
41 | | -| **Only access via fine-grained tokens** | Unauthorized | Authorized | |
42 | | -| **Do not require administrator approval** | Unauthorized | Authorized | |
43 | | -| **Require administrator approval** | Unauthorized | Unauthorized without an approval (except for admin-created) | |
| 33 | +Enterprise organization administrators can enforce the following policies: |
44 | 34 |
|
| 35 | +| **Policy** | **Unscoped (Read/Write) Access Tokens** | **Fine-Grained Tokens** | |
| 36 | +| ------------------------------------------------- | --------------------------------------- | ----------------------------------------------------------- | |
| 37 | +| **Allow access via User Access Tokens (default)** | Authorized | Authorized | |
| 38 | +| **Only access via fine-grained tokens** | Unauthorized | Authorized | |
| 39 | +| **Do not require administrator approval** | Unauthorized | Authorized | |
| 40 | +| **Require administrator approval** | Unauthorized | Unauthorized without an approval (except for admin-created) | |
45 | 41 |
|
46 | 42 | <div class="flex justify-center"> |
47 | 43 | <img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/tokens-management-policy.png" /> |
48 | 44 | <img class="hidden dark:block" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/tokens-management-policy.png" /> |
49 | 45 | </div> |
50 | 46 |
|
51 | | - |
52 | 47 | ## Reviewing Token Authorization |
53 | 48 |
|
54 | | -When your token policy is set to "Require administrator approval", organization administrators can view the details of all fine-grained tokens with access to resources owned by the organization. They can also revoke access to those tokens. Organization administrators will receive an email when an authorization is requested for a fine-grained token. |
| 49 | +When token policy is set to "Require administrator approval", organization administrators can review details of all fine-grained tokens accessing organization-owned resources and revoke access if needed. Administrators receive email notifications for token authorization requests. |
55 | 50 |
|
56 | | -When a token is revoked or denied, the user who created the token will receive an email notification. |
| 51 | +When a token is revoked or denied, the user who created the token receives an email notification. |
57 | 52 |
|
58 | 53 | <div class="flex justify-center"> |
59 | 54 | <img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/tokens-management-review.png" /> |
|
0 commit comments