# Private Space authentication for external API calls

**URL:** <https://discuss.huggingface.co/t/private-space-authentication-for-external-api-calls/167772>\
**Category:** Spaces\
**Created:** [August 26, 2025, 8:43am UTC](https://discuss.huggingface.co/t/private-space-authentication-for-external-api-calls/167772 "2025-08-26T08:43:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nasr7322](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/nasr7322/32/53080_2.png) [@nasr7322](https://discuss.huggingface.co/u/nasr7322)\
**Post date:** [August 26, 2025, 8:43am UTC](https://discuss.huggingface.co/t/private-space-authentication-for-external-api-calls/167772/1 "2025-08-26T08:43:45Z")

</div>

Hello everyone!  
I’m using a Docker 🤗 Space to deploy my FastAPI application that uses multiple models, but I’ve set it to private since my project contains sensitive code. My problem is that I can’t send requests to the endpoints from anywhere outside my browser and get a 404.

Is it possible to send a 🤗 token with the request to authenticate myself? If so, how should I include it in my request to make it work properly?

Thank you all in advance! 🖐

---

<div class="post-metadata">

**Author:** ![John6666](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/john6666/32/27664_2.png) [@John6666](https://discuss.huggingface.co/u/John6666)\
**Post date:** [August 26, 2025, 9:10am UTC](https://discuss.huggingface.co/t/private-space-authentication-for-external-api-calls/167772/2 "2025-08-26T09:10:04Z")

</div>

If the space is functioning properly, you should be able to access it like following.  
You can figure out the actual space URL yourself, also [you can also find it using the GUI](https://huggingface.co/docs/hub/en/spaces-embed).

```bash
curl -X POST https://OWNER-SPACENAME.hf.space/api/predict \
  -H "Authorization: Bearer $HF_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"text":"hello"}'

```

or

```py
import os, requests
url = "https://OWNER-SPACENAME.hf.space/api/predict"
r = requests.post(url,
                  headers={"Authorization": f"Bearer {os.getenv('HF_TOKEN')}"},
                  json={"text": "hello"},
                  timeout=60)
print(r.status_code, r.text)

```

If you want to implement [more complex access control](https://huggingface.co/spaces/zero-gpu-explorers/README/discussions/88#68a736ebb21506a456c47c81).

---

<div class="post-metadata">

**Author:** ![nasr7322](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/nasr7322/32/53080_2.png) [@nasr7322](https://discuss.huggingface.co/u/nasr7322)\
**Post date:** [August 26, 2025, 9:11am UTC](https://discuss.huggingface.co/t/private-space-authentication-for-external-api-calls/167772/3 "2025-08-26T09:11:44Z")

</div>

yup it worked, thank youu!  
my problem was with the token

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/hellohellohello/original/2X/d/de4155eb4aa4108ecb32a1389d7cc37ae69f88b7.png) [@system](https://discuss.huggingface.co/u/system)\
**Post date:** [August 26, 2025, 9:12pm UTC](https://discuss.huggingface.co/t/private-space-authentication-for-external-api-calls/167772/4 "2025-08-26T21:12:23Z")

</div>

This topic was automatically closed 12 hours after the last reply. New replies are no longer allowed.