# Using tokens: THE BASICS PLEASE?

**URL:** <https://discuss.huggingface.co/t/using-tokens-the-basics-please/168733>\
**Category:** Beginners\
**Created:** [September 27, 2025, 6:28pm UTC](https://discuss.huggingface.co/t/using-tokens-the-basics-please/168733 "2025-09-27T18:28:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![DownDeep](https://avatars.discourse-cdn.com/v4/letter/d/9fc348/32.png) [@DownDeep](https://discuss.huggingface.co/u/DownDeep)\
**Post date:** [September 27, 2025, 6:28pm UTC](https://discuss.huggingface.co/t/using-tokens-the-basics-please/168733/1 "2025-09-27T18:28:17Z")

</div>

I have no problem logging into Hugging Face and to GitHub using conventional User/Password entry. I get access to gated public collections and can download individual files (e.g. Flux1-dev + needed extras).

How exactly does one login using a token? I know how to create tokens but not the means for entering them. This arises when a token is demanded to clone a repository. The standard username/password format is presented. Upon failure, a message states that this means of verification is obsolete and points to information which so far as I can tell does not spell out exactly what one _should_ do.

---

<div class="post-metadata">

**Author:** ![John6666](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/john6666/32/27664_2.png) [@John6666](https://discuss.huggingface.co/u/John6666)\
**Post date:** [September 27, 2025, 9:56pm UTC](https://discuss.huggingface.co/t/using-tokens-the-basics-please/168733/2 "2025-09-27T21:56:14Z")

</div>

FLUX.1 is a gated model, so you need to get approval, and if you’re on Windows, you have to download Git and GitLFS and upgrade them beforehand, etc. But let’s set that aside for now…  
I think doing it like this is better for Git.

```bash
python -m pip install huggingface_hub
hf auth login --add-to-git-credential # paste your HF token

```

> **[Getting Started with Repositories](https://huggingface.co/docs/hub/en/repositories-getting-started)**
>
> We’re on a journey to advance and democratize artificial intelligence through open source and open science.

---

<div class="post-metadata">

**Author:** ![JamesDavids](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/jamesdavids/32/54347_2.png) [@JamesDavids](https://discuss.huggingface.co/u/JamesDavids)\
**Post date:** [September 28, 2025, 8:17am UTC](https://discuss.huggingface.co/t/using-tokens-the-basics-please/168733/4 "2025-09-28T08:17:43Z")

</div>

This is a super common stumbling block — you’re right that Hugging Face and GitHub both deprecated plain username/password logins for `git clone` and now require tokens. The trick is: you **use the token as your password**.

Here’s the step-by-step:

* * *

### 🔑 Hugging Face (git clone with token)

1. **Create a token**

2. **Clone using HTTPS**  
Instead of your password, paste the token:

3. **Or set up credential helper**

* * *

### 🔑 GitHub (same pattern)

1. Generate a **Personal Access Token (PAT)** at [GitHub → Settings → Developer settings → Tokens](https://github.com/settings/tokens).

2. Use HTTPS clone: