Hugging Face signs users in with the account they use for models, datasets, and Spaces — the obvious connector for ML tooling and anything that pulls artifacts from the Hub.

## Copy the redirect URI

In the [Authdog console](https://console.authdog.com), select the project and environment, open **Authentication > Providers**, find **Hugging Face**, and click **Enable**. Copy the redirect URI shown in the form:

```url
https://identity.authdog.com/api/v1/callback/<connectionId>
```

## Create the application

1. Open [Connected Applications in your Hugging Face settings](https://huggingface.co/settings/connected-applications) and create an OAuth app, or add OAuth to a Space.
2. Name the application and add a description.
3. Under **Redirect URLs**, paste the redirect URI from Authdog.
4. Select the `openid`, `profile`, and `email` scopes.
5. Save, then copy the **Client ID** and **Client Secret**.

## Configure Authdog

| Field | Value |
| --- | --- |
| **Client ID** | The client identifier from the provider |
| **Client Secret** | The client secret from the provider |

Save, then toggle the connection **active**.

## What Hugging Face returns

Authdog requests the `openid profile email` scopes and reads the profile from `https://huggingface.co/api/whoami-v2`.

The whoami endpoint returns the username, full name, avatar, email, and the organizations the user belongs to.

Usernames on the Hub are mutable; the stable identifier is what Authdog links on.

## Test it

1. Open your environment's hosted sign-in page, or link to `https://identity.authdog.com/api/v1/signin/<connectionId>`.
2. Select the Hugging Face button and complete the flow.
3. Confirm the user appears under **Users** in the console with a Hugging Face identity linked.

## Troubleshooting

| Symptom | Cause |
| --- | --- |
| `invalid_scope` | The app was created without the `email` scope |
| Redirect or callback URL error | The URI registered with the provider does not match Authdog's exactly |
| Works in one environment only | Each environment has its own `connectionId`, and so its own redirect URI to register |

## Related

| Read | To learn how to |
| --- | --- |
| [Connectors](/docs/connectors) | Set up any other social provider |