Hugging Face - KavachOS

Setup

1

Get credentials

Go to huggingface.co/settings/applications and click New OAuth application. Set the redirect URI to:

https://your-app.com/api/kavach/auth/oauth/callback/huggingface

2

Configure

lib/kavach.ts

import { createKavach } from 'kavachos';
import { oauth } from 'kavachos/auth';

const kavach = await createKavach({
  database: { provider: 'sqlite', url: 'kavach.db' },
  plugins: [
    oauth({
      providers: [
        {
          id: 'huggingface',
          clientId: process.env.HUGGINGFACE_CLIENT_ID!,
          clientSecret: process.env.HUGGINGFACE_CLIENT_SECRET!,
        },
      ],
    }),
  ],
});

HUGGINGFACE_CLIENT_ID=...
HUGGINGFACE_CLIENT_SECRET=...

Scopes

Default scopes: openid, profile, email

Scope	What it unlocks
`openid`	OIDC identity token
`profile`	Username and full name
`email`	Email address
`read-repos`	Read access to user repositories
`read-billing`	Read billing information

Hugging Face supports the OIDC discovery endpoint at https://huggingface.co. User IDs are stable numeric values.

Endpoints

Method	Path	Description
GET	`/auth/oauth/authorize/huggingface`	Redirect to Hugging Face
GET	`/auth/oauth/callback/huggingface`	Handle callback

Last modified on April 29, 2026