# Access my private space endpoints without access token

**URL:** </static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Faccess-my-private-space-endpoints-without-access-token%2F131792%3E%5C
**Category:** Spaces\
**Created:** [December 16, 2024, 8:37pm UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Faccess-my-private-space-endpoints-without-access-token%2F131792 "2024-12-16T20:37:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![inboxpilot](https://avatars.discourse-cdn.com/v4/letter/i/e0b2c6/32.png) [@inboxpilot](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2Finboxpilot)%5C
**Post date:** [December 16, 2024, 8:37pm UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Faccess-my-private-space-endpoints-without-access-token%2F131792%2F1 "2024-12-16T20:37:46Z")

</div>

How can I make hf space be private (I don’t want to expose my files) but at the same time not require any access token/authorization when i am making api calls?

---

<div class="post-metadata">

**Author:** ![thesab](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/thesab/32/35894_2.png) [@thesab](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2Fthesab)%5C
**Post date:** [December 17, 2024, 11:12am UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Faccess-my-private-space-endpoints-without-access-token%2F131792%2F2 "2024-12-17T11:12:39Z")

</div>

Because of security policies, you can’t have a private Space accessible via API without authentication on Hugging Face. This ensures that only authorized users can access protected content and features.  
Here’s a tip: Keep your Space public and handle sensitive data externally or through environment variables (private). This way, you can offer API access without authentication while keeping your private information safe.

---

<div class="post-metadata">

**Author:** ![John6666](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/john6666/32/27664_2.png) [@John6666](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2FJohn6666)%5C
**Post date:** [December 17, 2024, 1:29pm UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Faccess-my-private-space-endpoints-without-access-token%2F131792%2F3 "2024-12-17T13:29:28Z")

</div>

Alternatively, you could scrape the data using a browser component.😅 This is a very difficult method. Whether you use the method above or this method, it is a method that is quite close to hacking.

---

<div class="post-metadata">

**Author:** ![inboxpilot](https://avatars.discourse-cdn.com/v4/letter/i/e0b2c6/32.png) [@inboxpilot](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2Finboxpilot)%5C
**Post date:** [December 19, 2024, 7:34pm UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Faccess-my-private-space-endpoints-without-access-token%2F131792%2F4 "2024-12-19T19:34:59Z")

</div>

Is there a production HF spaces alternative?
