# Protecting a private model when using inference endpoints
**URL:**
**Author:**  [@RaphaelK](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2FRaphaelK)%5C
**Post date:** [March 29, 2023, 7:08am UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fprotecting-a-private-model-when-using-inference-endpoints%2F34969%2F1 "2023-03-29T07:08:06Z")
Hello all,
We recently started an inference endpoint for our model. This endpoint will be used by clients using a local application. It is, however, unclear to us if using the organization API token the customer has read access to our model. Could the customer theoretically download our model using this token? Or can the organization token only be used for inference?
---
**Author:**  [@philschmid](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2Fphilschmid)%5C
**Post date:** [March 29, 2023, 11:49am UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fprotecting-a-private-model-when-using-inference-endpoints%2F34969%2F2 "2023-03-29T11:49:20Z")
Hello @RaphaelK,
You could create a user account and add him to your organization, with read permissions and then generate a UAT (User Access Token) for your customer.
In inference Endpoints you don’t have to use the org token for API calls to your endpoints, you can use tokens of users who are part of the organization.
---
**Author:**  [@RaphaelK](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2FRaphaelK)%5C
**Post date:** [March 29, 2023, 12:26pm UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fprotecting-a-private-model-when-using-inference-endpoints%2F34969%2F3 "2023-03-29T12:26:56Z")
Hi Phil,
Thank you for your reply. If I am correct the model should then be located on my personal account right, not on the organization?
---
**Author:**  [@philschmid](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2Fphilschmid)%5C
**Post date:** [March 29, 2023, 12:37pm UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fprotecting-a-private-model-when-using-inference-endpoints%2F34969%2F4 "2023-03-29T12:37:58Z")
Not particularly. You can host the model in the organization, but use a personal account (token) to access it if the account is part of the organization.
---
**Author:**  [@RaphaelK](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2FRaphaelK)%5C
**Post date:** [March 29, 2023, 12:50pm UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fprotecting-a-private-model-when-using-inference-endpoints%2F34969%2F5 "2023-03-29T12:50:23Z")
I just tried this and, using the customer account with a read UAT, I could clone the model git repository. This is what we would like to prevent.
---
**Author:**  [@philschmid](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2Fphilschmid)%5C
**Post date:** [March 29, 2023, 12:59pm UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fprotecting-a-private-model-when-using-inference-endpoints%2F34969%2F6 "2023-03-29T12:59:58Z")
What do you mean by clone? Cloning the repository deployed to the endpoint? Thats not possible. A token who can request the endpoint can also read the repository. You could hide the information which repository is used.
---
**Author:**  [@RaphaelK](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2FRaphaelK)%5C
**Post date:** [March 29, 2023, 1:23pm UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fprotecting-a-private-model-when-using-inference-endpoints%2F34969%2F7 "2023-03-29T13:23:09Z")
Thank you that answers my question. We will hide the repository information then.