# Auth suddenly required for model access .... sometimes

**URL:** <https://discuss.huggingface.co/t/auth-suddenly-required-for-model-access-sometimes/169124>\
**Category:** Beginners\
**Created:** [October 13, 2025, 11:23pm UTC](https://discuss.huggingface.co/t/auth-suddenly-required-for-model-access-sometimes/169124 "2025-10-13T23:23:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![LarryMartell](https://avatars.discourse-cdn.com/v4/letter/l/bcef8e/32.png) [@LarryMartell](https://discuss.huggingface.co/u/LarryMartell)\
**Post date:** [October 13, 2025, 11:23pm UTC](https://discuss.huggingface.co/t/auth-suddenly-required-for-model-access-sometimes/169124/1 "2025-10-13T23:23:18Z")

</div>

I have an app that uses Llama Index, QdrantVectorStore, fastembeed, etc. When we initialize it goes out to HF to download the sparse model. This has worked in the past. Now we are getting an error ‘Invalid credentials in Authorization header’ that we never had before. This prompted us to download the models offline into a cache and have the code pick it up from there. Running this snippet downloads the models without needing auth:

```
python3 -c "from fastembed import SparseTextEmbedding; import os; model_name = os.getenv('DEFAULT_SPARSE_EMBEDDING_MODEL_NAME'); cache_dir = os.getenv('FASTEMBED_CACHE_PATH'); \_ = SparseTextEmbedding(model_name=model_name, cache_dir=cache_dir)"

```

But when I try and use this, it still wants to go out to HF to get the sha: model\_info(hf\_source\_repo).sha - and that fails with the same error.

First question I have is why does running that code to download the models not require auth?  
Second question is why do I suddenly need auth and is there a way to use the locally cached models without auth?

---

<div class="post-metadata">

**Author:** ![John6666](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/john6666/32/27664_2.png) [@John6666](https://discuss.huggingface.co/u/John6666)\
**Post date:** [October 14, 2025, 12:00am UTC](https://discuss.huggingface.co/t/auth-suddenly-required-for-model-access-sometimes/169124/2 "2025-10-14T00:00:44Z")

</div>

It appears there have been changes to Hub’s behavior between last year and this year. If you don’t modify existing code, I think the simplest approach is to use [`login`](https://huggingface.co/docs/huggingface_hub/en/guides/cli#hf-auth-login).

* * *

Direct answers:

1. Your one-liner does not require auth because it downloads **public** model files through code paths that allow **anonymous** access and use the local cache if present. No token gets attached, so the request succeeds. ([Hugging Face](https://huggingface.co/docs/huggingface_hub/en/guides/download "Download files from the Hub"))

2. You suddenly “need auth” because a different code path is calling the **Hub metadata API** (e.g., `HfApi().model_info(...).sha`). If any Hugging Face token is present but invalid, `huggingface_hub` automatically adds it to requests. The server then returns **401 “Invalid credentials in Authorization header.”** This started showing up more for users in 2025 and also whenever libraries added metadata lookups before load. You can avoid this either by removing the bad token, forcing offline/local-only, or passing `token=None/False` so the request is anonymous. ([Hugging Face](https://huggingface.co/docs/huggingface_hub/v0.21.2/en/package_reference/hf_api "HfApi Client"))

# Background and context

## How FastEmbed and the Hub interact

- **File downloads** : `hf_hub_download` / `snapshot_download` fetch files and cache them. For **public repos** they work **without** any token. Cached files are then reused. Your one-liner uses this behavior. ([Hugging Face](https://huggingface.co/docs/huggingface_hub/en/guides/download "Download files from the Hub"))
- **Metadata calls** : `HfApi().model_info(repo_id)` queries the Hub REST API for repo metadata and returns a **commit SHA** used for snapshotting. If your environment or keyring has a token, the library **auto-attaches** it. A stale or malformed token triggers 401 even for public repos. ([Hugging Face](https://huggingface.co/docs/huggingface_hub/v0.21.2/en/package_reference/hf_api "HfApi Client"))
- **FastEmbed sparse models** like `prithivida/Splade_PP_en_v1` are public and shown in Qdrant’s docs and examples, so anonymous file fetches and cached use work. ([qdrant.tech](https://qdrant.tech/documentation/fastembed/fastembed-splade/ "Working with SPLADE"))

## Why it worked before and fails now

- **Environment drift** : a token landed in `HF_TOKEN` / `HUGGING_FACE_HUB_TOKEN` or was saved by `huggingface-cli login`, turning formerly anonymous requests into authenticated ones. Env-var tokens **override** stored tokens. Date: docs updated through 2024–2025. ([Hugging Face](https://huggingface.co/docs/huggingface_hub/en/quick-start "Quickstart"))
- **Library changes** : newer releases or upstream code paths started hitting `model_info(...)` to resolve revisions or SHAs before load. Users began reporting 401s in **Mar–Jul 2025** when an invalid token was present. ([GitHub](https://github.com/qdrant/fastembed/issues/498 "[Bug]: Unable to download any models from HF #498"))

# Make cached models work without auth

Pick one. All are valid.

**A) Remove or neutralize the token**

- Unset env vars and logout so calls are anonymous:

**B) Force full offline**

- Set offline mode **before** imports:

**C) Local-only loading via library flags**

- Where supported, pass `local_files_only=True` in the FastEmbed wrapper so underlying Hub downloads never run. Sparse support lagged in 2024, then matured; by 2025 maintainers confirm the flag is propagated. ([GitHub](https://github.com/qdrant/qdrant-client/issues/793 "QdrantFastembedMixin.set\_sparse\_model() does not ..."))

**D) Bypass the Hub API entirely**

- If your stack queries `model_info(...).sha`, skip it by pinning a **known commit** for the model in your config or load by **absolute local path** when your FastEmbed version supports it. Snapshotting by commit avoids revision resolution. ([Hugging Face](https://huggingface.co/docs/huggingface_hub/en/guides/download "Download files from the Hub"))

# Concrete patterns

**Minimal environment for local-only load**

```bash
# cache is prewarmed already
export FASTEMBED_CACHE_PATH=/models/fastembed_cache
export DEFAULT_SPARSE_EMBEDDING_MODEL_NAME=prithivida/Splade_PP_en_v1
export HF_HUB_OFFLINE=1
unset HF_TOKEN HUGGING_FACE_HUB_TOKEN

```

```python
# docs: HF offline + caching; SPLADE usage
# https://huggingface.co/docs/huggingface_hub/en/package_reference/environment_variables
# https://qdrant.tech/documentation/fastembed/fastembed-splade/
from fastembed import SparseTextEmbedding
import os

model = SparseTextEmbedding(
    model_name=os.environ["DEFAULT_SPARSE_EMBEDDING_MODEL_NAME"],
    cache_dir=os.environ["FASTEMBED_CACHE_PATH"],
    # local_files_only=True # if your fastembed version supports it
)

```

([Hugging Face](https://huggingface.co/docs/huggingface_hub/en/package_reference/environment_variables "Environment variables"))

**Keep online, but anonymous**

```python
from huggingface_hub import HfApi
sha = HfApi().model_info("prithivida/Splade_PP_en_v1", token=None).sha

```

This prevents attaching a bad token. ([Hugging Face](https://huggingface.co/docs/huggingface_hub/v0.21.2/en/package_reference/hf_api "HfApi Client"))

**LlamaIndex + Qdrant hybrid with local SPLADE**  
LlamaIndex’s Qdrant hybrid example runs SPLADE locally via FastEmbed; combine it with the env fixes above. ([LlamaIndex](https://developers.llamaindex.ai/python/examples/vector_stores/qdrant_hybrid/ "Qdrant Hybrid Search | LlamaIndex Python Documentation"))

# Operational checklist

- Verify cache is populated under your configured cache dir; the Hub stores **refs** , **snapshots** (by commit), and **blobs**. Date: docs current. ([Hugging Face](https://huggingface.co/docs/huggingface_hub/en/package_reference/file_download "Downloading files"))
- If behind a firewall or air-gapped: expect hangs unless you set `HF_HUB_OFFLINE=1` or `local_files_only=True`; this is a known issue pattern. Date: Apr 30, 2024 report; later fixes propagate the flag. ([GitHub](https://github.com/qdrant/fastembed/issues/218 "Fastembed hangs when used behind firewall even though ..."))
- If you must authenticate: ensure a valid token and scopes; many 401 reports in 2025 were token mistakes. ([Hugging Face Forums](https://discuss.huggingface.co/t/401-error-invalid-credentials-in-authorization-header-flan-t5-large-inference-api/143207 "Invalid Credentials in Authorization Header (Flan-T5-Large ..."))

# Short, high-signal resources

**Issues to watch**

- FastEmbed 401s to Hub, reports beginning **Mar 14, 2025**. ([GitHub](https://github.com/qdrant/fastembed/issues/498 "[Bug]: Unable to download any models from HF #498"))
- Firewall/offline hangs without `local_files_only` ( **Apr 30, 2024** ). ([GitHub](https://github.com/qdrant/fastembed/issues/218 "Fastembed hangs when used behind firewall even though ..."))
- Sparse `local_files_only` gap ( **Sep 26, 2024** ), later propagation ( **Aug 6, 2025** ). ([GitHub](https://github.com/qdrant/qdrant-client/issues/793 "QdrantFastembedMixin.set\_sparse\_model() does not ..."))

**Docs**

- HF download + cache layout and snapshot behavior. Updated 2024–2025. ([Hugging Face](https://huggingface.co/docs/huggingface_hub/en/guides/download "Download files from the Hub"))
- HF env vars and offline mode. Updated 2024–2025. ([Hugging Face](https://huggingface.co/docs/huggingface_hub/en/package_reference/environment_variables "Environment variables"))
- LlamaIndex Qdrant hybrid SPLADE example. Updated 2025. ([LlamaIndex](https://developers.llamaindex.ai/python/examples/vector_stores/qdrant_hybrid/ "Qdrant Hybrid Search | LlamaIndex Python Documentation"))
- Qdrant FastEmbed SPLADE guide. Updated 2024–2025. ([qdrant.tech](https://qdrant.tech/documentation/fastembed/fastembed-splade/ "Working with SPLADE"))

---

<div class="post-metadata">

**Author:** ![LarryMartell](https://avatars.discourse-cdn.com/v4/letter/l/bcef8e/32.png) [@LarryMartell](https://discuss.huggingface.co/u/LarryMartell)\
**Post date:** [October 14, 2025, 12:14am UTC](https://discuss.huggingface.co/t/auth-suddenly-required-for-model-access-sometimes/169124/3 "2025-10-14T00:14:13Z")

</div>

Wow - thanks for the very detailed response.