unslothai/unsloth · warning · ValueError

Hugging Face token cannot be empty

Error message

Hugging Face token cannot be empty

What it means

Pydantic validation failure (HTTP 422) from the field_validator on HuggingFaceTokenPayload.token. The validator strips whitespace AND quote characters (space, tab, CR, LF, double and single quotes) and rejects the token when nothing remains. The length guard (1-512) runs on the raw value, so a long quoted string can also fail the length check before normalization.

Source

Thrown at studio/backend/routes/settings.py:482

class UploadLimitResponse(BaseModel):
    max_upload_size_mb: int
    max_upload_size_bytes: int
    max_upload_size_label: str
    default_upload_size_mb: int
    min_upload_size_mb: int = MIN_UPLOAD_LIMIT_MB
    max_allowed_upload_size_mb: int = MAX_UPLOAD_LIMIT_MB


class HuggingFaceTokenPayload(BaseModel):
    token: str = Field(..., min_length = 1, max_length = 512)

    @field_validator("token")
    @classmethod
    def normalize_token(cls, value: str) -> str:
        normalized = value.strip(" \t\r\n\"'")
        if not normalized:
            raise ValueError("Hugging Face token cannot be empty")
        return normalized


class HuggingFaceTokenResponse(BaseModel):
    token: Optional[str] = None
    has_token: bool = False


@router.get("/hugging-face-token", response_model = HuggingFaceTokenResponse)
def get_hugging_face_token(
    _current_subject: str = Depends(get_current_subject),
    via_api_key: bool = Depends(authenticated_via_api_key),
) -> HuggingFaceTokenResponse:
    require_ui_session(via_api_key)
    token = credential_secrets.get_hf_token()
    return HuggingFaceTokenResponse(token = token, has_token = token is not None)

View on GitHub (pinned to 203007d190)

Solutions

1. Paste the bare token (typically starts with 'hf_') with no surrounding quotes or whitespace.
2. Strip quotes/whitespace client-side before submit and validate non-empty.
3. If the token field is empty, skip the PUT entirely rather than sending an empty string.

Example fix

// before
await api.put('/settings/hugging-face-token', { token: '"  "' }); // 422

// after
const token = raw.trim().replace(/^["']|["']$/g, '').trim();
if (!token) throw new Error('Token is empty');
await api.put('/settings/hugging-face-token', { token });

const token = raw.replace(/^[\s"']+|[\s"']+$/g, '');
if (!token || token.length > 512) throw new Error('Token empty or too long');
await api.put('/settings/hugging-face-token', { token });

function isValidHfToken(v: unknown): v is string {
  if (typeof v !== 'string') return false;
  const t = v.replace(/^[\s"']+|[\s"']+$/g, '');
  return t.length >= 1 && t.length <= 512;
}

try { await api.put('/settings/hugging-face-token', { token }); }
catch (e) {
  if (e.status === 422) { showFieldError('token', 'Enter the bare token, no quotes/spaces'); return; }
  throw e;
}

When it happens

Trigger: PUT the Hugging Face token endpoint with a value that is only spaces/tabs/newlines, or only quote characters like \" \" or '' — e.g. copy-pasting with surrounding quotes from documentation or a CSV.

Common situations: User pastes '"hf_abc..."' wrapped in quotes from a notes app or shell export line; secrets manager injects an empty/whitespace env var into the form; user clears the field and submits.

Related errors

• Provide either content_base64 or file_ids, not both
• Provide either content_base64 or file_ids
• file_ids must not be empty
• block_id is required when using file_ids
• file_names must be provided and same length as file_ids

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/856c6e30d26ef213. Report an issue: GitHub.