Workflow1111 — Automatic1111-style diffusion studio on gr.Workflow

README.md

@@ -349,32 +349,44 @@ endpoint list with parameter names and types.
 
 The Space holds **no** `HF_TOKEN` secret. In the browser, the Sign-in button
 supplies your token through OAuth; every other caller sends it on the request.
-Two hooks make that work:
+Two hooks make that work: each node that hits Inference Providers takes a
+`request: gr.Request` parameter and reads the token in `nodes.py`
+(`_hf_token`), and `app.py` extends gradio's own `_resolve_token` (used for the
+`model`/`space` nodes gradio runs itself) with the same fallback.
 
-* every node that talks to Inference Providers declares a `request: gr.Request`
-  parameter, and `_hf_token()` in `nodes.py` resolves the token in this order:
-  OAuth session → `X-HF-Token` header → `X-HF-Authorization: Bearer` header →
-  `Authorization: Bearer` header → server `HF_TOKEN` → local `hf auth login`;
-* `app.py` extends gradio's own `_resolve_token` (used for `model` and `space`
-  nodes, which gradio runs itself) with the same header fallback.
-
-`gradio_client` sends your token as `X-HF-Authorization` (it renames the
-`Authorization` header so the Hub proxy never sees it), so the ordinary
-`token=` argument just works — and so does the locally saved `hf auth login`
-token, which the client sends by default:
+**Which header to send.** On a Space the Hub proxy passes `X-HF-Token` and
+`Authorization: Bearer` through to the app but **strips `x-hf-authorization`**.
+`gradio_client`'s `token=` argument (and therefore `gradio predict --token`)
+sends the token *as* `x-hf-authorization`, so that path does **not**
+authenticate against this Space — use `X-HF-Token` instead:
 
 ```python
 from gradio_client import Client
 
-client = Client("https://ysharma-workflow1111.hf.space")          # uses `hf auth login` token
-client = Client("https://ysharma-workflow1111.hf.space", token="hf_...")
-prompt = client.predict("an orange cat with a yellow hat", api_name="/generated_prompt")
+# WORKS — token sent as X-HF-Token
+client = Client("https://ysharma-workflow1111.hf.space", headers={"X-HF-Token": "hf_..."})
+client.predict("an orange cat with a yellow hat", api_name="/generated_prompt")
+
+# does NOT work on a Space — token goes out as x-hf-authorization (stripped by the proxy)
+# client = Client("https://ysharma-workflow1111.hf.space", token="hf_...")
+```
+
+curl works with either header:
+
+```bash
+curl -s -X POST https://ysharma-workflow1111.hf.space/gradio_api/call/generated_prompt   -H "X-HF-Token: hf_..." -H "Content-Type: application/json"   -d '{"data": ["an orange cat with a yellow hat"]}'
 ```
 
-From the terminal (needs `typer>=0.15`; `gradio info <url>` prints the payload shapes):
+**From the `gradio` CLI.** `gradio info <url>` prints every endpoint's payload
+shape and needs no token. `gradio predict` runs a call, but its only auth knob
+is `--token`, which the proxy strips (above) — so `gradio predict` can reach
+this Space's token-free plumbing but cannot authenticate the model nodes. For a
+scripted authenticated call, use the `gradio_client` `headers={"X-HF-Token"}`
+snippet or curl instead. (`gradio info`/`predict` need `typer>=0.15`; older
+typer crashes with `Type not yet supported: str | None`.)
 
 ```bash
-gradio predict https://ysharma-workflow1111.hf.space /generated_prompt '{"in_0": "an orange cat with a yellow hat"}'
+gradio info https://ysharma-workflow1111.hf.space
 ```
 
 MCP clients forward custom headers verbatim, so use `X-HF-Token` there

nodes.py

@@ -632,11 +632,16 @@ def _caller_hf_token(request):
     without the Space holding a token of its own. Two spellings are accepted:
 
       * ``X-HF-Token: hf_...``               (custom header, e.g. MCP configs)
-      * ``X-HF-Authorization: Bearer hf_...`` (what ``gradio_client`` and the
-        ``gradio predict`` CLI send for ``token=`` / ``--token`` / the locally
-        saved ``hf auth login`` token — the client renames ``Authorization``
-        to this so the Hub proxy never sees it)
-      * ``Authorization: Bearer hf_...``      (plain HTTP callers)
+      * ``Authorization: Bearer hf_...``      (plain HTTP callers, e.g. curl)
+      * ``X-HF-Authorization: Bearer hf_...`` (what ``gradio_client`` / the
+        ``gradio predict`` CLI send for ``token=`` / ``--token``)
+
+    NOTE: on Hugging Face Spaces the reverse proxy STRIPS ``x-hf-authorization``
+    before it reaches the app, so ``gradio_client(token=...)`` and
+    ``gradio predict --token`` do NOT authenticate here — pass ``X-HF-Token``
+    (``gradio_client(headers=...)``) or a raw ``Authorization: Bearer`` instead.
+    The header is still honored when this app runs OUTSIDE a Space (local / any
+    host without that proxy), which is why it stays in the list.
     """
     headers = getattr(request, "headers", None)
     if not headers: