Workflow1111 — Automatic1111-style diffusion studio on gr.Workflow

README.md

@@ -348,18 +348,26 @@ endpoint list with parameter names and types.
 ### Bring your own token (API and MCP callers)
 
 The Space holds **no** `HF_TOKEN` secret. In the browser, the Sign-in button
-supplies your token through OAuth; API and MCP callers supply it on the
-request instead. Every node that talks to Inference Providers declares a
-`request: gr.Request` parameter, and `_hf_token()` in `nodes.py` looks for
-the token in this order: OAuth session → `X-HF-Token` header →
-`Authorization: Bearer` header → server `HF_TOKEN` → local `hf auth login`.
-Gradio's MCP server forwards the caller's headers verbatim, so the same
-header works for tools.
+supplies your token through OAuth; API and MCP callers send it on the request
+as an `X-HF-Token` header instead. Two hooks make that work:
+
+* every node that talks to Inference Providers declares a `request: gr.Request`
+  parameter, and `_hf_token()` in `nodes.py` resolves the token in this order:
+  OAuth session → `X-HF-Token` header → `Authorization: Bearer` header →
+  server `HF_TOKEN` → local `hf auth login`;
+* `app.py` extends gradio's own `_resolve_token` (used for `model` and `space`
+  nodes, which gradio runs itself) with the same header fallback.
+
+Gradio's MCP server forwards the caller's headers verbatim, so the same header
+works for tools. Use `X-HF-Token`, not `Authorization: Bearer`: the Spaces
+proxy consumes the `Authorization` header before it reaches the app (it does
+work when running locally).
 
 ```python
 from gradio_client import Client
 
-client = Client("https://ysharma-workflow1111.hf.space", token="hf_...")  # sends Authorization: Bearer
+client = Client("https://ysharma-workflow1111.hf.space",
+                headers={"X-HF-Token": "hf_..."})
 prompt = client.predict("an orange cat with a yellow hat", api_name="/generated_prompt")
 ```
 

app.py

@@ -79,6 +79,21 @@ import gradio as gr
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import nodes  # noqa: E402
 
+# API/MCP callers authenticate per request with an `X-HF-Token` header (see
+# `nodes._hf_token`). The four `model`/`space` nodes are run by gradio itself,
+# whose `gradio.workflow._resolve_token` only knows OAuth sessions and the local
+# write-token — so extend it here to fall back to the caller's header token.
+import gradio.workflow as _gw  # noqa: E402
+
+_orig_resolve_token = _gw._resolve_token
+
+
+def _resolve_token_with_header(data, idx, token, request=None):
+    return _orig_resolve_token(data, idx, token, request) or nodes._caller_hf_token(request)
+
+
+_gw._resolve_token = _resolve_token_with_header
+
 HERE = os.path.dirname(os.path.abspath(__file__))
 WORKFLOW = os.path.join(HERE, "workflow.json")
 

nodes.py

@@ -631,9 +631,10 @@ def _caller_hf_token(request):
     the caller's headers verbatim — so a client can authenticate per call
     without the Space holding a token of its own. Two spellings are accepted:
 
-      * ``X-HF-Token: hf_...``          (custom header; shown in MCP configs)
+      * ``X-HF-Token: hf_...``          (custom header; works everywhere)
       * ``Authorization: Bearer hf_...`` (what ``gradio_client`` sends for
-        ``Client(..., hf_token=...)``)
+        ``Client(..., token=...)``; fine locally, but the Spaces proxy
+        consumes this header, so on a Space use ``X-HF-Token``)
     """
     headers = getattr(request, "headers", None)
     if not headers: