nxj18
Bearer-token auth for API access: keys from the VALID_API_KEYS secret (one per line), constant-time compare, fails closed on missing/invalid Authorization; document gradio_client/raw-HTTP usage
dca4d05 | title: Joy Caption Beta One | |
| emoji: 🖼️💬 | |
| colorFrom: yellow | |
| colorTo: blue | |
| sdk: gradio | |
| sdk_version: 5.29.0 | |
| app_file: app.py | |
| pinned: false | |
| Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference | |
| ## API-key auth | |
| This Space requires bearer authentication for anything that runs the model or touches files (`/gradio_api/queue`, `/gradio_api/call`, `/gradio_api/upload`, `/gradio_api/file`, and legacy equivalents). Page load and API discovery stay open, so the UI renders but the Caption button returns 401 without a key. | |
| Setup: add a Space **secret** named `VALID_API_KEYS` containing the valid keys, **one key per line**. Blank lines are ignored. If `VALID_API_KEYS` is missing or empty the Space fails closed and rejects every protected request. | |
| Calling with `gradio_client`: | |
| ```python | |
| from gradio_client import Client, handle_file | |
| client = Client("<owner>/<space>", headers={"Authorization": "Bearer <your-key>"}) | |
| result = client.predict( | |
| input_image=handle_file("photo.jpg"), | |
| prompt="Write a detailed description for this image.", | |
| temperature=0.6, top_p=0.9, max_new_tokens=512, log_prompt=False, | |
| api_name="/chat_joycaption", | |
| ) | |
| ``` | |
| Or raw HTTP: send `Authorization: Bearer <your-key>` on `POST /gradio_api/call/chat_joycaption` and the follow-up `GET /gradio_api/call/chat_joycaption/{event_id}`. | |