Hugging Face is where machine-learning models and datasets live: founded in 2016 by Clement Delangue, Julien Chaumond and Thomas Wolf, it hosts the model files that transformers, vLLM, llama.cpp, LM Studio and Ollama pull down when you run an open-weights model, plus the datasets, the Spaces demos and the ZeroGPU compute behind them. It is also one of the few AI services that publishes exactly how it rate-limits, and the numbers are the whole story of whether a proxy is the right tool.
Most sites in this series meter by account and pretend otherwise. Hugging Face meters anonymous traffic by IP address, says so in a table, and then tells you in the same document that the cheapest way past the limit is a token, not an address. This page takes the Hub at its word: the limits as published, the one case where a residential pool genuinely helps, our own observation of the limit firing on free exits, and the quotas no address moves.
The limits, as Hugging Face publishes them
The Hub's rate-limit documentation splits traffic into three buckets and counts each over a five-minute window: Hub API calls, resolver requests (the /resolve/ URLs that download model and dataset files, which is what every local-inference tool actually hits) and page views. The tiers, as listed in September 2025:
| Tier | Hub API | File downloads (resolvers) | Pages | Counted per |
|---|---|---|---|---|
| Anonymous | 500 | 3,000 | 100 | IP address |
| Free account | 1,000 | 5,000 | 200 | account |
| PRO | 2,500 | 12,000 | 400 | account |
| Team organisation | 3,000 | 20,000 | 400 | member |
| Enterprise organisation | 6,000 | 50,000 | 600 | member |
| Enterprise Plus | 10,000 | 100,000 | 1,000 | member |
Exceed a bucket and the Hub returns 429 with RateLimit and RateLimit-Policy headers that tell you the window and what is left; recent versions of the huggingface_hub library read them and wait automatically. The footnote on the anonymous and free rows says they are subject to change depending on platform health, so treat the table as the shape rather than a promise.
Two sentences in that document decide the proxy question. The anonymous row is explicitly per IP address. And the advice section opens with: make sure you always pass an HF_TOKEN, and that it is passed downstream to every library that downloads from the Hub, because a missing token is the number-one reason users get rate limited and a very easy fix.
We watched the limit fire on free exits
On 24 August 2026 we pointed 50 fresh proxies from our free proxy list at the huggingface.co homepage, one request each. Nineteen of the exits that reached the site got a normal page. Three got HTTP 429 on that single request, before we had sent a second one: the anonymous allowance for those addresses, one in Germany, one in Cyprus, one in Saudi Arabia, had already been spent by whoever else was using them. The per-IP rule, in action, and the free pool's problem in one line. A shared address arrives with its window already used.
Why a token beats a pool for almost everyone
Follow the arithmetic. An anonymous address gets 3,000 file downloads per five minutes. A free account, which costs nothing and takes a minute to create, gets 5,000, counted per account, from any address. A PRO account gets 12,000. Every one of those beats buying addresses, because a token multiplies the limit without bandwidth charges and without a second system to run. The Hub's own troubleshooting order is the right one: token first, then spread requests over a longer period, then prefer resolver calls over API calls, then upgrade the plan.
The message continuous-integration runners see makes the same point. A GitHub-hosted runner pulling a model without a token was answered, in a user's report from December 2025, with a note that Hugging Face had to rate limit that IP and that the way to continue was to create an account or log in and pass an HF_TOKEN. Cloud ranges are shared by thousands of jobs; the anonymous allowance for such an address is spent by lunchtime. The fix in the message is a token, and it costs nothing.
Where a pool genuinely helps
Two situations remain where the address, not the account, is the lever.
Anonymous bulk pulls you cannot authenticate. Some pipelines fetch from the Hub without credentials on purpose: a mirror that must stay reproducible from a clean environment, a build that runs where secrets cannot be injected, a crawler over public model metadata that should not carry a personal token. For those, the limit is per IP by design, and spreading the pull across many home addresses gives each one its own anonymous window. Rotating residential exits with backoff on every 429, and the RateLimit headers read rather than guessed, keep each address under the line. Our guide on fixing 429 Too Many Requests behind a proxy covers the retry discipline, and proxies for AI training data covers the sourcing side at scale.
A shared range that is already exhausted. A datacenter or office address whose anonymous window strangers keep spending is a dead end for anonymous requests, whatever your own behaviour. A residential exit with one user starts each window fresh. This is the same shared-address problem that runs through every AI service in this series, and Hugging Face is the rare one that documents the exact size of the bucket.
Everything authenticated is out of scope for a pool. Once the token is in the request, the Hub counts against the account, and a thousand addresses are a thousand requests against one allowance. Organisations get per-member limits rather than shared ones, which is a plan feature, not an address feature.
The quotas no address moves
ZeroGPU. Spaces on ZeroGPU give an unauthenticated visitor two minutes of daily GPU time at low priority, a free account five minutes at medium priority, PRO forty minutes at the highest priority, with Team and Enterprise members at forty and sixty. The quota resets twenty-four hours after first use and, above the included amount, paid tiers can buy more. All of it rides on the account. Whether the unauthenticated two minutes is counted per address is not stated, and either way it is two minutes.
Hosting limits. How many ZeroGPU Spaces you can host, two on a free account in good standing, ten on PRO, fifty for organisations, is an account rule.
Undocumented per-action limits. The Hub says it applies further limits to repository creation, commits, discussions and moderation actions without publishing them. Those attach to what you do with an account, not to where you connect from.
An address moves
The anonymous per-IP allowance
500 API, 3,000 downloads, 100 pages per 5 minutes
A shared range whose window is spent
a residential exit starts fresh
Reachability on a filtered network
and the Chinese government block, at your own risk
Only a token or a plan moves
Authenticated limits
per account, from any address
ZeroGPU minutes and priority
per account
Space hosting counts
per account or organisation
Gated model access
accepted terms on the account
The one country story
Hugging Face restricts nothing by country itself; its terms carry only an export-control clause requiring use in compliance with US and other sanctions law. The block that exists is on the other side: in October 2023 a spokesperson confirmed that the site had become inaccessible in China, said the Chinese AI community was incredible and that the company wished their access was better, and added that there was not much it could do against government regulations. A user in mainland China reaching the Hub through an address elsewhere is stepping around a government filter, which is a question about local law that no proxy company can answer for them, and it is not a rule of Hugging Face's that they would be breaking.
Setting it up, in the right order
- Create a free account and put the token in
HF_TOKEN, then confirm every tool in the chain forwards it. This alone lifts the limits by more than any proxy, and it fixes the CI case outright. - If the job is genuinely anonymous and large, route it through rotating residential exits, honour every 429 with exponential backoff, and read the
RateLimit-Policyheader to size the pace. The Python pattern is in how to use proxies with Python requests; forhuggingface_hubitself, the library respects the standardHTTPS_PROXYenvironment variable. - For an account you use daily from a laptop that moves between networks, one static ISP address keeps it appearing from one place, which is tidy rather than necessary.
- Check any exit with the proxy checker before a large pull, so you are not paying to discover that an address reports the wrong country.
Where HProxy fits
Hugging Face is the service in this series where we most often tell people not to buy. If your 429s come from CI or a shared cloud range, a token fixes them for free. Where a pool belongs, anonymous bulk downloads that must not carry credentials, or a mirror spread across many addresses, our rotating residential exits from $0.44/GB give each address its own anonymous window, and the pricing is metered by the gigabyte, which for model files is the honest unit. One account that should always look like itself belongs on a static ISP proxy, $2.70/IP a month for an address nobody else uses.
Read the rate-limit page, pass the token, and spend on addresses only for the traffic that cannot carry one. That order saves most people the purchase, and it is the order Hugging Face itself recommends.
Sources
- Hugging Face, Hub rate limits: the per-tier table over five-minute windows, anonymous limits per IP address, the 429 and RateLimit headers, and the advice that a missing HF_TOKEN is the number-one cause of rate limiting.
- Hugging Face, ZeroGPU Spaces: daily GPU quotas by tier and hosting limits.
- Hugging Face, Terms of Service: the export-control clause.
- GitHub, llama.cpp issue 18108, 16 December 2025: the rate-limit message seen by a CI runner's IP, as reported by a user.
- Semafor, Hugging Face confirms China blocked it, 20 October 2023.
- Wikipedia, Hugging Face, for the founding.
- HProxy measurement, 24 August 2026: 50 free proxies from our list pointed at https://huggingface.co/; 19 received a normal page and 3 received HTTP 429 on the first request.