Update credentials.md per @mxinO review on PR #1239

Edwardf0t1 · Edwardf0t1 · commit 634ac7d8c103 · 2026-04-26T20:54:51.000-07:00
Two small additions:

1. New "Check what's already set first" section — most users already have
   HF_TOKEN, docker login, or enroot credentials in place from prior work.
   Provides four one-liner detection commands so the agent skips sections
   that are already configured.

2. Document `hf auth login` as the recommended interactive way to persist
   the HF token at `~/.cache/huggingface/token`. The HF Python client and
   `transformers`/`datasets` read this file automatically — many users
   never need HF_TOKEN in env. Kept the env-var path as option 2 for
   scripts/CI and remote sessions.

Signed-off-by: Zhiyu Cheng &lt;zhiyuc@nvidia.com&gt;
diff --git a/.claude/skills/common/credentials.md b/.claude/skills/common/credentials.md
@@ -2,17 +2,44 @@
 
 Tokens and registry credentials that ModelOpt workflows need across local and cluster environments. Not SLURM-specific — referenced from PTQ, deployment, evaluation, and slurm-setup skills.
 
+## Check what's already set first
+
+Before configuring anything, check what the user already has — many of these are likely in place from prior `hf auth login`, `docker login`, or previous SLURM work. Skip any section below for which credentials are already present.
+
+```bash
+# HF token: env var or persisted from `hf auth login`
+[ -n "$HF_TOKEN" ] && echo "✓ HF_TOKEN set in env"
+[ -s ~/.cache/huggingface/token ] && echo "✓ HF token at ~/.cache/huggingface/token (from 'hf auth login')"
+
+# Docker / NGC registry credentials
+grep -qE '"(nvcr\.io|https://index\.docker\.io)"' ~/.docker/config.json 2>/dev/null && echo "✓ Docker login present"
+
+# Enroot / pyxis credentials (on cluster login node, for SLURM users)
+grep -qE '^machine nvcr\.io ' ~/.config/enroot/.credentials 2>/dev/null && echo "✓ Enroot NGC entry present"
+```
+
+For remote clusters, run the same checks via SSH (`ssh <cluster-login> '<check>'`) — credentials live on the cluster, not your workstation.
+
 ## HuggingFace token (`HF_TOKEN`)
 
 Required for gated models (e.g., Llama, Mistral, some Nemotron variants) and gated datasets (e.g., GPQA, HLE).
 
-Generate at <https://huggingface.co/settings/tokens>, then export:
+Generate at <https://huggingface.co/settings/tokens>. Two persistence options (you can use either or both):
 
-```bash
-export HF_TOKEN=hf_...
-```
+1. **`hf auth login`** (recommended for interactive use) — stores the token at `~/.cache/huggingface/token`. The HF Python client picks it up automatically; `transformers`, `datasets`, and the `hf` CLI all read this file without needing `HF_TOKEN` in the env.
+
+   ```bash
+   pip install -U huggingface_hub
+   hf auth login   # paste the token interactively
+   ```
+
+2. **Environment variable** (good for scripts, CI, and remote sessions):
+
+   ```bash
+   export HF_TOKEN=hf_...
+   ```
 
-Persist in `~/.bashrc` or a project-local `.env` file. For remote clusters, check whether the cluster's shell config already sets it: `ssh <cluster-login> 'env | grep -c HF_TOKEN'`.
+   Persist in `~/.bashrc` or a project-local `.env` file. `HF_TOKEN` takes precedence when both are present.
 
 ## NGC API key (for `nvcr.io`)
 
