Streaming datasets fail with 403 SignatureError: invalid key pair id from xet-bridge-us (Colab, latest libraries)

### Describe the bug

I'm unable to stream datasets from the Hugging Face Hub. The issue affects both public datasets (e.g. beans) and gated datasets (ILSVRC/imagenet-1k).

The failure occurs before any examples are yielded. The request is redirected to the Xet CDN (xet-bridge-us) and fails with:

```
403 Forbidden

Auth failed: SignatureError: invalid key pair id
```

This started around July 13–14, 2026. The same notebooks had been working previously.

### Steps to reproduce the bug

```
from datasets import load_dataset

ds = load_dataset(
    "AI-Lab-Makerere/beans",
    split="train",
    streaming=True,
    token=True,
)

next(iter(ds))
```

fails immediately. 

Likewise,

```
from datasets import load_dataset

dataset = load_dataset(
    "ILSVRC/imagenet-1k",
    split="train",
    streaming=True,
)

for i, x in enumerate(dataset):
    print(i)
```

fails immediately.

The request is made against https://us.gcp.cdn.hf.co/xet-bridge-us/... and returns:

```
403 Forbidden

Auth failed:
SignatureError: invalid key pair id
```

The traceback ends with:

``'
HfHubHTTPError:

403 Forbidden

Cannot access content at:
https://us.gcp.cdn.hf.co/xet-bridge-us/...

Auth failed:
SignatureError: invalid key pair id
'``

The URL also contains: Key-Pair-Id=01KXEF4KZ1B6FV465MAWR4M21F

### Expected behavior

Streaming public datasets should work without returning

```
403 Forbidden

Auth failed:
SignatureError: invalid key pair id`
``

### Environment info

- `datasets` version: 5.0.0
- Platform: Linux-6.6.122+-x86_64-with-glibc2.35
- Python version: 3.12.13
- `huggingface_hub` version: 1.23.0
- PyArrow version: 25.0.0
- Pandas version: 2.2.2
- `fsspec` version: 2025.3.0


Hi ! I couldn't reproduce the issue on my side. I can see two options, let me know if any helps you:

1) this was a transient issue (we restarted some machines recently but this shouldn't have impacted you tbh), can you try again just in case ?
2) something is wrong with your token smh, can you logout and login again ?

Let me know if the issue persists

Thanks for looking into it!

I've already tried both of your suggestions:

- I restarted the Colab session multiple times with fresh runtimes, the error still persisted (started yesterday about 14 hours ago, still happening)
- Logged out and back into Hugging Face (huggingface-cli logout / login) and verified that my token works. I've even tried doing it without a token using public datasets to no avail.

Small downloads (like the README.md) do work, but any type of streaming doesn't. I've replicated this with both ILSVRC/imagenet-1k (using  my token) and AI-Lab-Makerere/beans , both don't work.

If there's any additional logging or environment information that would help, I'm happy to provide it.


I am also running into the same issue, flakily depending on which redirect server is being chosen, from GCP VMs. 
Also reported here: https://github.com/huggingface/xet-core/issues/897

Have there been no work arounds? Do we just have to wait?

@mahmoud-mannes for me, `HF_HUB_DISABLE_XET=0` seems to work; issue only occurs when it's redirected to XET and XET is disabled. 

Same error via `diffusers` on Colab, so this isn't specific to `datasets`: same `Key-Pair-Id: 01KXEF4KZ1B6FV465MAWR4M21F`, `huggingface_hub` 1.23.0, Python 3.12.13.

Two observations that might help narrow it down:

- It also hits **public** repos (`stable-diffusion-v1-5/stable-diffusion-v1-5`), on presigned URLs carrying `user_id=public`, and it happens with and without a token.
- It is **intermittent**: the same file 403s, then downloads fine minutes later.

`HF_HUB_DISABLE_XET=1` does not avoid it — you are still redirected to `xet-bridge-us` — but you get the 403 as an **exception** instead of a download that stalls part-way and never times out. That made a retry loop possible, and since the cache resumes, it does eventually get through:

```python
import os
os.environ["HF_HUB_DISABLE_XET"] = "1"   # before huggingface_hub is imported

import time

def fetch(call, retries=40):
    for attempt in range(1, retries + 1):
        try:
            return call()
        except Exception as exc:
            if "SignatureError" not in str(exc) or attempt == retries:
                raise
            time.sleep(3)
```

Not a fix, but it unblocked a multi-GB checkpoint download for me.

Same error  on Colab while streaming:

- `403 Forbidden` from `https://us.gcp.cdn.hf.co/xet-bridge-us/...`
- `Auth failed: SignatureError: invalid key pair id`
- `Key-Pair-Id=01KXEF4KZ1B6FV465MAWR4M21F`

Looks like the same GCP CDN signing issue as huggingface/xet-core#897.

Hi ! Thanks we are in the process of restarting our CDN for gcp / google colab. It should be back soon, sorry for the inconvenience

Seems to work again

Yes it’s working 

Same issue here with `hf_hub_download` on a private dataset repo, from Google Colab.

- Requests are redirected to `https://us.gcp.cdn.hf.co/xet-bridge-us/...`
  and fail with `403 Forbidden — Auth failed: SignatureError: invalid key pair id`
- Same `Key-Pair-Id=01KXEF4KZ1B6FV465MAWR4M21F` as the OP
- Started around July 13–14, 2026. Same notebook had been working fine before with no code changes
- Still reproducible as of July 15, 2026
- Request IDs: `01KXFP39MES5SH6ZTBR3TC8CFS`, `01KXFP3KXQFG20PPBF1QVZBQBQ`, `01KXFP47YXK7824D1V9BS6TFRH`, `01KXFQ1EKJMK4MEP49RC0QW9TN`
- `huggingface_hub`: 1.20.1
- `hf-xet`: 1.5.1
- Python 3.12, Google Colab