compose_song: use visitor OAuth token for the LLM step

- token: gr.OAuthToken param injected by gr.Workflow (excluded from canvas
ports); bills the signed-in visitor's own inference quota.
- Falls back to the Space's HF_TOKEN secret for anonymous/local runs, with a
clear gr.Error when neither is available.
- README: hf_oauth_scopes: [inference-api].

README.md

@@ -9,6 +9,8 @@ app_file: app.py
 pinned: true
 suggested_hardware: zero-a10g
 hf_oauth: true
+hf_oauth_scopes:
+ - inference-api
 ---
 
 # MiniMax Music 3 — diffusers demo as a `gr.Workflow`
@@ -21,7 +23,9 @@ prompting guide) → `generate_song` (`@spaces.GPU` ZeroGPU worker: AR frames
 wav) → Output Song / Seed Used / Stats → `make_video` (CPU ffmpeg visualizer) → Share Video.**
 
 Seed, randomize-seed, flow-matching steps, guidance scale, duration, and video title are editable reference
-nodes. `hf_oauth: true` lets the owner edit the canvas; visitors can run the pipeline. The original Blocks app
+nodes. `hf_oauth: true` lets the owner edit the canvas; visitors sign in to run the pipeline, and the
+`compose_song` LLM step uses the visitor's own OAuth token (`inference-api` scope), so inference bills the
+visitor directly. Set an `HF_TOKEN` secret if you want anonymous/local runs to fall back to the owner's token. The original Blocks app
 (with the live-streaming PCM player) is preserved as `app_blocks.py` — workflow fn nodes are plain callables,
 so chunk-by-chunk streaming is replaced by a final audio subject.
 

app.py

@@ -496,12 +496,20 @@ Given a sound instruction and/or lyrics, produce global_metadata, vocal_details
 Answer with ONLY a JSON object with keys: global_metadata, vocal_details, arrangement."""
 
 
-def _llm_json(system, user):
+def _llm_json(system, user, token=None):
     import json as _json
 
     from openai import OpenAI
 
-    client = OpenAI(base_url="https://router.huggingface.co/v1", api_key=os.environ["HF_TOKEN"])
+    # Prefer the visitor's OAuth token (hf_oauth + inference-api scope bills the visitor
+    # directly); fall back to the Space owner's HF_TOKEN secret for local/anonymous runs.
+    api_key = getattr(token, "token", None) or os.environ.get("HF_TOKEN")
+    if not api_key:
+        raise gr.Error(
+            "Sign in with Hugging Face to compose (the LLM step bills your own account), "
+            "or ask the Space owner to add an HF_TOKEN secret."
+        )
+    client = OpenAI(base_url="https://router.huggingface.co/v1", api_key=api_key)
     completion = client.chat.completions.create(
         model="MiniMaxAI/MiniMax-M3:fastest",
         messages=[{"role": "system", "content": system}, {"role": "user", "content": user}],
@@ -512,10 +520,12 @@ def _llm_json(system, user):
     return _json.loads(text)
 
 
-def compose_song(description, duration):
+def compose_song(description, duration, token: gr.OAuthToken = None):
+    # `token` is injected by gr.Workflow (OAuthToken params are excluded from the canvas
+    # ports and filled with the signed-in visitor's OAuth token at run time).
     if not description.strip():
         raise gr.Error("Describe the song you want first.")
-    data = _llm_json(_COMPOSER_SYSTEM, f"Song description: {description}\nTarget duration: {int(duration)} seconds.")
+    data = _llm_json(_COMPOSER_SYSTEM, f"Song description: {description}\nTarget duration: {int(duration)} seconds.", token)
     return data["lyrics"], data["global_metadata"], data["vocal_details"], data["arrangement"]