Basic Auth Setup

ComfyUI ships with zero authentication. If anything can reach the port it's listening on - your LAN, a shared box, a forwarded port, a public IP - anyone can hit the API and run arbitrary workflows on your GPU. That's not hypothetical; the community's "please secure your ComfyUI instance" PSAs exist because people exposed it to the internet and got their machines turned into crypto miners. Basic Auth Setup from fofr's comfyui-basic-auth pack is the five-minute fix: a username and password in front of the whole server.

Before you get excited, know the honest framing: the node you drag into your workflow is the least important part of this pack. The actual authentication is a middleware that installs itself the moment ComfyUI starts, long before any graph runs. The BasicAuthSetup node is basically a bookmark that lives in your workflow so you can see "auth is on" - the real work is invisible.

How it actually works

Peek at basic_auth.py and the picture clears up. On import, the pack grabs ComfyUI's aiohttp app (server.PromptServer.instance.app) and inserts a middleware at position zero. That middleware checks two environment variables, COMFYUI_USERNAME and COMFYUI_PASSWORD. If both are set, every HTTP request must carry a valid Authorization header or it gets a 401 back with a WWW-Authenticate: Basic realm="ComfyUI Server" challenge. Correct credentials, and the request passes through to the queue, the API, the whole UI.

A few mechanism details matter:

• The /ws WebSocket path is skipped. The middleware explicitly lets WebSocket connections through unauthenticated. The web UI needs that socket for queue updates, so it's a deliberate trade-off - just know it's there.
• Credentials are base64, not encrypted. Basic auth is username:password base64-encoded in the header. Anybody sniffing plain HTTP can read it in seconds. The README is upfront about this, and it's the single biggest reason this is a "good enough for your LAN / a casual remote box" tool, not a production security product.
• No dependencies beyond what ComfyUI already has. There's no requirements.txt in the repo; it uses aiohttp and os, both already in a stock install. No models, no weights, nothing heavy.

The one input and the one output

The node takes exactly one input:

• enabled (boolean, default true) - and here's the trap: toggling it in your workflow does nothing to actual authentication. The middleware's own "enabled" flag is computed from whether both env vars are set, at server start. The node just returns a {"enabled": ...} dict that nothing in ComfyUI consumes. Leave it on; it's a marker, not a switch.

Its output is a single BASIC_AUTH value, and since the node is marked OUTPUT_NODE, it sits at the end of a graph like a finished output. There's nothing to wire it into. If that feels anticlimactic, welcome to utility nodes - the value is the middleware it drags along with it.

Installing it

The README's way:

cd ComfyUI/custom_nodes/
git clone https://github.com/fofr/comfyui-basic-auth

Then restart ComfyUI. It's also on the Comfy Registry (it publishes via the official workflow), so ComfyUI Manager works too: search "ComfyUI-Basic-Auth" in Manager's Custom Nodes list and install from there. Either path, no model downloads, no pip packages.

Now set the credentials in the same shell that launches ComfyUI - this is where people get burned:

export COMFYUI_USERNAME=myuser
export COMFYUI_PASSWORD="a long random string"

On Windows, use set COMFYUI_USERNAME=myuser in the terminal you run the .bat from, or set them as system environment variables. Restart the server, open the web UI, and you'll get the browser's login prompt.

Troubleshooting

• Auth never prompts. The env vars weren't in the environment ComfyUI actually started with - check your launch script, systemd unit, or Docker -e flags, then restart. The middleware reads them once, at process start.
• Login prompt loops or rejects you. Wrong credentials, or a stale cached session - a browser will happily cache basic auth credentials for a site, so try incognito or a different browser before assuming the pack broke.
• You turned enabled off and it's still locked. See above: the toggle is cosmetic; kill the env vars and restart if you actually want it off.

Is this enough?

For "I want my ComfyUI box to not be an open door," yes - it stops the drive-by GPU hijackers. But a lock on the door isn't a security system. Pair it with HTTPS (a Caddy or nginx reverse proxy with a cert, or an SSH tunnel for remote use) so the credentials aren't flying around base64-encoded. And remember it does nothing about the other big ComfyUI hazard: malicious custom nodes. No middleware can protect you from a node that runs arbitrary Python on import - that's a "who do you trust" problem, not an auth problem. Basic Auth Setup is the blunt, effective first layer, and for most people that's exactly what they need.