CYAI 创建真人认证会话

Every other node in this pack can run unattended at 3am. This one can't, and it never will, because its output is a link you have to hand to an actual person who then has to hold a phone up to their face. If you've hit the may contain real person wall on Seedance and you're working with someone's actual likeness - a client, an actor, yourself - this is step one of the only legitimate way through it.

The mechanism: Volcengine won't host a real person's face as a mere asset. It has to sit in a group that was created after a liveness check proved the uploader is the person in the photos. So the platform hands you a hosted verification page, the person completes it, and the platform quietly creates the group for you. This node opens that session.

How it works

One call - CreateVisualValidateSession on the Action endpoint, POST {base_url}/api/?Action=CreateVisualValidateSession&Version=2024-01-01 - with two fields in the body: your CallbackURL and a ProjectName. The response carries H5Link and BytedToken.

H5Link is a mobile-friendly web page. Send it to the person on WeChat, WhatsApp, email, whatever; they open it on a phone, do the standard look-at-the-camera liveness dance, and it's done - entirely outside ComfyUI, on their time, with no software for them to install.

BytedToken is the session handle. It's the only thing that lets you come back later and ask "did they do it yet, and what group did they get?", which is exactly what the matching CYAI 查询认证结果 node does with it.

Worth being explicit about what the callback_url is not: the node never receives a callback. ComfyUI isn't listening on a public endpoint for platform webhooks, and this pack doesn't ship a webhook receiver. The field is required by the node (it raises callback_url 不能为空 before it'll run) and by the upstream call, but the result you actually use comes from polling, not from a push. Give it a real-looking address you control for audit purposes and move on.

Inputs and outputs

Four required fields, no optionals: api_key, base_url, callback_url, project_name. That's the whole node.

Two STRING outputs: h5_link and byted_token. Wire byted_token into the next node's byted_token input and the two-node chain does the whole thing. Wire h5_link into a text-display node so you can select and copy the URL - a bare string output that nothing consumes means the node won't execute at all.

If the response comes back without a token, the node raises with the raw upstream payload attached. That's usually a key/permission problem rather than a typo, because the session call has nothing user-provided in it except the callback and the project name.

Installing it

Part of the pack:

cd ComfyUI/custom_nodes
git clone https://github.com/Gin3601/comfyui_transit_node.git

Restart ComfyUI, find it under CYAI/Asset. No dependencies, no downloads. Manager users can search CYAI Seedance and install the whole set at once.

Where people get burned

Do not queue this inside a long pipeline and walk away. The node itself returns immediately - the session creation is fast - but the very next node sits polling for a human, so the practical plan is: run this bit, send the link, wait for the person, then run the query. Splitting the graph into two runs is not a hack; it's the intended shape of a workflow that has a human in the middle of it.

Mismatched project_name will strand your session. The session is created under a project and the result is queried under a project; the pack defaults both to default, so leave them alone unless you deliberately scoped everything - including the upload node - to something else.

One verification per person, not per image. The group this produces is what makes every asset of that person acceptable. Don't build a workflow that re-verifies per shot; build one that verifies once, notes the group id, and reuses it. That's the whole reason the flow is split across nodes instead of hidden inside the upload step.

This is biometric data changing hands. The check happens on Volcengine's hosted page through a relay, and whatever it captures goes to ByteDance, not to you. If that sentence bothers you, the alternative is not doing photoreal likeness work with this model at all.