CoachBate Strip API Key Metadata

Here's the uncomfortable fact about ComfyUI: the workflow you used to make an image is baked into the image. Every PNG and video you save carries the full node graph - prompts, seeds, filenames, and every widget value, including any API key you typed into a hosted-service node. Share that file anywhere and the key travels with it. CoachBate Strip API Key Metadata exists because the author's own LTX production chain uses hosted API nodes (things like GemmaAPITextEncode with an api_key widget), and those ltxv_... secrets were ending up in saved files.

The node scrubs those key-shaped strings out of the embedded workflow metadata of a saved PNG or video, in place. It's the "before you share this file" step.

How it works

The scrubber looks for strings matching a ltxv_ + 20+ alphanumeric-underscore pattern, then walks nested JSON structures so a key buried inside a prompt dict or workflow payload gets caught too, not just a top-level field. PNGs are handled via PIL's text chunks; videos get re-muxed with ffmpeg to rewrite the metadata container. The file is sanitized in place, and by default the original is moved to the Recycle Bin first - so a bad scrub doesn't destroy your only copy. Recent releases also hardened it: ffmpeg is now found from the system PATH when VHS doesn't supply one, and a Windows "cannot move file to a different drive" crash was fixed.

Inputs

• file_path - absolute path to a PNG, MP4, MOV, MKV, or WEBM file. Or a folder - pass a folder and it processes every supported file inside it in one execution. Matching outer quotes are stripped automatically.
• send_original_to_recycle_bin - ON by default. Keep it on; you want the safety net.

The outputs

• path - absolute path to the sanitized file.
• changed - True if any API-key strings were actually found and removed, False if the file was clean. Wire this into a note or log to confirm a file is safe.

When you'd actually use this

Drop a finished PNG or MP4 into it before uploading anywhere public - Civitai, a Discord share, a client handoff. The underlying problem is well documented: because the metadata is the workflow, a file you post can leak your full graph including keys. If you run any API-backed node, make this part of your export routine. If everything you use is purely local, you can probably skip it - there's nothing to leak.

Common issues

• "Not found" error - the file doesn't exist at that path. Double-quoted paths are fine (they're stripped), but the path itself must resolve on the machine ComfyUI runs on.
• Video files not being scrubbed - check ffmpeg is available (VHS installed, or ffmpeg on PATH).
• changed always False - either the file is clean or the key didn't match the ltxv_ pattern this node targets.

Installation

Install via ComfyUI Manager (search "CoachBate") or:

cd ComfyUI/custom_nodes
git clone https://github.com/CoachBate/ComfyUI-CoachBate.git

Restart ComfyUI; the node appears under CoachBate in Add Node. No Python dependencies in the pack. If you're scrubbing videos, make sure ffmpeg is reachable (VideoHelperSuite provides it, or it must be on your system PATH). Alpha-stage tooling, but this is one of the more actively maintained nodes in the pack - it gets reliability fixes on a regular cadence.