Download Token Loader

Read the source before you trust this one, because the node's own labels will lie to you. Download Token Loader exists to hand a Hugging Face access token to the pack's Downloader node so you can pull gated models - the ones that make you accept license terms before the files become downloadable. That's a genuinely useful job. The problem is how it goes about it.

What it actually does. It has two inputs: value (a string) and type, an enum with three choices: plain, environment variable, and path to file. Output is a single token (STRING) that feeds straight into the Downloader's token input. But look at the shipped code and the branches don't match their names:

• environment variable - resolves value as the name of an environment variable. This one works, and it's the branch you should use. If the variable isn't set, you get None, which the Downloader treats as no token.
• plain - despite the name, this branch tries to open value as a file path and read it. Type a literal token here and the node dies with FileNotFoundError.
• path to file - despite the name, this branch does nothing special. It returns the path string itself as your "token."

In other words, the plain and path-to-file behaviors are swapped: plain expects a file, and path-to-file just echoes the path back. That's not a documented design choice, that's a bug, and it's still present in the repo. So the only reliable source type is the environment variable.

The version that works.

# in your shell, before launching ComfyUI
export HF_TOKEN=hf_xxxxxxxxxxxxxxxxx

Then set the node's value to HF_TOKEN and type to environment variable. Wire the token output into a Downloader whose URL starts with https://huggingface.co - that's the only domain where the Downloader attaches the token, as a Bearer header. For gated repos, accept the terms on the model's Hugging Face page first; the token alone isn't enough otherwise.

Two things the console will tell you. The node print()s the resolved value at the end, so whatever secret you load lands in your ComfyUI logs - another reason to prefer an env var over hardcoding. And remember that ComfyUI workflow files are JSON (or PNG metadata), and a token typed into a node widget gets embedded in that file. Share the workflow and you've shared the token. Environment variables keep it out of the file entirely.

Installing. Same pack as its siblings - stavsap/comfyui-downloader. Search "comfyui-downloader" in ComfyUI Manager, or:

cd ComfyUI/custom_nodes
git clone https://github.com/stavsap/comfyui-downloader

Then restart. Dependencies are just requests and tqdm, so nothing heavy installs with it.

The verdict: the node is broken in two of its three modes, and it prints secrets to the console in the one mode that works. If you need gated Hugging Face downloads, use it with an environment variable and you're fine. If you're tempted by the other modes, save yourself the FileNotFoundError and don't.