📦⚙️ DropSend - Setup Node

DropSendSetup is the boring node you run exactly once per machine - and the one people trip over, because it's a two-run OAuth ceremony with a deliberate security gate. It takes your Dropbox app's credentials, walks you through authorizing at Dropbox, and hands you a long-lived refresh token. Then it either writes that to a local .env file or shows it in a browser-only panel so you can stash it in your cloud platform's secrets manager.

Why it exists at all: Dropbox's API doesn't do "log in forever." The sibling AutoUploader node needs credentials to push files on your behalf, but you don't want tokens typed into every workflow and baked into PNG metadata. So this node does the ceremony once and stores the result somewhere the uploader can read - and it's the only node that knows how to create or rotate those credentials.

The mechanism (and the security story)

The setup flow works like this: click Set credentials… on the node, paste your Dropbox App Key and App Secret into a browser modal, run the workflow. The node prints an OAuth URL (via a popup, the terminal banner, or the node's STRING output), you authorize at Dropbox, copy the auth code it shows you, paste it into the second modal that auto-opens, and run again. Run two exchanges the code for a refresh token.

Two details make this worth reading past the first paragraph:

Your secrets are not workflow inputs. App Key, App Secret, and Auth Code never appear as node fields. That's a deliberate design - earlier versions of this pack accepted them as normal inputs, and on a network-reachable ComfyUI host that leaked credentials into saved workflow JSON, PNG metadata, and ComfyUI's unauthenticated /history endpoint. The v1.1.0 advisory told everyone affected to treat their keys as compromised. The current version funnels credentials through a same-origin modal that never touches the workflow at all. Respect that architecture: if something asks you to type your App Secret into a node field, that's a different, older version.

The COMFYUI_DROPSEND_ALLOW_SETUP=1 gate. The node refuses to write or clear any credentials unless this environment variable is set in the shell that launches ComfyUI. It's a guard against a hostile remote workflow wiping your connection or swapping in an attacker's Dropbox app. Set it, run setup, then you can unset it - the AutoUploader doesn't need it.

The inputs

Three knobs, none of them secrets:

• storage_method - env_file writes the values to .env in the plugin directory at mode 0600 (local installs only). display_only (default) shows them in a one-shot browser panel and writes nothing to disk - the cloud/RunPod path.
• encryption_key_method - off, Display Only, or save to .env. Choosing either of the non-off options generates a fresh Fernet key for the AutoUploader's file encryption. Back it up.
• reconnect - optional boolean, labelled "Reset stored credentials." Clears .env and revokes the refresh token at Dropbox so a leaked token can't be reused.

The STRING output returns status text only.

Installing and running it

Same pack install as the AutoUploader - ComfyUI Manager, search "DropSend", or:

cd ComfyUI/custom_nodes
git clone https://github.com/machinepainting/ComfyUI_DropSendNode.git
pip install -r ComfyUI_DropSendNode/requirements.txt

Then the critical bit. In the same terminal you'll launch ComfyUI from:

export COMFYUI_DROPSEND_ALLOW_SETUP=1
echo $COMFYUI_DROPSEND_ALLOW_SETUP   # must print: 1

Launch ComfyUI from that terminal. Setting the var in one terminal and starting ComfyUI from another (or from Pinokio / a launcher script) won't work - the gate is process-wide.

Troubleshooting

• "Setup is disabled" - the gate var isn't visible to the running ComfyUI process. Restart with it set in the right shell. On RunPod, add it to the pod template's env vars and restart the pod (env changes only apply on pod start).
• "Browser delivery refused" - you submitted the workflow via curl or an SDK without a client_id, so the node can't safely deliver credentials to your browser. Submit from the ComfyUI web UI instead.
• Credential panel didn't appear - re-run the node (in display_only mode nothing is stored, so each run regenerates the panel). Check the browser's popup blocker; if it still won't show, switch storage_method to env_file and read the .env from a shell.

If you're on a cloud GPU, the whole dance exists because the pod is ephemeral - do it once, save the values to your secrets manager and a pod template, and you'll never think about it again.