HTTP Authentication

Every API worth calling is locked behind some kind of credential. The moment your ComfyUI workflow talks to a service with a key or token, you've got two options: paste that header into every HTTP request node, or build it once here and wire it around. This node is the second option, and it's the reason the pack's method nodes have an auth input at all.

HTTP Authentication doesn't send anything by itself. It's a config builder: pick an auth_type, fill in the fields that match, and it hands you an auth_config object on its only output. That output plugs into the auth socket on any of the pack's request nodes - HTTPGet, HTTPPost, HTTPPut, HTTPPatch, HTTPDelete, HTTPHead, HTTPOptions, HTTPFileUpload, HTTPImageLoader all take it. One config, N requests, and when the token rotates you change one node instead of ten.

The dropdown and the fields that matter

auth_type is the whole show, with six choices:

• basic - username + password, HTTP Basic auth.
• bearer - the token field becomes Authorization: Bearer <token>. This is the one most modern APIs want.
• api_key - api_key plus api_key_header, which defaults to X-API-Key. Set the header name to whatever the API expects.
• token - Authorization: Token <token>, Django-style.
• oauth2 - here's the honest bit. This option is a stub. The code doesn't run a token exchange; it just treats the token field like a bearer token. The client_id, client_secret, oauth_token_url, and scope fields exist but aren't wired into the flow. If you need real OAuth2 client-credentials, use bearer with a token you fetched elsewhere, or stuff the full Authorization value into custom_headers.
• none - useful with custom_headers for anything that doesn't fit the patterns above.

custom_headers takes a JSON object and merges it into every request that uses this auth. That's your escape hatch for HMAC-style headers and other weirdness.

What comes out

A single auth_config (HTTP_AUTH type). Wire it to any request node's auth input and you're done. The request node applies it to its session before sending.

Install

ComfyUI Manager → search "ComfyUI-HTTP" → Install, then restart. Or manually:

cd ComfyUI/custom_nodes/
git clone https://github.com/wawahuy/ComfyUI-HTTP.git
cd ComfyUI-HTTP
pip install -r requirements.txt

No model downloads, no heavy dependencies - everything is plain requests under the hood.

Where people get burned

custom_headers must be valid JSON or it's silently dropped with a warning in the console - you'll get a 401 and wonder why. And remember the README's advice about environment variables doesn't actually exist in the code: your keys live in the workflow JSON in plaintext. That's fine on your own machine, but a shared workflow with your API key baked in is a leak waiting to happen, so scrub credentials before posting workflows anywhere.