HTTP Utilities

The name is a lie. HTTP Utilities - the "Utilities" node in the ComfyUI-HTTP pack - doesn't open a socket, call an API, or need a key. It's a 17-tool string-processing workbench disguised as a network node, and it's the piece you'll actually reach for when you're fighting an API integration in your workflow.

Here's the situation it exists for. You've got an [HTTP GET Request] feeding a POST to some third-party service. The service needs an HMAC signature, a unix timestamp, a bearer header, a URL built with query params - or your response comes back URL-encoded, JSON-escaped, or base64'd and you need it decoded before the next node can use it. Without this node you'd be opening a browser tab every five minutes to run a Python one-liner and paste the result back in. With it, all of that stays inside the graph.

How it works

Under the hood it's pure Python standard library - urllib.parse, base64, json, hmac, hashlib, html, uuid, re, time. No requests, no aiohttp, no network calls at all. That means it's also the most reliably-behaving node in the pack: nothing to time out, no SSL errors, no proxy config. Pick an operation from the dropdown, feed it a string, done.

Every operation returns three outputs: result (the transformed string), info (a short human-readable note about what it did), and success (a BOOLEAN). That success flag is the clever part - on bad input these nodes don't crash your graph, they return False and drop an error string into result, so you can wire success into a conditional and route around failures instead of watching the whole workflow die.

The inputs that actually matter

You set two fields for almost every operation:

• operation - the dropdown with 17 choices: url_encode / url_decode, base64_encode / base64_decode, json_escape / json_unescape, html_escape / html_unescape, generate_timestamp, generate_uuid, generate_signature, parse_url, build_url, extract_domain, validate_email, generate_bearer_token, create_basic_auth.
• input_data - the string you're transforming.

The optional fields only matter for two operations. secret_key and algorithm (sha1/sha256/md5, default sha256) are exclusively for generate_signature, which computes an HMAC of input_data - the classic way to sign requests for APIs like Binance or Stripe-style webhook verification. And url_base, url_path, and url_params are only used by build_url, which glues them together and URL-encodes url_params (a JSON object like {"page": 1, "q": "test"}) into a query string. Leave them alone for anything else.

When you'd actually use it

The realistic job list: build a signed URL and pipe it into an [HTTP GET Request]; generate a fresh timestamp or UUID for a request body; base64-encode an image payload before a POST; decode a response before feeding it to HTTP Get JSON Field; or create_basic_auth - feed it username:password and it hands back a ready-to-paste Basic ... header.

Two honest caveats. generate_bearer_token is not a real JWT - the source code says so itself; it's a base64 blob, fine for a smoke test, useless for anything that validates tokens. And generate_signature needs secret_key set or it just returns success: False with "Secret key required".

Install and troubleshooting

Same as the rest of the pack: ComfyUI Manager → search "ComfyUI-HTTP" → install, or

cd ComfyUI/custom_nodes/
git clone https://github.com/wawahuy/ComfyUI-HTTP.git
cd ComfyUI-HTTP
pip install -r requirements.txt

The requirements list torch and pillow alongside requests, aiohttp, jsonpath-ng, and jsonschema - but every ComfyUI install already has torch and pillow, so that pip install is mostly a no-op. No model downloads, no weights, nothing heavy.

Failures here are almost always input problems, not node problems: base64_decode on garbage returns False, build_url chokes on malformed JSON in url_params, validate_email just says "false". One real gotcha worth knowing: any API keys or secrets you type into secret_key live in plain text inside your workflow JSON, and the ComfyUI ecosystem's default posture is unauthenticated - the community PSA about locking down your instance applies double to a pack that happily sends your tokens to remote servers. Export your workflow before sharing, and don't paste real credentials into a public one.

It's a niche tool, but when you need to munge one string to satisfy a picky API, it beats every clipboard-and-paste workflow you'll cobble together instead. And unlike the pack's actual HTTP nodes, it can't leak, timeout, or hit a rate limit - it's the calm one in the family.