GPT-Image API 配置 (base_url + api_key)

One node, your key, wired everywhere

Every API-calling node in this pack needs the same two things: where to send requests and who you are. ImageAPIConfig (displayed as "GPT-Image API 配置 (base_url + api_key)") is that single source of truth. You fill it in once, and its single output - the 「配置」 output, typed IMAGE_API_CONFIG - feeds the 「配置」 input on every GPTImageGenerate and GPTImageEdit node you add. One config node can feed a whole graph of generation and edit nodes, which beats pasting your endpoint into each one.

It's the boring node in the pack, and that's the point. It does no generation, no networking on its own. It just takes two strings, validates them, and bundles them into a (base_url, api_key) tuple for the nodes that do the work.

The two inputs and how it checks them

「接口地址」 is your base URL - usually something ending in /v1. The author's own placeholder is https://your-endpoint.example.com/v1, and the node enforces that it starts with http:// or https:// and isn't empty. 「密钥」 is the API key. Both are plain string widgets, no defaults, no sample keys. If either is missing or malformed you get a clear error at execution time rather than a confusing 401 halfway through a generation. That's it - no other inputs, no optional knobs, just the two fields.

The part worth caring about: where the key goes

This is the node in the pack where security actually lives, and the author has clearly thought about it. API-wrapper nodes are the one category where a malicious phone-home with your credential doesn't look wrong - the whole class was weaponized once in this ecosystem, and the pack's own README acknowledges that history. So the design choices matter:

• The key widget has serialization disabled on the frontend, so api_key never gets written into your saved workflow JSON or into the workflow embedded in an exported PNG. Sharing a workflow no longer leaks the key. Since v3.4.0 that's the behavior, and it's a genuinely good fix.
• The key instead goes into your browser's localStorage, keyed per-node by a persistent uuid, and auto-refills when you reopen the workflow locally. This is community-standard handling for frontend keys - strictly better than "in the file everyone shares," but it's still plaintext on disk, readable by any same-origin script, and it won't follow you across browsers or machines.
• The clone/copy-paste trap is handled too. Earlier versions stored keys by base_url, so two config nodes pointed at the same gateway shared one slot and cloning a node would clobber the original's key. Since v3.5.0 each node writes only to its own slot, and a clone gets its own immediately.
• Requests go only to the base_url you typed. No preset gateway, no telemetry, no third-party image hosting - the key appears only in the Authorization: Bearer header.

Install

Same as the rest of the pack - it's one repo, four nodes:

cd ComfyUI/custom_nodes
git clone https://github.com/meomeo-dev/custom-gpt-image-2-api.git
cd custom-gpt-image-2-api
pip install -r requirements.txt   # requests, Pillow, numpy - that's it

Restart ComfyUI. ComfyUI Manager can also find it if you search the pack title.

Gotchas worth knowing

• The key lives in your browser, not the workflow. Reopen the workflow on a different browser or after clearing site data and you'll re-enter the key once. That's expected, not a bug.
• Old workflows may already contain a plaintext key. If you saved or shared a workflow before v3.4.0, rotate that key. The README is explicit about this.
• Clearing the key widget deletes its local stored copy - the two are linked, so don't blank it "just to hide it before a screenshot" unless you want to retype it.
• Two tabs running the same workflow can share a key slot if the nodes are copies of each other; for truly separate sessions, rebuild one workflow's config node. That's the documented edge, not a failure.

The honest framing: this node handles your credential better than most of the category, but it still holds your credential. Only point it at a gateway you trust, and glance at the source before your first run - for a pack this small and unknown, that one look is the whole security review.