Kling AI Authentication

Kling AI Authentication is the front door for the whole ComfyUI-Kling-Direct pack. Every other Kling node in this pack takes an auth input, and this is the node that produces it. No auth, no generations - you'll get a connection error the moment anything actually calls the API.

Here's the mental model that makes the whole pack click: Kling (from Kuaishou) is a closed model with no open weights, so there's no local option at any VRAM. This node doesn't hold a model, it holds a credential. It packages your API keys into a small KLING_AUTH object that every downstream node passes to Kling's servers. The pack is a direct API client - no third-party middleware, no Comfy account, no credits brokered by Comfy Org. You bring your own Kling access key and secret key.

Getting the keys

Head to https://app.klingai.com/global/dev and create an access key + secret key pair. The catch most people hit: a new account needs KYC activation before the dev console hands out keys. That's a real, sometimes slow step - budget for it. You're also signing up for Kling's per-call credit pricing, which is the other thing to internalize before you go far down this path; video jobs eat credits fast.

How the node works

The node has three inputs: access_key, secret_key, and a debug toggle. Keys are masked in the widget (the password flag in the source), and the node falls back to the KLING_ACCESS_KEY / KLING_SECRET_KEY environment variables if you leave the fields blank - handy if you'd rather not paste secrets into workflow JSON. Its single output is the auth object, which you wire into every generation node.

The actual API authentication is JWT signing on the client side: the access key identifies you, the secret key signs each request, and the token is cached for ~25 minutes to avoid re-signing on every poll. Two details worth knowing because they show the pack was hardened, not just slapped together: the signed JWT is scrubbed from exception tracebacks (v2.1), so the console log you paste into a GitHub issue won't leak your secret; and by default the client refuses downloads from loopback/private addresses unless you set KLING_ALLOW_INTERNAL_HTTP=1.

Wiring it up

• auth (KLING_AUTH) → the auth input on any KlingDirect_* generation node.
• If you're outside the Singapore default endpoint, run the output through the Kling Region Selector first (china / us / custom base URL). The Auth node doesn't care about region; the selector rewrites the base URL.

Common issues

• "No Kling API key provided" - both the field and the env var are empty. Either paste a key or set the env vars and restart ComfyUI.
• Auth passes but every task fails - almost always the account isn't KYC-activated, or the keys are for a different region than the endpoint you're hitting. Use the Kling API Health Check node (also in this pack) to separate "bad keys" from "no connectivity" in one click.
• Key appears as dots - that's expected, the field is masked. If you mistype, clear the field and re-paste.

Security note, since this is the one node that carries a credential: an API-wrapper node that phones home with your key is exactly the shape of thing that's been weaponized in this ecosystem before (the ComfyUI_LLMVISION incident). This pack handles the credential about as responsibly as a third-party pack can - masked fields, env-var option, no key logging, JWT scrubbed from tracebacks - but you should still only install custom nodes you can audit. The source is MIT-licensed and short enough to skim.

Install

ComfyUI Manager → Install Custom Nodes → search "Kling Direct" → install, then restart. Manual:

cd ComfyUI/custom_nodes
git clone https://github.com/IxMxAMAR/ComfyUI-Kling-Direct

No model downloads, no GPU required - the pack only needs what ComfyUI already ships (requests, Pillow, numpy, torch, opencv-python). Set up this one node correctly and the other 41 become single-purpose wrappers you barely think about.