Load Secret

Every workflow that calls a hosted API - Gemini, OpenAI, an image-upscale service, whatever - needs a key, and ComfyUI makes it very easy to paste that key into a text box. The problem is that text box lives in the workflow JSON: the file you drag into Discord, embed into PNG metadata, and post so someone else can reproduce your pipeline. Your AIza... key is right there, in plaintext, in a file the whole internet can download. Load Secret is the escape hatch. It grabs a value that was stored encrypted on disk and hands it back to the graph as a plain string, so the only thing that travels in the workflow is a name like gemini_key - not the key itself.

It's one half of a two-node pack called ComfyUI Secrets Manager (by perzeuss). Store Secret gets the value in, Load Secret gets it back out. This node is the half you wire into your actual graph.

How it works

Under the hood it's dead simple, and you can read all of it in about fifty lines. Load Secret reads a JSON file - secrets.enc.json in ComfyUI/user/secrets_manager/ - and decrypts the entry you asked for with Fernet (the cryptography library's symmetric-key scheme). The key lives in a .key file in that same folder, generated on first use with 0600 permissions. No network, no API, no cloud vault. That also means you should keep your expectations honest: this protects you from accidentally shipping a key in a shared file, not from someone who can already read your user directory. If an attacker has filesystem access, they can read the .key file right next to the data and decrypt everything. It's a convenience lockbox, not a password manager.

The inputs that matter

Only one input, and it's a dropdown:

• secret_name - a COMBO list of every secret you've stored, built at schema-definition time. Pick a name; that's the whole input.

One output:

• value (STRING) - the decrypted secret. Wire it into whatever input your API node expects for the key, the token, the credential.

So a Load Secret node feeding an API-calling node is the entire pattern. Type the name, drag the wire, done. The author also flags the node as not_idempotent, Comfy's hint that it shouldn't be treated as a pure, cacheable function - fair, since it reads mutable state off disk.

Installing it

Grab the pack from ComfyUI Manager by searching ComfyUI Secrets Manager, or clone it manually:

cd ComfyUI/custom_nodes
git clone https://github.com/perzeuss/comfyui_secrets_manager

Then restart ComfyUI. Its only Python dependency is cryptography, which ComfyUI ships with anyway, so there's no model download and no heavy install to babysit.

Where people get burned

• The dropdown goes stale. Secret names are read when the node schema is built, so a secret you store mid-session won't show up in Load Secret's list until you refresh ComfyUI. Store first, restart, then load.
• The plaintext comes back into the graph at runtime. Load Secret outputs the unencrypted value - that's the point, it has to feed a node. The win is that the secret never sits in a saved or shared workflow file, not that it's invisible in memory.
• It's a young pack. This is a small, fresh project built from the official cookiecutter template, so don't expect a polished settings UI or a huge feature list. What's here is tiny and readable - which is honestly a feature if you care about what your nodes do.