MediaHub API Key

Every node in ComfyUI MediaHub is a remote-API call waiting to happen, and every one of those calls needs a key. MediaHubAPIKey is where you park that key so it can flow into MediaHubGenerateImage, MediaHubSubmitVideo, and MediaHubResolveVideo. It's the most boring node in the pack and the one where a beginner is most likely to leak something.

The whole idea of this pack is that ComfyUI stays your front end while the actual generation happens on MiniMax, Agnes, ByteDance's Seedream/Seedance, or Alibaba's Wan - the providers the local community can't run anyway (Wan went API-only after 2.2, and Seedream/Seedance were never open). You pay per generation, and the key is how the provider bills you. Treat it like a credit card number, because effectively that's what it is.

What it does

It's a single password-style text field with an api_key input and one api_key STRING output. That's the whole node. You type (or paste) your key once and wire the output into the api_key socket of any execution node. The password: True flag in the node definition means the input is masked on screen - dots instead of characters - but that's cosmetics.

The one output is a plain STRING, so nothing stops you from routing it through other ComfyUI plumbing. Just remember the key is a real string traveling through your graph; anything that serializes the workflow serializes the key.

Where people get burned

The pack's own README is unusually blunt about this, and you should believe it. The inline mask hides the key on screen only. ComfyUI may still write it into exported workflow JSON and into generated-media metadata. Secure local credential storage is explicitly not implemented yet.

So the failure mode is: you make a nice workflow, share it on the subreddit or a Discord to show off the video you generated, and your API key is sitting in the JSON for anyone to grab. Someone then runs their own generations on your dime. Before you share anything:

• delete the key from the exported workflow (ComfyUI's API-format export strips widget values, but the "workflow" JSON from the menu often keeps them),
• inspect any saved PNG/MP4 metadata,
• and if you suspect a key got out, revoke and rotate it at the provider console rather than just deleting the node.

MiniMax, Volcengine ARK, DashScope, and the rest all have key-rotation pages. Use them early and often. This is also why the author recommends a key with spending limits if your provider offers them - a leak then costs you a fixed amount instead of an unlimited one.

Installing the pack

This node ships in ComfyUI MediaHub, so you install the pack, not the node:

cd ComfyUI/custom_nodes
git clone https://github.com/vantang/ComfyUI-MediaHub.git
/path/to/ComfyUI/python -m pip install -r ComfyUI-MediaHub/requirements.txt

Restart ComfyUI and you'll find MediaHub API Key under the MediaHub/Inputs category. Requirements are just requests, Pillow, and numpy - nothing heavy, no model downloads, because nothing runs locally. ComfyUI Manager support exists in theory (the pack publishes to the registry as mediahub-cloud), but the Manager registration was still working its way through review, so the git clone path is the reliable one for now.

Actually using it

Get a real key from whichever provider you want (each provider needs its own key - there's no shared "MediaHub key"), paste it in, wire it to the execution node. If a generation fails with an auth error, first suspect the key: paste it back in, check for a trailing space from copy-paste, and confirm the key belongs to the provider you're actually calling. A MiniMax key won't authenticate a Volcengine call, and that trips people up more than any node bug.