萌宝AI全局API Key管理

Every API-wrapper node pack eventually invents the same node, and this is MengBaoAI's version: a single password field where you paste your key once, so you're not pasting it into the generation node, the vision node, and the audit node separately - or worse, pasting it into a workflow you then share.

It's called 萌宝AI全局API Key管理 and it is about as simple as a node gets. The one thing to internalise is that the node itself does nothing on a run. Executing a workflow with it attached just reads whether a key exists and prints the status. Saving and clearing only happen when you click the buttons in its UI. That's deliberate, and the source spells it out: run the node and it reports; press the button and it writes.

What happens when you click

The key is written to ComfyUI/user/mengbaoai/.env as MENGBAO_API_KEY. Not into the workflow JSON, not into the node's state output, not into git - the README's security section is emphatic about this, and it matters, because a workflow with a key inlined is a workflow that leaks the moment you post the PNG or hand someone the graph.

Resolution order for the API nodes is: a key typed directly into the image node's api_key widget wins; if that's blank, the global key is used. Older workflows that carried credentials in the image node's connection_json still work - that channel is kept for compatibility.

Clearing is the interesting part. It asks for confirmation, leaves your other environment entries alone, and then writes an empty value rather than deleting the line - so the key can't be silently migrated back in from an old install directory. That's three failure modes the author clearly hit during development and closed off.

Inputs and outputs

One input: api_key (STRING, not multiline) - the password box. One output: status, a STRING that reads Global API Key saved or Global API Key not set. The node is also flagged as an output node, so it always executes and always reports, even if nothing consumes status.

You generally don't wire anything to it. Drop it anywhere on the canvas, use the two buttons, done. If you're building a graph for other people, piping status into a text display is a genuinely nice touch - they'll see immediately that they need to supply a key before the run burns 20 minutes of nothing.

Installing it

Part of ComfyUI-MengBaoAI (17 nodes, Corkery520, MIT, Registry id mengbaoai). Manager: search MengBaoAI / mengbaoai / 萌宝AI; CLI: comfy node install mengbaoai. Until the Registry release is fully live, use Git:

cd ComfyUI/custom_nodes
git clone https://github.com/Corkery520/ComfyUI-MengBaoAI.git
cd ComfyUI-MengBaoAI
python -m pip install -r requirements.txt

Three dependencies (numpy, Pillow, requests), no models to download. Restart ComfyUI afterwards - and note that this node needs the backend to come back up, since the buttons hit local HTTP routes, not just Python. In the canvas search box, 全局API Key, 密钥管理, or MengBaoGlobalAPIKey all find it.

There's a migration path from the old standalone ComfyUI-MengBao-Image-API plugin: on first load the pack tries to pull the key out of the old install's .env. Disable that plugin first, though - duplicate node IDs and duplicate routes are the documented consequence of running both.

Things that bite

• Keys are credentials, and this pack calls a third-party endpoint. The generation and vision requests go to a fixed reseller base URL (https://api.lk888.ai), not to OpenAI or Google directly. That's a normal arrangement in this ecosystem - the KB's API-node doc covers the reseller layer in detail - but it means your key and your images go to a vendor of the pack author's choosing. Read the pack before you paste a key that can spend real money; the same category of node is what got weaponised in the ComfyUI_LLMVISION incident.
• The vision features ignore per-node keys. Reverse, replication and audit use only the global key, so image-to-image workflows can run off a pasted key while the reverse node still says "Global API Key is empty. Save a global API Key first."
• user/mengbaoai/.env isn't in your workflow. Move to a new machine, or wipe the user directory, and every API node stops working until you re-enter the key. Same for backups: back up the whole mengbaoai folder if you care about history, materials and the key.