image2oss-tag

Same watermark-and-upload trick as the STS version of this node, but with your Alibaba cloud keys typed straight into the widgets. It exists for the setup that doesn't want (or doesn't need) a self-hosted STS token service: you run ComfyUI on a box you control, the workflow never leaves it, and you're fine with AK/SK living in the node.

What it does, in one line: every image it receives gets a semi-transparent white "Ai生成" label stamped in the bottom-right corner, then the labeled image is uploaded to your OSS bucket as PNG. The "Ai生成" (AI-generated) text is the pack's nod to China's AI content-labeling requirement - the README cites the 网络安全技术 人工智能生成合成内容标识方法 standard. If you're distributing AI output in a Chinese context, this is the pack's attempt to make compliance a node instead of a manual Photoshop step.

How it works

Per image, the node converts the tensor to a PIL image, draws the watermark, encodes as PNG, and calls put_object via the oss2 SDK using StsAuth (signature v2). The watermark text is scaled so its height is at least 5% of the image's shorter edge (never below 10px), and it renders with the bundled Noto Sans CJK SC font - required, since Pillow's default font can't draw the Chinese character.

The inputs

• image - the IMAGE from your sampler/VAE decode.
• filename - parsed as a Python list literal, one full object key per image in the batch, count must match exactly. ["tmp-comfyui/filename.jpeg"] for a single image.
• access_key_id / access_key_secret - your long-lived Alibaba Cloud keys.
• security_token - empty unless you're using STS-style temporary credentials with these keys.
• bucket_name and endpoint - the latter is the 44-region dropdown; validation rejects anything hand-typed.

No outputs - terminal output node.

Install

ComfyUI Manager (search "image2oss"), comfy node registry-install image2oss, or:

cd ComfyUI/custom_nodes
git clone https://github.com/nxt5656/image2oss

Restart after. oss2 is the only dependency beyond stock ComfyUI, and the font ships inside the repo - nothing extra to download.

The trap that matters

Your keys are in the file. Save this workflow and the AK/SK are sitting in the JSON, plain text. Share it, post it, attach it to a bug report - and those are now public credentials. If the workflow has any chance of leaving your machine, use the STS-service sibling instead, where the workflow holds nothing secret. The KB's warning about credential-carrying nodes applies to this one literally: a node whose whole job is cloud access with your key baked in is exactly the shape of thing you don't broadcast.

Beyond that, the same gotchas as its STS twin:

• Font path is hardcoded to ComfyUI/custom_nodes/image2oss/NotoSansCJKsc-Regular.otf. Install folder not named image2oss and the 生成 character degrades to a tofu box (the code warns in the console).
• Filename count must match the batch. Mismatch raises a ValueError before anything uploads.
• It's "Ai生成" with a lowercase i - that's literally what the code writes. If your compliance process cares about exact wording, know what you're getting.