Secure API Call

ComfyUI is rarely the whole product. Usually it's the thing that makes an image while your own server waits to do something with it - log the job, fire a webhook, kick off a downstream task, tell a queue a render finished. That's exactly what this node is for: a terminal output node that POSTs a JSON payload to whatever URL you give it, then ends the workflow.

The name is more honest than most. It calls an API, and the whole design is about keeping that call's credentials secure. Which matters more than it sounds like, because ComfyUI embeds the entire workflow graph - including the literal text of every node field - into your output files as metadata. That's a beloved feature for sharing ("workflow included" is culture around here) and a nightmare if you've hardcoded an API key into a node. This pack exists so you don't have to.

What you actually set

• any (*) - accepts anything; there's nothing to wire in semantically, but dragging a wire from a late node here forces this to run after it.
• api_url - where the POST goes.
• data - a JSON string that becomes the request body. The default {"data": "some_data"} shows the shape.
• api_auth - the key value sent in the x-api-key header. Note the header name is hardcoded to x-api-key, so your endpoint has to expect that. No Bearer tokens here.
• timeout (default 3s), verify_ssl (default on), full_comfyui_info (default on) - the last one decides whether the payload also carries ComfyUI's whole execution queue object (huge) or just the prompt_id under comfyui_execution_info.

There are no outputs - it's a terminal node. It either succeeds and the workflow finishes, or it raises and the workflow fails.

The security bit is the whole point

Use $ENV. prefixes for anything secret. Put $ENV.API_URL in the url field and $ENV.API_KEY in the auth field, then set the actual values as environment variables:

CSAPI_API_URL=https://your.api/endpoint
CSAPI_API_KEY=your-super-secret-key

The $ENV.NAME syntax resolves to CSAPI_NAME. Do this, and the real URL and key never touch your workflow JSON, so they can't end up baked into an output PNG. Skip it, and you've put your API key in every image you save. The README's warning is not decorative - it's bolded, in caps, with "WILL" underlined. Run ComfyUI with --disable-metadata if you can, but the author's point stands: some nodes re-attach their own metadata anyway, so the env-var habit is the real fix.

Installing

In ComfyUI Manager, search ComfyUI Secure API Call and hit install. Or do it by hand:

cd ComfyUI/custom_nodes
git clone https://github.com/Mattabyte/ComfyUI-SecureApiCall

Restart ComfyUI after. Dependencies are boto3, python-dotenv, and Pillow - no models, nothing heavy.

Where people get burned

The default URL is https://localhost:9001/, which will fail unless you actually have a test server listening there. Set it before you run. If you get a "Environment Variable CSAPI_API_KEY is not set" error, that's this node telling you the env var is missing or the name doesn't match - variable names must be letters, numbers, and underscores. Invalid JSON in data also raises, so if you're hand-editing the payload, it has to parse.

One thing this pack can't do for you: it's built for a secure environment per the README, and the API auth is a static key in a header. If your endpoint needs request signing, that's what the sibling "Secure API Call (AWS)" node is for - it signs the POST with SigV4 instead of sending a plain key.