Secure API Call (AWS)

This is the sibling of the plain Secure API Call node, and the difference is one word: signed. Where the basic node sends a static key in an x-api-key header, this one signs its POST with AWS Signature Version 4 - the auth that AWS API Gateway expects. If your ComfyUI box is the back end of an AWS-hosted pipeline - say, an API Gateway endpoint in front of a Lambda that consumes finished generations - this is the node that call was written for.

Mechanically it's the same shape as its sibling: a terminal output node that POSTs a JSON body to a URL. But instead of your key sitting in a header, it builds the request through boto3 and stamps it with SigV4Auth for the execute-api service, so the signature covers the exact URL, body, and timestamp. That has a practical consequence: the URL you type must be the precise invocation URL of the endpoint, and the credentials must be valid at signing time - a stale or wrong key fails with a 403 from AWS rather than anything more informative.

The inputs

• any (*) - a trigger input; wire anything in to force ordering.
• api_url - the AWS endpoint (or any SigV4-compatible endpoint).
• data - the JSON string that becomes the body.
• aws_access_key_id, aws_secret_access_key, region_name - the credentials and region used for signing. All default to empty, so nothing works until you fill these or use env vars.
• additional_data - extra JSON appended to the payload as an additional_data object. This is the one field the plain node doesn't have.
• timeout, verify_ssl, full_comfyui_info - same as the base node, though full_comfyui_info defaults to off here, so by default you get just the prompt_id in comfyui_execution_info rather than the whole execution queue.

No outputs - it's a terminal node that succeeds or raises.

Environment variables, not pasted keys

Same security deal as the whole pack: ComfyUI bakes node field values into output metadata, so pasting AWS keys into a node means they end up in your saved files. Use the $ENV. prefix instead:

CSAPI_AWS_ACCESS_KEY_ID=AKIA...
CSAPI_AWS_SECRET_ACCESS_KEY=...
CSAPI_AWS_REGION_NAME=us-east-1
CSAPI_API_URL=...

$ENV.AWS_ACCESS_KEY_ID resolves to CSAPI_AWS_ACCESS_KEY_ID, and so on. The tooltips in the node say exactly this - it's the intended workflow, not an afterthought. There's also $ENV.API_URL for the endpoint and $ENV.AWS_REGION_NAME for the region.

Installing

The pack is ComfyUI Secure API Call in ComfyUI Manager - install and restart. Manually:

cd ComfyUI/custom_nodes
git clone https://github.com/Mattabyte/ComfyUI-SecureApiCall

Dependencies are boto3, python-dotenv, and Pillow; no models to download. If you installed the pack for the plain node, this one's already there - they ship together.

The practical bits

Because the signature binds the request to its exact body and URL, treat the node's config as frozen once it works: change data or the URL and the signature recomputes automatically (that part's fine), but any mismatch between your AWS region and the endpoint's region is an instant failure. And like its sibling, this is built for a private, secure environment per the README - don't hang it off a publicly exposed ComfyUI instance, which is a whole separate can of worms given the default-unauthenticated ComfyUI API. If your endpoint is fine with a static key and you don't need AWS signing, the plain Secure API Call node is simpler; reach for this one only when SigV4 is actually in the picture.