Store Secret

Store Secret is the boring, forgettable half of ComfyUI Secrets Manager (by perzeuss), and boring is exactly what you want from it. Its whole job is to take a plaintext value - an API key, a token, a password - and write it to disk encrypted, keyed by a name. The interesting part is what happens after: you delete this node from your graph, and from then on you reference the secret by name with the pack's Load Secret node. Your workflow JSON carries stripe_live_key as a label instead of the actual sk_live_... string. For a workflow you share, that's a meaningful difference.

ComfyUI workflows are JSON, embedded in the metadata of output PNGs, swapped freely in community channels. When you hardcode a credential in a node's text field, it rides along in every one of those files. Store Secret is the one-time setup step that breaks that habit.

How it works

The mechanism is small enough to read in one sitting. On first use it generates a Fernet key and saves it to ComfyUI/user/secrets_manager/.key (chmod 0600, so only your user account can read it). Then it encrypts your value and tucks it into secrets.enc.json in that same folder. Store the same name twice and it overwrites the old value - so this is a "last write wins" store, not a password vault with history.

One honest caveat, same one that applies to the whole pack: the encryption key sits in the same directory as the encrypted data. That makes this perfect protection against accidentally leaking a key in a shared file, and useless against someone who can already read your user folder. Don't sell it to yourself as a secure vault; it's a lock on the door that keeps your keys out of the files you hand to strangers.

The inputs (there are two)

• name (STRING) - the identifier you'll pick later in Load Secret's dropdown. Make it obvious: gemini_key, openai_key.
• value (multiline STRING) - the actual secret. This is the only place it ever exists in the graph.

There are no outputs. Store Secret is an output node - you run it purely for the side effect. Nothing wires out of it, and nothing should.

Installing it

ComfyUI Manager, searching ComfyUI Secrets Manager, or the manual route:

cd ComfyUI/custom_nodes
git clone https://github.com/perzeuss/comfyui_secrets_manager

Restart ComfyUI after either. The only dependency is cryptography, already present in ComfyUI, so no models, no giant downloads, no setup ceremony.

Where people get burned

• The plaintext sits in the widget until you run it. You type the value into a node, and that node's widget value is part of the workflow JSON. So the intended flow is: run Store Secret once, then delete the node (or at least clear its value) before you save or share the workflow. Leave it there with the secret still typed in and you've simply added an extra step before leaking it.
• There's no delete node. The underlying code has a delete_secret function, but no node exposes it. To remove a secret you'll be hand-editing secrets.enc.json. Minor, but worth knowing before you depend on this for anything critical.
• Load Secret's list needs a refresh. Store the secret, then restart or reload ComfyUI before Load Secret's dropdown will show your new name.

It's a young, minimalist pack - the README is mostly cookiecutter boilerplate - but the core loop is sound and the code is short enough to audit yourself.