Tara LLM API Key Loader

If you've been pasting an OpenAI or Groq API key into a plain text node and wiring it into a prompt generator, stop and read the first line of the README. ComfyUI embeds your whole workflow as JSON in the PNG's metadata, and workflow JSON travels. Share one image and your sk-... is in the file. TaraApiKeyLoader is this pack's answer to that: the key lives in a file on disk, the graph only ever carries a STRING output you wire into a node. It's the most-searched node in the pack for a reason - it's the one that keeps you from leaking credentials.

How it works

The loader doesn't call any API and has no key of its own. It reads API_KEYS.json, the file written by TaraApiKeySaver, and pulls out the entry for the provider you pick. Keys are stored under fields named like environment variables - OPENAI_API_KEY, GROQ_API_KEY, TOGETHER_API_KEY - so one file holds keys for all three services.

Two inputs, and only two:

• model - a dropdown of the pack's model list (openai/gpt-3.5-turbo, groq/mixtral-8x7b-32768, groq/llama3-8b-8192, and so on). This is a provider picker in disguise: only the part before the / matters here. together/coming-soon is a placeholder - Together support was never finished, so don't expect a key out of it.
• temporary - default off. When on, the loader looks in /tmp instead of the pack's folder, matching a key you saved with the Saver's temporary flag.

Output is a single api_key (STRING). Wire it into the api_key input of the deprecated TaraPrompter or TaraDaisyChainNode, or leave it alone and let TaraPresetLLMConfig call the loader internally via its use_loader toggle.

Why it exists in a security sense

The custom-node world has a real reason to be paranoid about keys. The ecosystem's most famous incident, ComfyUI_LLMVISION, was a node that exfiltrated browser data via a fake OpenAI library - nodes run unsandboxed Python with your user-level access. Tara's answer is modest but sound: keep the key out of the shared artifact. The README even suggests the nuclear option - a text/primitive node, never saved to disk at all - for hosted/shared boxes. Between a plaintext JSON file in the pack directory and a key embedded in a workflow you might share, the file is clearly the less-bad option.

Install

The whole pack is two small Python deps (orjson and openai), no models to download:

cd ComfyUI/custom_nodes
git clone https://github.com/ronniebasak/ComfyUI-Tara-LLM-Integration

Restart ComfyUI. Or, in ComfyUI Manager, use Install via Git URL and paste the repo URL - it's a small pack, so don't expect it in the Manager catalog search.

Common issues

The classic failure is FileNotFoundError: API key not found in API_KEYS.json. That means you haven't run the Saver yet, or you saved it for a different provider, or you mismatched the temporary flag - saved with it off, loaded with it on, and the two look in different directories. The loader raises instead of degrading gracefully, which is at least honest: you'll know immediately. And as a heads-up, this pack is a small 2024-era alpha from ronniebasak that's been quiet since; for a full-featured LLM prompt pipeline you'd use the modern nodes in the same pack (TaraLLMConfig + TaraPrompterAdvanced) rather than the legacy ones this loader feeds.