Modelverse Secret Client

There are two ways to hand an API key to the UCloud Modelverse pack, and they differ in one important way. The plain Modelverse Client keeps the key (or a path to config.ini) in the workflow itself. The Modelverse Secret Client stores the key somewhere else - a secrets.json file next to the plugin - and the workflow only ever references the key by name.

That distinction is the whole node. If you've ever shared a ComfyUI workflow on the web, you know the fear: drag it into a friend's ComfyUI, and there's your API key in plain text inside the JSON. This node exists so that never has to happen. The tooltip puts it directly: "The workflow stores this name, not the API key."

How it works

Under the hood the plugin registers a tiny secrets manager as HTTP routes on your ComfyUI server - GET/POST/DELETE /modelverse-secrets - backed by a secrets.json file in the plugin's folder. You store your key under a name like prod-key once, and then this node's secret field just needs that name. At execution time it looks up the name, pulls the real key, and emits the same MODELVERSE_API_CLIENT output that every other node in the pack consumes.

Two nice details in the source:

• The node implements IS_CHANGED so the workflow re-runs when the underlying secret value changes - meaning you can rotate a key without touching the graph.
• If the name you typed doesn't exist in secrets.json, it raises Secret 'X' not found with the exact name, so the failure is obvious rather than a cryptic 401.

Setting it up

The pack's README leans on the other client node and on config.ini, so this one is easy to miss. But it's the recommended path if you share workflows at all:

1. Install the pack (Manager → search "ComfyUl-UCloud", or git clone https://github.com/ucloud/comfyui-plugin into custom_nodes).
2. Store a secret via the plugin's secrets UI, or by editing secrets.json in the plugin folder:

   { "prod-key": "your_modelverse_api_key" }

3. Add Modelverse Secret Client, type prod-key into the secret field, and wire its client output into any Modelverse generation node.

One honest caveat: secrets.json is plain text on disk, so this is about sharing hygiene, not encryption. Anyone with access to your machine can still read the file. But it completely solves the "I pasted my key into a workflow that got posted" problem, which is the failure mode that actually bites people.

If you're not sharing workflows and you're solo on your own box, the plain Modelverse Client reading config.ini is simpler and does the same job. Choose based on whether other people will ever see your .json.