🔒Secure API LLM Loader (local JSON)

Here's the ComfyUI fact most people learn the hard way: every image you save carries the entire workflow that made it, embedded as text chunks in the PNG. The workflow is the project file - drag it back and the whole graph rebuilds - the whole mechanism is documented in our KB's image-io-metadata essay. And that means if your workflow has an API key typed into a text widget, that key is in every PNG you ever share. This node exists because comfyui_LLM_party's stock ☁️API LLM加载器 stores api_key exactly that way.

🔒Secure API LLM Loader (local JSON) is the fix: a tiny companion node that reads model_name / base_url / api_key from a local JSON file, selected by a profile-name dropdown. Only the profile name ever touches the workflow. The key is resolved at runtime and never enters the workflow JSON, which means it never enters your PNGs. Same model, same LLM node, zero key in the metadata.

How it works

The mechanism is simple and it holds up to a peek at the source. The node ships one input that matters, config_name - an enum dropdown whose choices are read straight from your llm_api_keys.json at load time. That string is the only thing saved in the workflow. When the graph runs, it reads the file, pulls the matching entry, and hands model_name, api_key, base_url to the Chat class it borrows from comfyui_LLM_party at runtime (via importlib, so it has zero Python dependencies of its own - pyproject.toml lists dependencies = []).

The output is a single model socket of type CUSTOM, fully compatible with the ☁️API LLM通用链路 (LLM) node. You wire it in exactly where you used the old loader and nothing downstream changes.

The inputs you actually set

Beyond config_name, there are two optional knobs:

• json_path - absolute path to a custom key file. Leave it empty to use llm_api_keys.json in the node's folder. The README's tip is worth taking: put the file outside your ComfyUI folder entirely, so it doesn't ride along if you ever zip up custom_nodes.
• is_ollama - flip this for a local Ollama server. It skips the key file completely and points the Chat class at http://127.0.0.1:11434/v1/ with no key. Handy if you run a local LLM for prompt work (the pattern our KB's llm-in-comfyui essay calls the sensible default anyway).

Install and set up

Prereq: comfyui_LLM_party must already be installed - search "LLM party" in ComfyUI Manager. Without it this node dies at runtime with a "Could not locate the Chat class" error. Then either search Manager for "Secure LLM API Loader" or:

cd ComfyUI/custom_nodes
git clone https://github.com/R0smontis/comfyui_secure_llm_loader.git

No model downloads, no heavy deps. Then:

cd ComfyUI/custom_nodes/comfyui_secure_llm_loader
cp llm_api_keys.json.example llm_api_keys.json

Fill in your providers - the top-level key is your dropdown label, model_name is the real model id (defaults to the label if you omit it), and base_url + api_key do what they say:

{
  "my-deepseek": {
    "model_name": "deepseek-chat",
    "base_url": "https://api.deepseek.com/v1/",
    "api_key": "sk-your-real-key"
  }
}

Restart ComfyUI after installing the node. Later edits to the JSON only need a page refresh to repopulate the dropdown - the choices are built when the node loads.

Where people get burned

First, the obvious one: "secure" here means leak prevention, not encryption. llm_api_keys.json is gitignored but stores keys in plaintext - never share or commit that file, only share workflows and images. Second, the error messages are literal: if you get "config name not in key file," the dropdown label and a JSON key disagree; if you get "missing api_key," you didn't put one in. Both are spelled out in the source.

And the honest caveat: this only helps if you actually use comfyui_LLM_party. It's a niche companion to a niche ecosystem - but if you're in that ecosystem, it's the right call, because the alternative is every image you post quietly leaking a key you'll only notice when the bill arrives. Treat any key that ever sat in a text widget as compromised and rotate it, and double-check shared PNG metadata regardless. Small node, real problem, properly solved.