Allow Comfy API key from environment

[yzxcj797]

Fixes #12542.

Summary

• Allow the server environment to provide a Comfy API key through API_KEY_COMFY_ORG.
• Use that key for the X-API-KEY header before falling back to request-provided credentials.

Tests

• python -m pytest tests-unit/comfy_api_nodes_test/helpers_test.py -q — 3 passed.
• python -m pytest tests-unit/comfy_api_nodes_test -q — 18 passed.
• python -m ruff check comfy_api_nodes/util/_helpers.py tests-unit/comfy_api_nodes_test/helpers_test.py — all checks passed.

API Node PR Checklist

Scope

• Is API Node Change

Pricing & Billing

• Need pricing update
• No pricing update

If Need pricing update:

• Metronome rate cards updated
• Auto‑billing tests updated and passing

QA

• QA done
• QA not required

Comms

• Informed Kosinkadink

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6dc6bed5-a815-460e-9677-c0a567248476

📥 Commits

Reviewing files that changed from the base of the PR and between 76135e5 and e4c716b.

📒 Files selected for processing (2)

• comfy_api_nodes/util/_helpers.py
• tests-unit/comfy_api_nodes_test/helpers_test.py

Included review availability: Your plan provides up to 10 included reviews per hour; 4 remain after this review.

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (6)

**/*

📄 CodeRabbit inference engine (AGENTS.md)

**/*: Keep changes small, direct, and limited to the narrowest necessary code path and smallest number of files.
Prefer practical fixes, minimal dependencies, and existing repository patterns; remove obsolete, dead, unreachable, or unused code.
Preserve existing APIs, node names, model-loading behavior, file layout, and workflow compatibility unless replacement is explicitly intended.
Core ComfyUI must not add outbound internet requests, telemetry, tracking, reporting, remote configuration, or background network activity. User-authorized model downloads are limited to the requested artifact and must exclude telemetry and unrelated metadata.

Files:

• tests-unit/comfy_api_nodes_test/helpers_test.py
• comfy_api_nodes/util/_helpers.py

**/*.py

📄 CodeRabbit inference engine (AGENTS.md)

**/*.py: Keep state and capability flags on the object that owns the behavior. Prefer explicit parent-owned attributes over probing child objects with getattr; use child checks only when the child owns the delegated behavior.
Preserve shared method signatures, argument order, return shapes, side effects, and error behavior unless every affected caller and interface is intentionally updated.
Do not add unused compatibility parameters, flags, attributes, constructor options, or model-specific options to shared helpers; keep one-off behavior at the integration boundary.
Normalize third-party return conventions at integration boundaries so core code receives the expected type and shape; avoid undocumented caller-side unwrapping.
Do not add torch.no_grad, torch.inference_mode, or inference-mode wrappers. Do not add model freeze/unfreeze toggles; only disable globally enabled inference mode when a training path requires gradients.
Remove inference-only training behavior such as dropout while preserving checkpoint and state-dict compatibility; use nn.Identity when deleting a module would alter keys or ordering.
Keep imports at module scope except established optional-backend probes or imports required to avoid cycles; avoid unnecessary try/except blocks and use specific exceptions with useful fallbacks.
Do not add workarounds for unsupported library versions, especially PyTorch exception-and-float-cast retries, unless a comment names the exact versions still requiring them.
Let unsupported model formats, invalid quantization metadata, and bad states fail with clear errors instead of silently degrading output.
Match local style, keep comments sparse and useful, and remove comments that merely restate obvious code.
Treat dtype, device placement, VRAM use, and offloading as correctness concerns across CPU, CUDA, ROCm, MPS, DirectML, XPU, NPU, and low-VRAM environments.
Prefer existing ComfyUI and Comfy Kitchen operations, quantization helpers, cast/offload helpe...

Files:

• tests-unit/comfy_api_nodes_test/helpers_test.py
• comfy_api_nodes/util/_helpers.py

**/*.{py,json}

📄 CodeRabbit inference engine (AGENTS.md)

Treat legacy combo, io.Combo, and io.DynamicCombo values affecting filesystem access as untrusted; revalidate them at load/save boundaries with folder_paths, containment checks, or fixed allowlists.

Files:

• tests-unit/comfy_api_nodes_test/helpers_test.py
• comfy_api_nodes/util/_helpers.py

**/*.{py,md,txt,json}

📄 CodeRabbit inference engine (AGENTS.md)

Keep warning and info messages short and actionable, remove noisy or misleading logging, and make documentation edits concise, factual, and tied to changed behavior.

Files:

• tests-unit/comfy_api_nodes_test/helpers_test.py
• comfy_api_nodes/util/_helpers.py

**

⚙️ CodeRabbit configuration file

**: IMPORTANT: Only comment on issues directly introduced by this PR's code changes.
Treat AGENTS.md as mandatory repository policy, not optional style guidance.
Flag PR changes that violate AGENTS.md even when the code is otherwise functional.
In particular, enforce architecture boundaries, dtype/device/memory rules,
interface contracts, import style, no unnecessary try/except blocks, no inline
imports, no outbound internet paths in core ComfyUI, and narrow scoped fixes.
Prefer direct findings over suggestions when a rule is violated. Only ignore
AGENTS.md when it clearly conflicts with a newer explicit maintainer instruction
in the PR.
Do NOT flag pre-existing issues in code that was merely moved, re-indented,
de-indented, or reformatted without logic changes. If code appears in the diff
only due to whitespace or structural reformatting (e.g., removing a with: block),
treat it as unchanged. Contributors should not feel obligated to address
pre-existing issues outside the scope of their contribution.

Files:

• tests-unit/comfy_api_nodes_test/helpers_test.py
• comfy_api_nodes/util/_helpers.py

comfy_api_nodes/**

⚙️ CodeRabbit configuration file

comfy_api_nodes/**: Third-party API integration nodes. Focus on:

• No hardcoded API keys or secrets
• Proper error handling for API failures (timeouts, rate limits, auth errors)
• Correct Pydantic model usage
• Security of user data passed to external APIs

Files:

• comfy_api_nodes/util/_helpers.py

🔇 Additional comments (2)

comfy_api_nodes/util/_helpers.py (1)

37-39: LGTM!

tests-unit/comfy_api_nodes_test/helpers_test.py (1)

1-10: LGTM!

Also applies to: 13-19, 22-43

---

📝 Walkthrough

Walkthrough

get_auth_header now checks API_KEY_COMFY_ORG first and returns its value in an X-API-KEY header when configured. Existing node-level bearer-token and API-key fallbacks remain available. Unit tests cover environment-variable precedence and both hidden credential fallback paths.

Merge Risk: ⚪ Minimal · up to e4c71

The PR adds an environment-provided API key fallback for Comfy API requests; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: allowing a Comfy API key from the server environment.
Description check	✅ Passed	The description explains the environment-variable support, fallback behavior, tests, and checks for this changeset.
Linked Issues check	✅ Passed	The changes satisfy issue #12542 by prioritizing API_KEY_COMFY_ORG and preserving node_cls.hidden credential fallbacks.
Out of Scope Changes check	✅ Passed	The code and tests remain focused on environment-based API key authentication and its fallback behavior.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[alexisrolland]

Closing this as part of a batch cleanup of the review queue.

This account currently has ~30 open pull requests filed over the course of a few days. Submissions at that volume — particularly ones that appear to be largely AI-generated — exceed what our review capacity can absorb, and they congest the queue rather than help maintenance of the repository.

If you'd like to contribute, please open an issue describing the problem first so a maintainer can confirm it's worth fixing, then send a single focused PR. Contributions that come through that way are welcome.

---

Generated by Claude Code