Secrets
Encrypted environment variables for your machines — API keys your custom nodes need, without baking them into anything.
Many custom nodes need credentials at runtime — a Comfy.org API key for API nodes, S3 credentials, third-party model APIs. Secrets are encrypted key/value pairs attached to your machines and injected as environment variables when the machine runs.
Creating a secret
- Go to the Secrets page
- New secret → give it a name and add your key/value pairs (e.g.
API_KEY_COMFY_ORG=sk-…) - Attach the secret to a machine in the machine's settings
Values are stored encrypted and never shown again after saving — you can replace them, but not read them back.
When your nodes see them
Secrets are injected as environment variables into the machine's container at start. Any custom node that reads os.environ gets them — no code changes, no hardcoding keys into workflows that might get shared.
Common uses
| Secret | Used by |
|---|---|
API_KEY_COMFY_ORG | Comfy.org API nodes (paid external models) with your own key |
| S3 credentials | Custom S3 output storage |
| Third-party API keys | Any custom node calling external services |
Never put API keys directly in workflow JSON or node fields — workflows can be shared and exported. Secrets exist so credentials live outside anything that leaves the platform.