[GH-ISSUE #6] upload_file returns 401 — emits X-API-Key header, server only accepts X-Api-Key #4

New issue

Closed

opened 2026-10-26 22:27:40 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-26 22:27:40 +00:00

Owner

Originally created by @kygdigital on GitHub (Apr 26, 2026).
Original GitHub issue: https://github.com/Comfy-Org/comfy-cloud-mcp/issues/6

The upload_file MCP tool generates a curl command using header X-API-Key, but the upload endpoint at https://cloud.comfy.org/api/upload/image rejects that header with 401 {"message":"authentication required"}. The same key authenticates successfully when sent as X-Api-Key (mixed case) or Authorization: Bearer.

Steps to reproduce:

Call upload_file MCP tool with a valid local file.
Run the emitted curl command with a valid COMFY_API_KEY.
Receive HTTP 401.

Expected: 200 with {name, subfolder, type} JSON.
Actual: 401 authentication required. Seems the upload endpoint's header parser is case-sensitive and the tool template uses the wrong case, or the MCP transport accepts X-API-Key while the public API only accepts X-Api-Key

Workaround: Replace -H "X-API-Key: $COMFY_API_KEY" with -H "X-Api-Key: $COMFY_API_KEY" (capital A only)

Impact: Blocks the documented "upload local image → reference in workflow" flow end-to-end. I hit a 401 with no obvious cause since the same key works for every other MCP call.

Environment: Claude Code MCP client, comfyui-cloud MCP server (https://cloud.comfy.org/mcp), curl 8.x on macOS.

Originally created by @kygdigital on GitHub (Apr 26, 2026). Original GitHub issue: https://github.com/Comfy-Org/comfy-cloud-mcp/issues/6 The upload_file MCP tool generates a curl command using header X-API-Key, but the upload endpoint at https://cloud.comfy.org/api/upload/image rejects that header with 401 {"message":"authentication required"}. The same key authenticates successfully when sent as X-Api-Key (mixed case) or Authorization: Bearer. Steps to reproduce: 1. Call upload_file MCP tool with a valid local file. 2. Run the emitted curl command with a valid COMFY_API_KEY. 3. Receive HTTP 401. Expected: 200 with {name, subfolder, type} JSON. Actual: 401 authentication required. Seems the upload endpoint's header parser is case-sensitive and the tool template uses the wrong case, or the MCP transport accepts X-API-Key while the public API only accepts X-Api-Key Workaround: Replace -H "X-API-Key: $COMFY_API_KEY" with -H "X-Api-Key: $COMFY_API_KEY" (capital A only) Impact: Blocks the documented "upload local image → reference in workflow" flow end-to-end. I hit a 401 with no obvious cause since the same key works for every other MCP call. Environment: Claude Code MCP client, comfyui-cloud MCP server (https://cloud.comfy.org/mcp), curl 8.x on macOS.

bsakaguchi closed this issue

2026-10-26 22:27:40 +00:00

bsakaguchi commented

2026-10-26 22:27:43 +00:00

Author

Owner

@mattmillerai commented on GitHub (Jun 22, 2026):

Migrated to Comfy-Org/comfy-cloud-mcp-server#427 (this installer repo is being archived). Tracking the fix there.

@mattmillerai commented on GitHub (Jun 22, 2026): Migrated to Comfy-Org/comfy-cloud-mcp-server#427 (this installer repo is being archived). Tracking the fix there.

bsakaguchi referenced this issue

2026-10-26 22:27:47 +00:00

[PR #4] [MERGED] sync: update skills from comfy-cloud-mcp-server #7