[PR #9] [MERGED] feat: apiKey on submit/run for partner (API) node auth #19

New issue

Closed

opened 2026-10-31 22:03:52 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 22:03:52 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/comfy-typescript-sdk/pull/9
Author: @wei-hai
Created: 7/21/2026
Status: ✅ Merged
Merged: 7/21/2026
Merged by: @wei-hai

Base: main ← Head: feat/extra-data-api-key

📝 Commits (1)

e7b612d feat: apiKey on submit/run for partner (API) node auth

📊 Changes

11 files changed (+145 additions, -11 deletions)

View changed files

➕ .github/CODEOWNERS (+4 -0)
📝 README.md (+17 -0)
📝 scripts/check-public-repo-hygiene.mjs (+20 -3)
📝 spec/openapi.yaml (+10 -0)
📝 src/low/generated/types.gen.ts (+9 -0)
📝 src/low/generated/zod.gen.ts (+4 -1)
📝 src/low/transport.test.ts (+18 -0)
📝 src/low/transport.ts (+15 -2)
📝 src/sdk/client.test.ts (+25 -0)
📝 src/sdk/client.ts (+13 -3)
📝 test/support/stub-server.ts (+10 -2)

📄 Description

What

Workflows that use partner/API nodes (Gemini, etc.) authenticate with a single Comfy API key carried in the POST /api/v2/jobs body as extra_data.api_key_comfy_org. This adds an optional apiKey option to submit()/run() that packs the key into a typed, closed extra_data object sent alongside the workflow.

const job = await client.run(wf, { apiKey: "comfyui-…" });

Omit apiKey and no extra_data is sent (never an empty object).
Low-level types regenerated from the vendored spec (closed extra_data, additionalProperties: false) — nothing beyond api_key_comfy_org can be smuggled through.
The key never participates in idempotency and is never logged or persisted by the SDK.
README documents the field and disambiguates it from the client-constructor apiKey (which authenticates you to the server); often the same key but conceptually distinct.

Tests

New tests at both the transport and client layers prove extra_data.api_key_comfy_org is a sibling of workflow when a key is given and genuinely absent otherwise. vitest — 109/109 passed; typecheck, oxlint, oxfmt --check, and spec-drift all clean.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/comfy-typescript-sdk/pull/9 **Author:** [@wei-hai](https://github.com/wei-hai) **Created:** 7/21/2026 **Status:** ✅ Merged **Merged:** 7/21/2026 **Merged by:** [@wei-hai](https://github.com/wei-hai) **Base:** `main` ← **Head:** `feat/extra-data-api-key` --- ### 📝 Commits (1) - [`e7b612d`](https://github.com/Comfy-Org/comfy-typescript-sdk/commit/e7b612d8749485a6229884497a552ac5aad1a51b) feat: apiKey on submit/run for partner (API) node auth ### 📊 Changes **11 files changed** (+145 additions, -11 deletions) <details> <summary>View changed files</summary> ➕ `.github/CODEOWNERS` (+4 -0) 📝 `README.md` (+17 -0) 📝 `scripts/check-public-repo-hygiene.mjs` (+20 -3) 📝 `spec/openapi.yaml` (+10 -0) 📝 `src/low/generated/types.gen.ts` (+9 -0) 📝 `src/low/generated/zod.gen.ts` (+4 -1) 📝 `src/low/transport.test.ts` (+18 -0) 📝 `src/low/transport.ts` (+15 -2) 📝 `src/sdk/client.test.ts` (+25 -0) 📝 `src/sdk/client.ts` (+13 -3) 📝 `test/support/stub-server.ts` (+10 -2) </details> ### 📄 Description ## What Workflows that use partner/API nodes (Gemini, etc.) authenticate with a single Comfy API key carried in the `POST /api/v2/jobs` body as `extra_data.api_key_comfy_org`. This adds an optional `apiKey` option to `submit()`/`run()` that packs the key into a typed, closed `extra_data` object sent alongside the workflow. ```ts const job = await client.run(wf, { apiKey: "comfyui-…" }); ``` - Omit `apiKey` and **no `extra_data` is sent** (never an empty object). - Low-level types regenerated from the vendored spec (closed `extra_data`, `additionalProperties: false`) — nothing beyond `api_key_comfy_org` can be smuggled through. - The key **never participates in idempotency** and is **never logged or persisted** by the SDK. - README documents the field and disambiguates it from the client-constructor `apiKey` (which authenticates *you* to the server); often the same key but conceptually distinct. ## Tests New tests at both the transport and client layers prove `extra_data.api_key_comfy_org` is a sibling of `workflow` when a key is given and genuinely absent otherwise. `vitest` — 109/109 passed; `typecheck`, `oxlint`, `oxfmt --check`, and spec-drift all clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 22:03:52 +00:00