CivitAI download with token broken

[Jinnai]

Describe the bug
Since comfy-cli 1.5.0+ the CivitAI download with token is broken.

To Reproduce

• install comfy-cli 1.5.1
• run command comfy --skip-prompt model download --url '{url}' --relative-path 'models/{local_dir}' --filename '{filename}' --set-civitai-api-token '{token}' with any url that requires login
• Download fails with exception:

DownloadException: Failed to download file.
Unauthorized download (401).
The creator of this asset requires you to be logged in to download it
or you can set a CivitAI API token using `comfy model download
--set-civitai-api-token` or via the `CIVITAI_API_TOKEN` environment variable
Traceback (most recent call last):
  File "/pkg/modal/_runtime/container_io_manager.py", line 778, in handle_input_exception
    yield
  File "/pkg/modal/_container_entrypoint.py", line 243, in run_input_sync
    res = io_context.call_finalized_function()
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/pkg/modal/_runtime/container_io_manager.py", line 197, in call_finalized_function
    res = self.finalized_function.callable(*args, **kwargs)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/root/app.py", line 70, in civitai_dl
    subprocess.run(cmd, shell=True, check=True)

(Same exception when setting the token as environment variable CIVITAI_API_TOKEN instead of with --set-civitai-api-token)

Expected behavior
Download completes without error like it does with comfy-cli 1.4.1 or prior.

[dosubot]

Hi @Jinnai! I'm Dosu and I’m helping the comfy-cli team.

This is a known regression in comfy-cli 1.5.0+ due to a refactor in how CivitAI API tokens are handled. The new logic prioritizes CLI-provided tokens, then environment variables, then config file values, and only sets the Authorization header if the URL is recognized as a CivitAI model or API URL. The correct environment variable is now CIVITAI_TOKEN (not CIVITAI_API_TOKEN), and you can also use the CLI option --set-civitai-api-token. Make sure your token is set using one of these methods and that your URL matches the expected CivitAI format. These changes were introduced in PR #296, which also fixed previous token leakage and improved error messages. If you still get a 401 error, double-check your token and how it's being passed, as the new logic is stricter about matching CivitAI URLs and token sources.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[Jinnai]

To be clear, the readme and PR #280 mention that CIVITAI_API_TOKEN is correct, but I tried both CIVITAI_TOKEN and CIVITAI_API_TOKEN and neither works (same as --set-civitai-api-token).

[bigcat88]

I will take a look tomorrow, thanks for reporting this

[bigcat88]

Unfortunately, I am not able to reproduce this. Maybe you can point me more precisely how can I reproduce this?

My tests from main branch:

CIVITAI_API_TOKEN=XXXXX python3 -m comfy_cli --skip-prompt model download --url https://civitai.com/api/download/models/955535 --relative-path models/test
Start downloading URL: https://civitai.com/api/download/models/955535 into /home/shurik/comfy/ComfyUI/models/test/aidmaFLUXpro1.1-FLUX-V0.2.safetensors
Downloading 73 MB ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00

python3 -m comfy_cli --skip-prompt model download --url https://civitai.com/api/download/models/955535 --relative-path models/test --set-civitai-api-token=XXXXX
Start downloading URL: https://civitai.com/api/download/models/955535 into /home/shurik/comfy/ComfyUI/models/test/aidmaFLUXpro1.1-FLUX-V0.2.safetensors
Downloading 73 MB ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00

Also I tested latest release from pypi:

Downloading comfy_cli-1.5.1-py3-none-any.whl (88 kB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 88.9/88.9 kB 660.4 kB/s eta 0:00:00
Installing collected packages: comfy-cli
Successfully installed comfy-cli-1.5.1
WARNING: There was an error checking the latest version of pip.
(venv) shurik@shurik-linux:~/Comfy/comfy-cli-work$ comfy --skip-prompt model download --url https://civitai.com/api/download/models/955535 --relative-path models/test --set-civitai-api-token=XXXXX
Start downloading URL: https://civitai.com/api/download/models/955535 into /home/shurik/comfy/ComfyUI/models/test/aidmaFLUXpro1.1-FLUX-V0.2.safetensors
Downloading 73 MB ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00

[Jinnai]

Sure, I start from a simple Dockerfile

FROM nvidia/cuda:12.9.0-devel-ubuntu24.04
# python 3.12
COPY /python/. /usr/local
RUN ln -s /usr/local/bin/python3 /usr/local/bin/python

RUN apt-get update
RUN apt-get install -y git

COPY --from=ghcr.io/astral-sh/uv:latest /uv /.uv/uv
RUN /.uv/uv pip install --python $(command -v python) --compile-bytecode comfy-cli==1.5.1

then I run

comfy --skip-prompt model download --url 'https://civitai.com/api/download/models/1617665?type=Model&format=SafeTensor' --relative-path 'models/test' --filename 'test.safetensors' --set-civitai-api-token '{token}'

-> DownloadException: Failed to download file.
Unauthorized download (401).
The creator of this asset requires you to be logged in to download it
or you can set a CivitAI API token using `comfy model download

If I do the exact same steps but with comfy-cli 1.4.1
-> download completes fine

[bigcat88]

Can you test on the latest version of comfy-cli ?

[bigcat88]

there was a rework of CivitAI token usage in the 1.5.0 version: #296

Since comfy-cli 1.5.0+ the CivitAI download with token is broken.

I was hoping you were testing the latest version. Did I miss something?

[Jinnai]

RUN /.uv/uv pip install --python $(command -v python) --compile-bytecode comfy-cli==1.5.1

I am testing with the latest version

[bigcat88]

looks like it works for url https://civitai.com/api/download/models/1617665 but does not work for https://civitai.com/api/download/models/1617665?type=Model&format=SafeTensor

I will investigate it, thanks for reporting

[bigcat88]

commit with regression: 0b2e010

[bigcat88]

@Jinnai the release was published with fix this issue.

Thank you again for your patience in helping us find this bug.