# How to Use Third-Party Libraries in OpenAI Plugins: A Complete Guide

> Learn how to use third-party libraries in OpenAI plugins. Discover how to declare dependencies and configure your environment for secure execution within the sandbox.

- Repository: [OpenAI/plugins](https://github.com/openai/plugins)
- Tags: how-to-guide
- Published: 2026-06-14

---

**Yes, you can use third-party libraries in OpenAI plugins by declaring them in your dependency manifest and environment configuration, allowing the sandboxed runtime to install and execute them securely.**

The **openai/plugins** repository provides a fully sandboxed execution environment for custom plugins, giving you complete control over your runtime dependencies. When you build a plugin, you ship your source code alongside a manifest that lists required packages, enabling you to import any public library available via `pip` or `npm`. This architecture ensures that external dependencies are installed automatically while maintaining strict security boundaries.

## How the OpenAI Plugin Architecture Supports External Dependencies

The platform accommodates third-party code through four core mechanisms that handle installation, security, and isolation.

### The Manifest and Dependency Declaration

Every plugin requires a **manifest file** located at [`.codex-plugin/plugin.json`](https://github.com/openai/plugins/blob/main/.codex-plugin/plugin.json) that describes the plugin name, entry points, and required permissions. According to the manifest schema defined in [`.agents/skills/plugin-creator/references/plugin-json-spec.md`](https://github.com/openai/plugins/blob/main/.agents/skills/plugin-creator/references/plugin-json-spec.md), you can include a `dependencies` section that tells the platform which packages to install before executing your code.

The **Plugin Creator skill** automatically scaffolds the necessary dependency files when you initialize a new project. As documented in [`.agents/skills/plugin-creator/SKILL.md`](https://github.com/openai/plugins/blob/main/.agents/skills/plugin-creator/SKILL.md), this skill generates a [`requirements.txt`](https://github.com/openai/plugins/blob/main/requirements.txt) for Python plugins or a [`package.json`](https://github.com/openai/plugins/blob/main/package.json) for Node.js plugins, ensuring your third-party libraries are declared correctly from the start.

### Runtime Installation Process

Plugins execute in language-specific runtimes (Python or Node.js) within clean sandboxed environments. When a plugin first loads, the platform reads your dependency list and runs the appropriate installation command—`pip install` for Python or `npm install` for Node—before invoking your code. This happens transparently, so your imports resolve exactly as they would in a local development environment.

### Security Validation and Secret Management

The platform validates that **no secret values are embedded in your source code**. If a third-party library requires an API key, you must expose it through an environment variable defined in your plugin’s `.env.example` file or via the marketplace’s auto-provisioned variables. The runtime never exposes raw secrets in the source tree, ensuring that sensitive credentials remain encrypted and separate from your logic.

### Container Isolation

Each plugin runs in its own container, providing complete isolation from other plugins. Even if two plugins depend on the same third-party library, they operate in separate environments, eliminating version conflicts and dependency hell.

## Implementing Third-Party Libraries in Your Plugin

You can safely add any public library to extend your plugin’s functionality. Below are implementation patterns for Python and Node.js based on real examples from the repository.

### Python: Using the Requests Library

To use the `requests` library for HTTP calls, declare it in your [`requirements.txt`](https://github.com/openai/plugins/blob/main/requirements.txt) file:

```text
requests>=2.28.0

```

Then import and use it in your plugin code, accessing API keys through environment variables:

```python
import os
import requests

def get_user_profile(user_id: str) -> dict:
    """Fetch a user profile from an external service."""
    resp = requests.get(
        f"https://api.example.com/users/{user_id}",
        headers={"Authorization": f"Bearer {os.getenv('EXAMPLE_API_KEY')}"}
    )
    resp.raise_for_status()
    return resp.json()

```

### Node.js: Using the Twilio SDK

For Node.js plugins, add the package to your [`package.json`](https://github.com/openai/plugins/blob/main/package.json) dependencies:

```json
{
  "dependencies": {
    "twilio": "^4.0.0"
  }
}

```

Then require the module and initialize it using environment variables:

```javascript
const twilio = require('twilio');

const client = twilio(process.env.TWILIO_SID, process.env.TWILIO_TOKEN);

async function sendSms(to, body) {
  await client.messages.create({
    from: process.env.TWILIO_FROM,
    to,
    body,
  });
}

```

## Real-World Examples from the Repository

The **openai/plugins** repository contains production-ready demonstrations of third-party library usage.

### Twilio Agent Connect Skill

The [`plugins/twilio-developer-kit/skills/twilio-agent-connect/SKILL.md`](https://github.com/openai/plugins/blob/main/plugins/twilio-developer-kit/skills/twilio-agent-connect/SKILL.md) file documents a complete implementation using the Twilio SDK (a third-party NPM package) to send SMS messages and manage voice calls. This example demonstrates proper environment variable configuration for Twilio credentials and shows how to structure a plugin that relies on external SaaS APIs.

### Zoom OAuth and HTTP Clients

Several skills in the Zoom plugin demonstrate third-party REST integration using standard HTTP clients. The [`plugins/zoom/skills/zoom-apps-sdk/references/oauth.md`](https://github.com/openai/plugins/blob/main/plugins/zoom/skills/zoom-apps-sdk/references/oauth.md) file illustrates how to implement OAuth flows—requiring external HTTP libraries—to authenticate with Zoom’s API securely.

## Summary

- **Yes, third-party libraries are fully supported** in OpenAI plugins through the sandboxed execution environment.
- **Declare dependencies** in [`requirements.txt`](https://github.com/openai/plugins/blob/main/requirements.txt) (Python) or [`package.json`](https://github.com/openai/plugins/blob/main/package.json) (Node.js), which the Plugin Creator skill can scaffold for you.
- **Use environment variables** for all secrets and API keys; never hard-code credentials in your source.
- **Each plugin runs in isolation**, preventing version conflicts between different plugins.
- **Real-world examples** exist in the repository, including the Twilio Agent Connect skill and Zoom OAuth implementations.

## Frequently Asked Questions

### Can I use any Python or Node.js package in an OpenAI plugin?

Yes, you can use any public package available on PyPI or NPM as long as it does not require system-level privileges or hard-coded secrets. The platform installs dependencies via standard package managers (`pip` or `npm`) when your plugin loads, giving you access to the full ecosystem of open-source libraries.

### How do I install dependencies when developing an OpenAI plugin?

You do not manually install dependencies in the sandbox. Instead, list them in your [`requirements.txt`](https://github.com/openai/plugins/blob/main/requirements.txt) or [`package.json`](https://github.com/openai/plugins/blob/main/package.json) file. The Plugin Creator skill, documented in [`.agents/skills/plugin-creator/SKILL.md`](https://github.com/openai/plugins/blob/main/.agents/skills/plugin-creator/SKILL.md), automatically generates these files when scaffolding a new plugin. The platform handles installation automatically when executing your code.

### Are there security restrictions when using external libraries?

The primary restriction is that you cannot embed secret values directly in your source code. The platform scans for hard-coded credentials and rejects plugins that violate this policy. All sensitive configuration must flow through environment variables defined in `.env.example` or provisioned via the marketplace, ensuring third-party libraries receive credentials securely at runtime.

### Can two plugins use different versions of the same library?

Yes. Because each plugin runs in its own containerized environment, dependency versions are isolated per plugin. One plugin can use `requests==2.28.0` while another uses `requests==2.31.0` without conflict, as each environment maintains its own virtual environment or `node_modules` directory.