# Understanding OpenAI Plugin Licensing and Developer Terms: A Complete Guide

> Master OpenAI plugin licensing and developer terms. Understand MIT licenses, plugin JSON manifests, authentication, permissions, and acceptable use. Get the complete guide.

- Repository: [OpenAI/plugins](https://github.com/openai/plugins)
- Tags: licensing-guide
- Published: 2026-06-27

---

**OpenAI plugins use a dual-layer legal model where each plugin carries its own MIT License while developer terms governing authentication, permissions, and acceptable use are defined in the mandatory [`.codex-plugin/plugin.json`](https://github.com/openai/plugins/blob/main/.codex-plugin/plugin.json) manifest.**

The `openai/plugins` repository organizes integrations as self-contained packages, each establishing distinct legal permissions through decentralized licensing and operational constraints through machine-readable manifests. Understanding how **OpenAI plugin licensing and developer terms** interact ensures compliance whether you are publishing, consuming, or redistributing plugin code.

## Repository Architecture and Licensing Structure

The repository eschews a monolithic license in favor of per-plugin ownership. Each plugin resides under `plugins/<plugin-name>/` and maintains independent legal authority.

### Per-Plugin MIT Licensing

Every plugin directory contains a `LICENSE` file (predominantly MIT) that grants explicit rights to **use, copy, modify, merge, publish, distribute, sublicense, and sell** the software. Because the repository root does not contain a single top-level LICENSE file, the `plugins/<plugin-name>/LICENSE` path serves as the authoritative source for each integration's legal terms.

When redistributing or forking code from the repository, you must preserve the copyright notice and license text found in the specific plugin's `LICENSE` file. This decentralized approach allows third-party developers to safely adapt individual plugins without inheriting complex monolithic licensing dependencies.

### Marketplace Configuration Files

The repository uses JSON configuration files to define plugin availability without altering licensing terms:

- [`.agents/plugins/marketplace.json`](https://github.com/openai/plugins/blob/main/.agents/plugins/marketplace.json) — Default marketplace definition pointing to the `plugins/` directory
- [`.agents/plugins/api_marketplace.json`](https://github.com/openai/plugins/blob/main/.agents/plugins/api_marketplace.json) — Alternative marketplace for API-key-authenticated users

These files reference plugin locations but do not modify the underlying MIT licenses or developer terms defined in individual manifests.

## Understanding Developer Terms in the Manifest

The [`.codex-plugin/plugin.json`](https://github.com/openai/plugins/blob/main/.codex-plugin/plugin.json) file serves as the binding contract between the plugin and the OpenAI platform. This manifest encodes the **developer terms** that restrict how the plugin operates regardless of the permissive MIT license.

### The plugin.json Schema

A valid manifest declares capabilities, authentication requirements, and usage policies. Here is the structural breakdown:

```json
{
  "name": "figma",
  "description": "Design-to-code and Code Connect for Figma",
  "version": "1.0.0",
  "api": {
    "type": "openapi",
    "url": "https://api.figma.com/openapi.json"
  },
  "auth": {
    "type": "oauth2",
    "scopes": ["files:read", "files:write"]
  },
  "permissions": [
    "read:user",
    "write:files"
  ],
  "terms": {
    "allowed_use": "non-commercial and commercial projects",
    "prohibited_content": "illegal, hateful, or disallowed material"
  }
}

```

### Authentication and Permissions

The `auth` field declares the security flow (OAuth 2, API key, etc.) and the specific scopes the plugin requests from users. The `permissions` array lists granular actions the plugin may perform on behalf of the user, such as `read:user` or `write:files`. These declarations function as operational constraints that the OpenAI platform enforces at runtime.

### Usage Policies and Restrictions

The `terms` object outlines acceptable use cases and content restrictions. Typical fields include `allowed_use` (defining commercial viability) and `prohibited_content` (banning illegal or harmful material). These free-form policies constitute the binding developer terms that publishers must honor and users must accept before installation.

## How Licensing and Terms Work Together

The separation of legal rights (MIT License) from operational constraints (manifest terms) creates a clear compliance framework:

1. **Publishing** — Contributors include both the `LICENSE` file and the [`plugin.json`](https://github.com/openai/plugins/blob/main/plugin.json) manifest. The MIT license grants code-level rights, while the manifest imposes platform-level restrictions.
2. **Installation** — The OpenAI platform reads the manifest to enforce declared permissions and usage terms before activating the plugin for a user.
3. **Redistribution** — Forks must preserve the MIT license text and cannot remove the `terms` object from the manifest, ensuring downstream users remain bound by the original developer terms.

This model ensures that while code remains open and modifiable, runtime behavior respects the original author's operational constraints.

## Working with Licenses and Manifests in Code

When building tooling around the OpenAI plugins ecosystem, you can programmatically interact with both licensing and developer terms.

### Loading Licenses at Runtime

To surface MIT license text to end-users, resolve the file path dynamically:

```javascript
import fs from 'fs';
import path from 'path';

function getPluginLicense(pluginName) {
  const licensePath = path.join(
    __dirname,
    'plugins',
    pluginName,
    'LICENSE'
  );
  return fs.readFileSync(licensePath, 'utf8');
}

console.log(getPluginLicense('zoom'));

```

This Node.js approach satisfies the MIT requirement to include the license in all copies while allowing UI integration.

### Validating Developer Terms

For CI pipelines, validate that manifests contain required terms fields:

```python
import json
from pathlib import Path

def load_manifest(plugin):
    manifest_path = Path('plugins') / plugin / '.codex-plugin' / 'plugin.json'
    return json.loads(manifest_path.read_text())

def validate_terms(manifest):
    terms = manifest.get('terms', {})
    assert 'allowed_use' in terms, "Manifest must state allowed use"
    assert 'prohibited_content' in terms, "Manifest must list prohibited content"

manifest = load_manifest('figma')
validate_terms(manifest)
print("Manifest terms are valid.")

```

This validation step ensures compliance with repository standards before publishing, as enforced by the `plugin-eval` tooling documented in [`plugins/plugin-eval/README.md`](https://github.com/openai/plugins/blob/main/plugins/plugin-eval/README.md).

### Displaying Terms in UIs

Embed legal transparency directly into React interfaces:

```tsx
import React, { useEffect, useState } from 'react';
import axios from 'axios';

export const LicenseView: React.FC<{ plugin: string }> = ({ plugin }) => {
  const [license, setLicense] = useState('');

  useEffect(() => {
    axios.get(`/plugins/${plugin}/LICENSE`).then(res => setLicense(res.data));
  }, [plugin]);

  return (
    <div>
      <h2>{plugin} – MIT License</h2>
      <pre>{license}</pre>
    </div>
  );
};

```

This pattern helps users review open-source terms before enabling plugin functionality.

## Key Files and Their Roles

- **[`README.md`](https://github.com/openai/plugins/blob/main/README.md)** — High-level repository overview and marketplace layout explanation
- **`plugins/<name>/LICENSE`** — Definitive MIT license for each individual plugin (e.g., `plugins/zoom/LICENSE`)
- **`plugins/<name>/.codex-plugin/plugin.json`** — Manifest encoding authentication, permissions, and developer-term policies
- **[`.agents/plugins/marketplace.json`](https://github.com/openai/plugins/blob/main/.agents/plugins/marketplace.json)** — Default marketplace pointer for the plugin directory
- **[`.agents/plugins/api_marketplace.json`](https://github.com/openai/plugins/blob/main/.agents/plugins/api_marketplace.json)** — API-key-user marketplace configuration
- **[`plugins/plugin-eval/README.md`](https://github.com/openai/plugins/blob/main/plugins/plugin-eval/README.md)** — Documentation for CI validation of manifest correctness

## Summary

- Each plugin carries its own MIT License in `plugins/<plugin-name>/LICENSE`, granting broad usage rights while requiring copyright notice preservation.
- Developer terms live in [`.codex-plugin/plugin.json`](https://github.com/openai/plugins/blob/main/.codex-plugin/plugin.json), defining authentication flows, permission scopes, and acceptable use policies that the platform enforces.
- The repository uses marketplace JSON files to organize plugins without modifying individual licensing terms.
- Validation tooling in `plugins/plugin-eval` ensures manifests meet structural requirements before publication.
- When redistributing plugins, you must maintain both the MIT license file and the original manifest terms object.

## Frequently Asked Questions

### What license covers the OpenAI plugins repository?

Each plugin is individually licensed under the MIT License via its own `LICENSE` file. There is no single repository-wide license; you must check the specific `plugins/<plugin-name>/LICENSE` file for the exact terms governing that code.

### Where are the developer terms defined for a specific plugin?

Developer terms are encoded in the [`.codex-plugin/plugin.json`](https://github.com/openai/plugins/blob/main/.codex-plugin/plugin.json) manifest file within each plugin directory. This JSON file specifies authentication requirements, permission scopes, and usage restrictions under the `auth`, `permissions`, and `terms` fields.

### Can I modify and sell a plugin from this repository?

Yes, the MIT License explicitly grants rights to **modify, sublicense, and sell** the software. However, you must include the original copyright notice and license text. Additionally, if you redistribute the plugin, you must preserve the `terms` object in the manifest, which may impose operational restrictions on how the plugin functions within the OpenAI platform.

### How does the platform enforce developer terms?

The OpenAI platform reads the [`plugin.json`](https://github.com/openai/plugins/blob/main/plugin.json) manifest during installation to validate authentication scopes and permissions. The CI pipeline also uses the `plugin-eval` tooling referenced in [`plugins/plugin-eval/README.md`](https://github.com/openai/plugins/blob/main/plugins/plugin-eval/README.md) to check that manifests contain required fields like `allowed_use` and `prohibited_content` before accepting publication.