# Web Application Deployment Patterns for OpenAI Plugin Projects > Explore web application deployment patterns for OpenAI plugin projects. Learn Vercel Git-based CI/CD Netlify CLI flows Zoom HTTPS tunnels and Cloudflare Workers for efficient plugin deployment. - Repository: [OpenAI/plugins](https://github.com/openai/plugins) - Tags: architecture - Published: 2026-06-27 --- **OpenAI plugin projects require public HTTPS endpoints, secure secrets management, and persistent storage, with deployment patterns varying by platform—Vercel uses Git-based CI/CD with preview URLs, Netlify relies on CLI-driven flows, Zoom needs HTTPS tunnels for local development, and Cloudflare deploys edge Workers via Wrangler.** The `openai/plugins` repository contains reusable skill files that document how to deploy web services across major cloud platforms. These patterns cover everything from local development with webhook tunnels to production CI/CD pipelines. Understanding these concrete implementations helps developers ship reliable plugin backends that meet OpenAI's architectural requirements. ## Core Architectural Requirements Every OpenAI plugin deployment must satisfy five critical requirements to handle OAuth flows, webhook callbacks, and stateful operations securely. ### Public HTTPS Endpoints Plugins must expose **public HTTPS endpoints** to receive secure callbacks from platforms like Zoom, Vercel, and Cloudflare. According to the Zoom deployment guide in [`plugins/zoom/skills/team-chat/concepts/deployment.md`](https://github.com/openai/plugins/blob/main/plugins/zoom/skills/team-chat/concepts/deployment.md), all webhook registrations require TLS termination via reverse proxies such as Nginx or Cloudflare's proxy layer. ### Secrets Management **Client IDs, OAuth secrets, and API keys** must never reside in source control. The repository recommends platform-specific secret stores: Vercel Environment Variables, Netlify Environment Variables, and Cloudflare Secrets. Access these via environment variables at runtime rather than hardcoded configuration files. ### Persistent Storage OAuth tokens and webhook idempotency keys require durability across restarts. The deployment patterns support **Cloud databases** (Supabase, DynamoDB) and **KV stores** (Cloudflare Workers KV) for maintaining state between serverless function invocations. ### CI/CD Pipeline Automated workflows handle preview builds for pull requests and production promotion. The Vercel deployment expert in [`plugins/vercel/agents/deployment-expert.md`](https://github.com/openai/plugins/blob/main/plugins/vercel/agents/deployment-expert.md) demonstrates GitHub Actions integration that builds artifacts before deployment. ### Preview-First Workflow and Rollback All platforms support **preview deployments** for safe testing before live rollout. Recovery mechanisms include `vercel rollback`, `netlify deploy --prod` after fixes, or Git revert triggers to regenerate builds. ## Platform-Specific Deployment Patterns The repository encodes platform-specific logic as reusable markdown skills that follow the universal pattern: **authenticate → link/create site → build → preview → promote**. ### Vercel Located in [`plugins/vercel/agents/deployment-expert.md`](https://github.com/openai/plugins/blob/main/plugins/vercel/agents/deployment-expert.md) and [`plugins/vercel/skills/vercel-cli/SKILL.md`](https://github.com/openai/plugins/blob/main/plugins/vercel/skills/vercel-cli/SKILL.md), the Vercel pattern supports Git-push triggered previews and production promotion. **Key commands:** - `vercel build && vercel deploy --prebuilt` (pre-built strategy) - `vercel promote ` (production promotion) - `vercel pull --yes --environment=production` (environment sync) The platform handles monorepo builds and edge-first architectures through configuration in [`vercel.json`](https://github.com/openai/plugins/blob/main/vercel.json). ### Netlify Documented in [`plugins/netlify/skills/netlify-deploy/references/deployment-patterns.md`](https://github.com/openai/plugins/blob/main/plugins/netlify/skills/netlify-deploy/references/deployment-patterns.md), Netlify uses a CLI-driven flow that supports framework detection and static site deployment. **Implementation steps:** 1. `npx netlify login` (authentication) 2. `npx netlify init` (site creation) 3. `npm run build` (artifact generation) 4. `npx netlify deploy --dir=dist --prod` (production push) For Vite or React applications, specify the `dist` directory explicitly. The pattern handles monorepo subdirectories through [`netlify.toml`](https://github.com/openai/plugins/blob/main/netlify.toml) configuration. ### Zoom The [`plugins/zoom/skills/team-chat/concepts/deployment.md`](https://github.com/openai/plugins/blob/main/plugins/zoom/skills/team-chat/concepts/deployment.md) file describes running local servers behind HTTPS tunnels for webhook development. **Development workflow:** ```bash export ZOOM_CLIENT_ID=your_client_id export ZOOM_CLIENT_SECRET=your_secret ngrok http 3000 ``` Register the generated `https://.ngrok.io` URL as the webhook endpoint in the Zoom Marketplace. This pattern requires persistent storage for OAuth tokens between restarts. ### Cloudflare Found in [`plugins/cloudflare/skills/cloudflare/references/api-shield/configuration.md`](https://github.com/openai/plugins/blob/main/plugins/cloudflare/skills/cloudflare/references/api-shield/configuration.md) and [`plugins/cloudflare/skills/cloudflare/references/patterns.md`](https://github.com/openai/plugins/blob/main/plugins/cloudflare/skills/cloudflare/references/patterns.md), Cloudflare deployments utilize edge Workers and KV stores. **Essential commands:** - `wrangler publish` (Worker deployment) - `wrangler secret put ` (secret management) The API Shield configuration enables JWT validation and firewall rules critical for securing edge-deployed plugin endpoints. ## Implementation Examples Copy these concrete snippets directly from the repository's skill files to bootstrap your deployment pipeline. ### Vercel CI/CD via GitHub Actions ```bash npm install -g vercel vercel pull --yes --environment=production --token=${VERCEL_TOKEN} vercel build --prod --token=${VERCEL_TOKEN} vercel deploy --prebuilt --prod --token=${VERCEL_TOKEN} ``` This sequence appears in the deployment-expert agent and enables automated production releases triggered by repository events. ### Netlify First-Time Deployment ```bash npx netlify status # Verify login state npx netlify login # Authenticate if needed npx netlify init # Create new site npm install # Install dependencies npm run build # Generate dist/ npx netlify deploy --dir=dist --prod ``` For subsequent updates, omit the `init` step and run the build and deploy commands only. ### Zoom Local Development Tunnel ```bash export ZOOM_CLIENT_ID=… # Load from secure vault export ZOOM_CLIENT_SECRET=… ngrok http 3000 # Exposes localhost as HTTPS ``` After starting the tunnel, copy the HTTPS URL into the Zoom Marketplace webhook configuration to receive real-time events during development. ## Key Repository Files Reference these specific paths when implementing your deployment strategy: - **[`plugins/zoom/skills/team-chat/concepts/deployment.md`](https://github.com/openai/plugins/blob/main/plugins/zoom/skills/team-chat/concepts/deployment.md)** – Minimal checklist for Zoom webhook services covering HTTPS requirements and OAuth token persistence. - **[`plugins/netlify/skills/netlify-deploy/references/deployment-patterns.md`](https://github.com/openai/plugins/blob/main/plugins/netlify/skills/netlify-deploy/references/deployment-patterns.md)** – Decision tree for Netlify CLI workflows, including monorepo and static site scenarios. - **[`plugins/vercel/agents/deployment-expert.md`](https://github.com/openai/plugins/blob/main/plugins/vercel/agents/deployment-expert.md)** – Diagnostic matrix and CI/CD YAML examples for Vercel deployments. - **[`plugins/cloudflare/skills/cloudflare/references/api-shield/configuration.md`](https://github.com/openai/plugins/blob/main/plugins/cloudflare/skills/cloudflare/references/api-shield/configuration.md)** – API Shield, JWT validation, and edge firewall configuration. - **[`plugins/vercel/skills/vercel-services/SKILL.md`](https://github.com/openai/plugins/blob/main/plugins/vercel/skills/vercel-services/SKILL.md)** – Multi-service Vercel projects combining Python APIs with Next.js frontends. - **[`plugins/cloudflare/skills/cloudflare/references/patterns.md`](https://github.com/openai/plugins/blob/main/plugins/cloudflare/skills/cloudflare/references/patterns.md)** – Reusable Cloudflare patterns for Workers, KV stores, and firewall rules. ## Deployment Workflow Follow this unified sequence across all platforms: 1. **Select platform** based on your latency, scaling, and edge requirements. 2. **Configure secrets** in the platform's native store (never commit to Git). 3. **Define build configuration** in [`netlify.toml`](https://github.com/openai/plugins/blob/main/netlify.toml), [`vercel.json`](https://github.com/openai/plugins/blob/main/vercel.json), or [`wrangler.toml`](https://github.com/openai/plugins/blob/main/wrangler.toml). 4. **Execute platform CLI** following the pattern file to generate a preview URL. 5. **Validate preview** through automated tests and manual verification. 6. **Promote to production** using `vercel promote`, `netlify deploy --prod`, or `wrangler publish`. 7. **Monitor and rollback** via platform logs and analytics dashboards. ## Summary - **OpenAI plugins require HTTPS endpoints** with proper TLS termination and persistent storage for OAuth tokens. - **Vercel** uses Git-based CI/CD with `vercel build` and `vercel deploy` commands, supporting pre-built artifacts and monorepos. - **Netlify** relies on CLI authentication via `netlify login` followed by `netlify deploy --dir=dist --prod`. - **Zoom development** requires HTTPS tunneling tools like `ngrok` to expose local servers for webhook testing. - **Cloudflare** deploys edge Workers using `wrangler publish` and manages secrets via `wrangler secret put`. - All platforms support preview deployments and rollback mechanisms for safe production updates. ## Frequently Asked Questions ### What are the minimum requirements for deploying an OpenAI plugin? OpenAI plugins require a **public HTTPS endpoint** for webhooks, **secure secrets management** for API keys and OAuth credentials, and **persistent storage** for tokens and user state. The [`plugins/zoom/skills/team-chat/concepts/deployment.md`](https://github.com/openai/plugins/blob/main/plugins/zoom/skills/team-chat/concepts/deployment.md) file specifies that local development must use HTTPS tunneling tools like `ngrok` to satisfy the HTTPS requirement during testing. ### How do I handle secrets in OpenAI plugin deployments? Never store secrets in source control. According to the repository patterns, use platform-specific secret stores: **Vercel Environment Variables**, **Netlify Environment Variables**, or **Cloudflare Secrets**. Access these at runtime through environment variables, and inject them during CI/CD using tokens like `${VERCEL_TOKEN}` or `wrangler secret put`. ### Which deployment pattern works best for serverless edge functions? **Cloudflare Workers** provide the native edge deployment pattern documented in [`plugins/cloudflare/skills/cloudflare/references/patterns.md`](https://github.com/openai/plugins/blob/main/plugins/cloudflare/skills/cloudflare/references/patterns.md). Use `wrangler publish` to deploy Workers and `wrangler secret put` to manage credentials. For Vercel edge functions, configure [`vercel.json`](https://github.com/openai/plugins/blob/main/vercel.json) and use the `vercel build` command to generate edge-compatible artifacts. ### How do I set up a preview environment before production deployment? All major platforms support preview URLs. In **Vercel**, Git pushes automatically generate preview URLs that you can validate before running `vercel promote`. **Netlify** creates previews via `netlify deploy` (without the `--prod` flag). These preview-first workflows allow safe testing of webhook integrations and OAuth flows without affecting live users.