Enhance your ChatGPT Plugin with Authentication

Updated on May 02, 2023 | By: Snehil Chouhan
  ChatGPT API

ChatGPT offers a wide range of plugin authentication options to cater to various use cases. By specifying the authentication schema in the manifest file, you can control access and security according to your requirements.

This article will provide an in-depth look at the available authentication options and how to implement them.

Authentication Schemas:

1. No Authentication:

For applications that do not require any authentication, ChatGPT supports the no-auth flow. This is useful for open APIs accessible to everyone, allowing traffic from various sources.

To specify no authentication, include the following in your ai-plugin.json file:

"auth": {

"type": "none"

2. Service Level Authentication:

To enable OpenAI plugins to work specifically with your API, provide a client secret during the plugin installation flow. This authenticates traffic from OpenAI plugins without user-level authentication.

To implement Service Level Authentication, follow these steps:

1. Select "Develop your own plugin" in the ChatGPT plugin store.

2. Set auth.type to "service_http" in the ai-plugin.json file.

3. Provide your service access token.

4. Add the verification token to your ai-plugin.json file.

Here's an example of how to set up service level authentication:

"auth": {

"type": "service_http",

"authorization_type": "bearer",

"verification_tokens": {

"openai":

"Replace_this_string_with_the_verification_token_generated_in_the_ChatGPT_UI"

3. User Level Authentication:

Allow user-level authentication by enabling end users to paste their secret API key into the ChatGPT UI during plugin installation. Although this method is encrypted, it's not recommended due to the poor user experience.

To set up user-level authentication, use the following code:

"auth": {

"type": "user_http",

"authorization_type": "bearer",

},

4. OAuth:

The plugin protocol is compatible with OAuth.

Follow these steps to set up OAuth authentication:

1. Paste in your OAuth client id and client secret.

2. Add the verification token to your manifest file.

3. Store an encrypted version of the client secret.

4. Users log in through the plugin’s website during installation.

5. Store the OAuth access token (and optionally, refresh token) for the user, encrypted.

Here's an example of the OAuth flow in the manifest:

"auth": {

"type": "oauth",

"client_url": "https://my_server.com/authorize",

"scope": "",

"authorization_url": "https://my_server.com/token",

"authorization_content_type": "application/json",

"verification_tokens": {

"openai":

"Replace_this_string_with_the_verification_token_generated_in_the_ChatGPT_UI"

}

},

Considerations for Plugins in Production:

1. Rate limits:

Implement rate limiting on your API endpoints to handle high volumes of requests.

2. Timeouts:

ChatGPT has specific thresholds for timeouts during API calls, such as 15 seconds for fetching ai-plugin.json/openapi.yaml and 45 seconds for API calls.

3. Updating your plugin:

When making changes to your ai-plugin.json manifest file, update it manually by going through the "Develop your own plugin" flow in the plugin store.

Conclusion:

By using the appropriate authentication schema, you can optimize the security and accessibility of your ChatGPT plugin. These options provide flexibility in controlling access and delivering a seamless user experience.

About Writer

Swapnil Chouhan is Founder of Optimum Technical Labs LLP

Swapnil Chouhan is Founder of Optimum Technical Labs LLP, Worked on Several mobile app development projects, He writes about it.