Introduction

Authentication for ChatGPT plugins is a critical aspect of ensuring secure and controlled access to your backend.

Moreover identifying your users is interesting from a business perspective.

As explained in the OpenAI Official Documentation, authentication schemas must be specified in the manifest file of your ChatGPT plugin.

There are many authentication methods and we'll cover them in this article.

All types of authentication

No Authentication

It's worth saying you can implement a fully anonymous authentication scheme, aka: no authentication.

Pros

Super easy, you don't have to change anything to get started
Frictionless for your users

Cons

You cannot idenfity your users at all
You are losing a ton of potential leads/clients
Your backend will be basically opened to the internet, which is not super secure

Security note: if you use PluginLab with No Authentication, by default we are going to prevent all IP addresses except the OpenAI official IPs to reach your backend. So at least, it's more secure and you don't have to do it on your own.

Service Level Authentication

Service level authentication is a common choice in OpenAI plugins. This method provides developers control over how their plugin is used without introducing overhead for users.

During the plugin installation flow, a client secret can be provided to ensure that all traffic from OpenAI plugins is authenticated, albeit not on a user level.

Pros

No overhead for users
Easy way to protect your API

Cons

No way to authenticate your users
Not really worth the effort, especially when you can setup a simple IP protection

User Level Authentication

OpenAI allows user level authentication, enabling end users to copy and paste their secret API key into the ChatGPT UI during plugin install.
While the secret key is encrypted when stored in the database, this approach is not currently recommended due to UI limitations.

Pros

Easy for your user who already have an API Key

Cons

Not currently supported for the ChatGPT UI in production
Works only for users who have an account on your platform, so it means you don't leverage the power of acquiring new leads from ChatGPT

OAuth Authentication

OpenAI's plugin protocol is compatible with OAuth. From a user standpoint it works as follow:
When a user installs your plugin, he's redirected to your authentication portal
He logs-in on your platform
Authorizes the access
Gets redirected to ChatGPT

At this stage, everytime ChatGPT will make a request he'll send you the access token corresponding to your user.

Pros

Allows you to precisely identify every new user
Leverage the ChatGPT platform to register new leads
Easier for your user than copying an API key

Cons

The hardest flow to implement as a developer (except if you are using PluginLab, it takes 5 minutes)
Requires you to build a dedicated UI to handle this flow (except if you are using PluginLab, it's built for you)
It can be an overhead for some users, actually you could have between 10 and 40% of drop at this login step

Note that PluginLab allows you to configure a nifty Authentication Portal using OAuth in 5 minutes. So considering this, this flow is probably the most convenient to use.

Why you should use PluginLab to setup your ChatGPT plugin Authentication

Super easy

The first reason is that PluginLab makes it super easy for you to integrate an authentication flow for your ChatGPT Plugin.
This is especially true for OAuth since this flow is both the most valuable and the most complex to setup without PluginLab.

Don't waste your time

No matter if you are a hobbyist, a professional developer, a business guy: your time is valuable.

We know some developers who spent 30 hours (or event more) trying to implement an OAuth flow for their plugin.

Imagine how shocked they were when we implemented it in 5 minutes during a call with them?

If you value your time, you should definitely focus on your business, not on something we already built for you

Make money with your plugin in 5 minutes

How is that related to Authentication?!

Well, actually at PluginLab we provide a Payment Portal feature that allows you to connect your Stripe account and charge your user in 5 minutes.

But there's one condition: you have to authenticate your users with an OAuth flow so we can track them and manage their Quotas.

Feeling lost?

Feel free to contact us using the Chatbox on the bottom right corner and we will be more than happy to help!

Updated on: 20/06/2023