OpenAI

Plugins reach OpenAI surfaces through the same GitHub-backed marketplace that serves Claude Code and Cursor. A ChatGPT workspace admin imports that repository once from the OpenAI admin dashboard, after which its plugins are available to ChatGPT on web, desktop, and mobile, to Codex in the ChatGPT desktop app, and to the Codex CLI. This page covers importing the marketplace, setting the observability plugin’s installation policy, configuring Codex telemetry, and verifying that events arrive.

The observability plugin is the prerequisite for most governance features on OpenAI surfaces: observability of AI usage across the company (tokens, cost, clients, MCP, skills), security flagging and blocking, shadow MCP detection, and more.

In ChatGPT, a plugin marketplace is a JSON catalog in a GitHub repository that lists the plugins to import. The platform hosts such a marketplace on the org’s behalf containing the observability plugin and any custom plugins. Once imported, each plugin’s availability is controlled from the OpenAI admin dashboard rather than from the repository.

Access requirements

Publishing the marketplace requires the project:write scope and creating the API key requires the org:admin scope, both held by the default Admin role. The OpenAI-side steps require a workspace admin account on a ChatGPT Business, Enterprise, or Edu workspace.

Create an API key

In the dashboard, open Organization settings > API Keys (see API keys) and create a new key with the Hooks scope. Copy the key — it replaces the <MY_KEY> placeholder in the Codex telemetry configuration below.

Grant the importing account repository access

The marketplace repository is private, so the ChatGPT workspace admin performing the import needs access to it before the import can authorize. On the dashboard’s MCP Gateway > Plugins page, click Manage collaborators on the marketplace card, enter that admin’s GitHub username under GitHub Usernames, and click Add collaborators. (If the marketplace has never been published, Publish now asks for a marketplace name first and then opens the Publish Plugins dialog, which takes the same usernames.) Then follow the link to the plugin repo and accept the invitation to collaborate (check email or GitHub notifications if it doesn’t appear). Only the account performing the import needs this step.

Check the GitHub connection in ChatGPT

OpenAI uses the importing admin’s own GitHub connection to read the marketplace. Having GitHub installed in the workspace does not establish that connection or grant repository access. This connection is managed in ChatGPT, separately from the Speakeasy dashboard.

• Open “Plugins” in the ChatGPT sidebar and find “GitHub”.
• Open the GitHub plugin’s three-dot menu and select “Manage”.
• Connect the importing admin’s GitHub account, or confirm that the connected account is the one that accepted the repository invitation above.
• Confirm that the account and its GitHub connection can read the plugin repository and any repositories it references. Complete any required GitHub organization approval.

Troubleshooting marketplace access

If marketplace import or sync fails with an access error, the importing admin’s GitHub connection may be missing or may not have access to the plugin repository. This can happen if All Repositories was not selected when setting up the connection. Open Plugins > GitHub > Manage and check the connection and its repository permissions. It may be necessary to recreate the connection and select All Repositories, then retry the import or sync. The connected GitHub account must still have access to the plugin repository.

See OpenAI’s guide to importing and syncing plugin marketplaces from GitHub for connection and ownership requirements.

Import the marketplace

Copy the marketplace repository URL from the dashboard’s MCP Gateway > Plugins page. The repository is named <speakeasy-org>-<speakeasy-project>-plugins under the speakeasy-plugins GitHub org.

In ChatGPT, open Admin > Plugins and select Add > Import marketplace, then complete the fields:

• Source — the repository URL on its own, without a branch or folder path appended
• Path — leave empty, since the marketplace manifest sits at the repository root
• Branch, tag, or commit — leave empty to track the default branch, so later publishes are picked up automatically; pinning a commit freezes the marketplace at that revision

Select Import marketplace and authorize GitHub when prompted. A very large marketplace can take up to an hour on first import; later syncs take minutes.

Accepted manifests

OpenAI reads a Codex marketplace at .agents/plugins/marketplace.json, and also accepts a Claude-compatible marketplace at .claude-plugin/marketplace.json or a standalone plugin at .claude-plugin/plugin.json. The platform’s marketplace repository is the same one Claude Code and Cursor consume, so no separate repository or republish is needed for OpenAI.

Set the installation policy

Import does not carry policy over

GitHub import and sync ignore the installation and authentication policies declared in the repository, including AVAILABLE, INSTALLED_BY_DEFAULT, NOT_AVAILABLE, ON_INSTALL, and ON_USE. An imported plugin reaches nobody until a policy is set in the OpenAI admin dashboard, so this step is required rather than optional.

Open Admin > Plugins, select the observability plugin, and set its Installation policy for each eligible workspace role:

• Installed — the plugin is deployed to everyone in the role without any action on their part. Use this for a real rollout, since coverage gaps mean unobserved sessions.
• Available — the plugin appears in the directory for members of the role to install themselves. Adequate for a proof of concept.

Any MCP servers the plugin connects to must also be enabled, and members need access to those connected services.

Plugin assignments in the dashboard don’t gate marketplace installs. Scope delivery on OpenAI surfaces through the per-role installation policy instead.

Configure Codex telemetry

The plugin’s hooks cover sessions and tool calls on their own. Codex also exports OpenTelemetry, which is what associates Codex sessions with individual users and supplies token and cost detail. Without it, Codex activity arrives unattributed.

Codex reads telemetry settings from the [otel] section of ~/.codex/config.toml, or from .codex/config.toml for a single project. Export is off by default. The block takes this shape:

[otel]
environment = "production"
log_user_prompt = false
exporter = { otlp-http = { endpoint = "<endpoint>", protocol = "<protocol>", headers = { "Speakeasy-AI-Project" = "default", "Speakeasy-AI-Key" = "<MY_KEY>" } } }
metrics_exporter = { otlp-http = { endpoint = "<endpoint>", protocol = "<protocol>", headers = { "Speakeasy-AI-Project" = "default", "Speakeasy-AI-Key" = "<MY_KEY>" } } }

Copy the exact endpoint and protocol values from the Install tab of the plugin’s detail page on MCP Gateway > Plugins, which renders the current Codex snippet with the org’s values filled in, and replace <MY_KEY> with the API key created above.

Codex cloud surfaces emit no device telemetry

Codex cloud web tasks and GitHub code review run off-device, so neither the plugin nor this configuration covers them. Connect OpenAI Compliance Logs to observe and bill that usage, bearing in mind those imports are post-hoc and cannot be blocked in real time.

Keep the marketplace in sync

Imported marketplaces check GitHub once a day. After publishing a plugin from the dashboard, open Admin > Plugins > Marketplaces, select the marketplace, and choose Sync now to pull the change immediately. Review the status report afterward — Completed — N errors means some plugins failed to process and need fixing in the repository.

Transferring ownership

The GitHub connection belongs to the admin who imported the marketplace. To move it to another admin, have them reimport using identical Source, Path, and branch values. Deleting the marketplace removes every plugin imported from it, so reimporting is the safe path.

Verify

• Confirm the plugin is installed. In ChatGPT, open the Plugins tab and check that the observability plugin appears. In the Codex CLI, run /plugins.
• Execute any tool call — use an MCP server, or ask Codex to run echo hi there.
• Open Tool Logs in the dashboard. The tool call should appear immediately (for a local tool call, set the Type filter to include local tools).