前言

插件可以让 ChatGPT 具有更强大的功能和更灵活的扩展性，使得我们的系统更加适应不同领域的需求。

在生产环境使用插件时，我们一定要保证插件的质量和可靠性。一个不稳定的插件可能会严重影响 ChatGPT 的性能，甚至导致系统崩溃。因此，在引入插件之前，我们需要经过充分的测试和验证，并仔细考虑其是否真正符合我们的需求和标准。

同时，在生产环境中使用插件还需要注意安全问题。恶意插件可能会造成信息泄漏、攻击等安全问题，对用户造成极大的危害。因此，在使用插件时，我们需要仔细审查其源代码，防范潜在的风险。

Rate limits 速率限制

Consider implementing rate limiting on the API endpoints you expose. While the current scale is limited, ChatGPT is widely used and you should expect a high volume of requests. You can monitor the number of requests and set limits accordingly.
考虑在您公开的API端点上实施速率限制。虽然目前的规模有限，但ChatGPT被广泛使用，您应该期待大量的请求。您可以监视请求的数量并相应地设置限制。

Updating your plugin 更新您的插件

After deploying your plugin to production, you might want to make changes to the ai-plugin.json manifest file. Currently, manifest files must be manually updated by going through the “Develop your own plugin” flow in the plugin store each time you make a change to the file.
在将插件部署到生产环境后，您可能希望对 ai-plugin.json 清单文件进行更改。目前，清单文件必须在每次更改文件时通过插件商店中的“Develop your own plugin”流程手动更新。

ChatGPT will automatically fetch the latest OpenAPI spec each time a request is made.
ChatGPT将在每次请求时自动获取最新的OpenAPI规范。

Plugin terms

In order to register a plugin, you must agree to the Plugin Terms.
为了注册插件，您必须同意插件条款。

Domain verification and security 域验证和安全性

To ensure that plugins can only perform actions on resources that they control, OpenAI enforces requirements on the plugin’s manifest and API specifications.
为了确保插件只能在它们控制的资源上执行操作，OpenAI对插件的清单和API规范强制执行要求。

Defining the plugin’s root domain 定义插件的根域

The manifest file defines information shown to the user (like logo and contact information) as well as a URL where the plugin’s OpenAPI spec is hosted. When the manifest is fetched, the plugin’s root domain is established following these rules:
清单文件定义了显示给用户的信息（如徽标和联系信息）以及托管插件的OpenAPI规范的URL。当获取清单时，插件的根域将按照以下规则建立：

• If the domain has www. as a subdomain, then the root domain will strip out www. from the domain that hosts the manifest.
  如果域具有 www. 作为子域，则根域将从托管清单的域中去除 www. 。
• Otherwise, the root domain is the same as the domain that hosts the manifest.
  否则，根域与承载清单的域相同。

Note on redirects: If there are any redirects in resolving the manifest, only child subdomain redirects are allowed. The only exception is following a redirect from a www subdomain to one without the www.
重定向注意事项：如果在解析清单时有任何重定向，则只允许子子域重定向。唯一的例外是从www子域重定向到没有www的子域。

• ✅ https://example.com/.well-known/ai-plugin.json
  Root domain: example.com
• ✅ https://www.example.com/.well-known/ai-plugin.json
  Root domain: example.com
• ✅ https://www.example.com/.well-known/ai-plugin.json → redirects to https://example.com/.well-known/ai-plugin.json
  Root domain: example.com
• ✅ https://foo.example.com/.well-known/ai-plugin.json → redirects to https://bar.foo.example.com/.well-known/ai-plugin.json
  Root domain: bar.foo.example.com
• ✅ https://foo.example.com/.well-known/ai-plugin.json → redirects to https://bar.foo.example.com/baz/ai-plugin.json
  Root domain: bar.foo.example.com
• ❌ https://foo.example.com/.well-known/ai-plugin.json → redirects to https://example.com/.well-known/ai-plugin.json
  Redirect to parent level domain is disallowed 不允许重定向到父级域
• ❌ https://foo.example.com/.well-known/ai-plugin.json → redirects to https://bar.example.com/.well-known/ai-plugin.json
  Redirect to same level subdomain is disallowed 不允许重定向到同一级别子域
• ❌ https://example.com/.well-known/ai-plugin.json -> redirects to https://example2.com/.well-known/ai-plugin.json
  Redirect to another domain is disallowed 不允许重定向到另一个域

Manifest validation 清单验证

Specific fields in the manifest itself must satisfy the following requirements:
清单本身中的特定字段必须满足以下要求：

• api.url - the URL provided to the OpenAPI spec must be hosted at the same level or a subdomain of the root domain.
  api.url -提供给OpenAPI规范的URL必须托管在根域的同一级别或子域。
• legal_info - The second-level domain of the URL provided must be the same as the second-level domain of the root domain.
  legal_info -提供的URL的二级域名必须与根域名的二级域名相同。
• contact_info - The second-level domain of the email address should be the same as the second-level domain of the root domain.
  contact_info -电子邮件地址的二级域应与根域的二级域相同。

Resolving the API spec 解析API规范

The api.url field in the manifest provides a link to an OpenAPI spec that defines APIs that the plugin can call into. OpenAPI allows specifying multiple server base URLs. The following logic is used to select the server URL:
清单中的 api.url 字段提供了一个指向OpenAPI规范的链接，该规范定义了插件可以调用的API。OpenAPI允许指定多个服务器基础URL。以下逻辑用于选择服务器URL：

• Iterate through the list of server URLs
  遍历服务器URL列表
• Use the first server URL that is either an exact match of the root domain or a subdomain of the root domain
  使用与根域或根域的子域完全匹配的第一个服务器URL
• If neither cases above apply, then default to the domain where the API spec is hosted. For example, if the spec is hosted on api.example.com, then api.example.com will be used as the base URL for the routes in the OpenAPI spec.
  如果以上两种情况都不适用，则默认为API规范所在的域。例如，如果规范托管在 api.example.com 上，那么 api.example.com 将用作OpenAPI规范中路由的基本URL。

Note: Please avoid using redirects for hosting the API spec and any API endpoints, as it is not guaranteed that redirects will always be followed.
注意：请避免使用重定向来托管API规范和任何API端点，因为不能保证重定向总是被遵循。

Use TLS and HTTPS 使用TLS和HTTPS

All traffic with the plugin (e.g., fetching the ai-plugin.json file, the OpenAPI spec, API calls) must use TLS 1.2 or later on port 443 with a valid public certificate.
与插件的所有流量（例如，获取 ai-plugin.json 文件、OpenAPI规范、API调用）必须在端口443上使用TLS 1.2或更高版本，并具有有效的公共证书。

IP egress ranges IP出口范围

ChatGPT will call your plugin from an IP address in the CIDR block 23.102.140.112/28. You may wish to explicitly allowlist these IP addresses.
ChatGPT将从CIDR块中的IP地址调用插件 23.102.140.112/28 。您可能希望明确允许列出这些IP地址。

Separately, OpenAI’s web browsing plugin accesses websites from a different IP address block: 23.98.142.176/28.
另外，OpenAI的网页浏览插件从不同的IP地址块访问网站： 23.98.142.176/28。

FAQ 问答

How is plugin data used? 如何使用插件数据？

Plugins connect ChatGPT to external apps. If a user enables a plugin, ChatGPT may send parts of their conversation and their country or state to your plugin.
插件将ChatGPT连接到外部应用程序。如果用户启用了插件，ChatGPT可能会将他们的部分对话以及他们的国家或州发送到您的插件。

What happens if a request to my API fails? 如果对我的API的请求失败，会发生什么？

If an API request fails, the model might retry the request up to 10 times before letting the user know it cannot get a response from that plugin.
如果API请求失败，模型可能会重试请求多达10次，然后才能让用户知道它无法从该插件获得响应。

Can I invite people to try my plugin? 我可以邀请别人试用我的插件吗？

Yes, all unverified plugins can be installed by up to 15 users. At launch, only other developers with access will be able to install the plugin. We plan to expand access over time and will eventually roll out a process to submit your plugin for review before being made available to all users.
是的，所有未经验证的插件最多可以由15个用户安装。在启动时，只有其他具有访问权限的开发人员才能安装该插件。我们计划随着时间的推移扩大访问范围，并最终推出一个流程，在向所有用户提供之前提交您的插件进行审查。

Can I charge people money for my plugin? 我可以为我的插件向人们收取费用吗？

Yes, we encourage you to consider a limited number of free API calls but understand that it requires resources to run your plugin.
是的，我们鼓励您考虑有限数量的免费API调用，但要理解它需要资源来运行您的插件。

其它资料下载

如果大家想继续了解人工智能相关学习路线和知识体系，欢迎大家翻阅我的另外一篇博客《重磅 | 完备的人工智能AI 学习——基础知识学习路线，所有资料免关注免套路直接网盘下载》
这篇博客参考了Github知名开源平台，AI技术平台以及相关领域专家：Datawhale，ApacheCN，AI有道和黄海广博士等约有近100G相关资料，希望能帮助到所有小伙伴们。