Picture a team dashboard that is built once but shows every colleague their own tickets, files and messages, without anyone pasting API keys into it. That is the idea behind plugins in OpenAI’s Sites, which the company highlighted at DevDay 2026. Let’s get the workflow straight before you try it.
What plugins in Sites change
A Site is a web page or small app that you build with Codex and host through OpenAI. OpenAI’s DevDay 2026 page says you can now build a Site that uses each visitor’s own connected apps. A plugin, in this setting, is the bundle that lets ChatGPT or Codex reach a third-party service such as a drive, a chat tool or a ticket tracker. Instead of one shared integration behind the page, every visitor’s view is filled from that person’s own connections. OpenAI’s Sites documentation points the same way: it describes choosing storage, adding sign-in and connecting apps to your site.
Who can use it, and where
The limit is stated plainly: plugins in Sites are available for workspace-private Sites where they are enabled. A public page does not get this. So the feature suits internal tools such as a launch tracker or a team overview, not a site open to anyone on the internet. Because it depends on what is enabled, check with whoever administers your workspace before you plan around it.
How access is handled
Visitors choose their own accounts and give consent for access. That matters for the person in charge of the site: two colleagues can open the same URL and see different data, each limited to what their own account allows. It also means the builder does not hold everyone’s credentials.
Where scheduled tasks fit
In its DevDay session OpenAI also described linking scheduled tasks to a Site so that it can be refreshed automatically. Scheduled tasks themselves are a documented ChatGPT and Codex feature, but the written pages we checked do not detail that link to Sites. Treat it as announced on stage, not yet confirmed in the documentation.
Our assessment
The documented facts are narrow: private Sites, a user-by-user choice of accounts, and consent. What follows is our inference, not OpenAI’s claim. The real gain is a cleaner split of responsibility: the builder designs the page, and each visitor decides what the page may see on their behalf. There’s a simpler handoff here than building a shared service account. The open question for any team is who takes the next step when a plugin should be allowed on a Site, and who reviews that choice. Start with one low-risk internal page, see which permissions people are asked to grant, and decide from there.
