---
{
  "id": "platform.creator.plugin-authoring",
  "topic": "creator",
  "title": "Plugin identity, bundles, review, and marketplace promotion",
  "locale": "en",
  "version": "2026-09-05",
  "summary": "A Plugin starts self-only with an automatically bound OAuth identity, then advances through bundle validation, scanning, review, and optional marketplace promotion.",
  "content": "A Plugin extends the user's Arinova workspace and may access only resources and operations the user explicitly grants. The normal Creator flow asks for a name and description, then atomically creates a public PKCE OAuth app and a self-only Plugin package. The returned `packageId`, OAuth `clientId`, and `plugin.json.id` must be the same value. Creating a separate OAuth app first is an advanced option, not a normal prerequisite.\n\n`plugin.json` declares the semantic version, HTML entry, requested scopes, exact HTTPS origins, and supported contributions. Build it with the author files into a ZIP. The web uploader rejects bundles above 20 MB and the Rust validator enforces manifest, path, file-count, expanded-size, origin, scope, and contribution rules. Every version must pass the deterministic scan. A self-only owner can activate a scan-passed version without marketplace review, but it remains private, owner-only, free, and absent from the catalog.\n\nMarketplace distribution uses the reviewed promotion flow. Submit a version for review, address scan or review failures, and promote only an approved version. Promotion changes the package from self-only to marketplace, disables existing installs for re-consent, and cannot be reversed back to self-only. Runtime bundles execute in an opaque sandbox without session cookies, bearer tokens, provider tokens, or unrestricted Office access.\n",
  "aliases": [
    "build an Arinova Plugin",
    "plugin.json",
    "self only Plugin",
    "Plugin marketplace promotion",
    "Plugin bundle",
    "Plugin OAuth client ID"
  ],
  "tags": [
    "creator",
    "plugin",
    "oauth",
    "review",
    "marketplace"
  ],
  "relatedActions": [],
  "relatedActionPrefixes": [
    "arinova.creator."
  ],
  "url": "https://docs.arinova.ai/en/kb/creator/plugin-authoring/"
}
---

A Plugin extends the user's Arinova workspace and may access only resources and operations the user explicitly grants. The normal Creator flow asks for a name and description, then atomically creates a public PKCE OAuth app and a self-only Plugin package. The returned `packageId`, OAuth `clientId`, and `plugin.json.id` must be the same value. Creating a separate OAuth app first is an advanced option, not a normal prerequisite.

`plugin.json` declares the semantic version, HTML entry, requested scopes, exact HTTPS origins, and supported contributions. Build it with the author files into a ZIP. The web uploader rejects bundles above 20 MB and the Rust validator enforces manifest, path, file-count, expanded-size, origin, scope, and contribution rules. Every version must pass the deterministic scan. A self-only owner can activate a scan-passed version without marketplace review, but it remains private, owner-only, free, and absent from the catalog.

Marketplace distribution uses the reviewed promotion flow. Submit a version for review, address scan or review failures, and promote only an approved version. Promotion changes the package from self-only to marketplace, disables existing installs for re-consent, and cannot be reversed back to self-only. Runtime bundles execute in an opaque sandbox without session cookies, bearer tokens, provider tokens, or unrestricted Office access.