Find and install plugins

The public marketplace at plugins.hay.so lets you search published plugins and inspect a release before opening Hay. Browsing needs no account or browser sign-in; using the desktop app still requires a Hay account.

Browse what a plugin does

Search by name, ID, author or description. Results show the latest numeric version of each public plugin. Open a plugin to read its description, included views, requested access, package size and release history. Choose a version to inspect that release’s permissions and checksum.

The author name is display metadata, not a code-safety guarantee. Installation leaves permissions off until you review them in Hay.

Install in Hay

Open a plugin’s marketplace page and choose the release version.
Select Install in Hay. Your browser may ask to open Hay.
In Hay, check the overview’s plugin ID, version, registry and destination workspace.
Choose Review installation. Hay downloads the exact release and checks its manifest, size and SHA-256 against the link and registry.
Review the inline installation request and approve it if you want the plugin. Open its task and review any permissions it needs.

Opening a link does not install a plugin, grant access or change your saved registry selection. Existing source, version and view-preservation checks still apply to updates. If Hay refuses a changed checksum, unavailable version or conflicting source, fix the release or select the correct source rather than bypassing review.

Copy install link copies the same exact-version link for a deliberate handoff. It contains no credentials. A private registry address is not a shareable access grant; see personal registries.

Install-link contract

An install link has exactly four query parameters:

hay://install?registry=<encoded-base>&id=<plugin-id>&version=<version>&sha256=<digest>

Use a complete registry base address and URL-encode values. For a validated registry entry, a website can construct the link without handling Hay credentials:

function installLink(entry, registryBase) {
  const url = new URL('hay://install');
  url.search = new URLSearchParams({
    registry: registryBase,
    id: entry.manifest.id,
    version: entry.manifest.version,
    sha256: entry.bundle.sha256
  });
  return url.href;
}

Offer it as an explicit link or copy action. Do not launch it automatically on page load, after a search, or from plugin content. Duplicate or unknown parameters, embedded credentials, fragments, malformed identities and invalid digests are refused. Versions use canonical three-part numeric values; digests use 64 lower-case hexadecimal characters.

Public and personal plugins

The marketplace profile button uses the central Hay account for web identity and account actions. Its Sign out affects that browser session, not the native app. Browsing public releases still needs no sign-in.

The web marketplace lists public releases only. Private releases live in your account’s Personal registry · Only you in Hay; the public marketplace does not browse private artifacts or ask for a token.

To publish, choose the audience in Share & publish. Local creation, source folders and installed records remain local unless you deliberately export or publish code.

Rollout status

The marketplace and documentation are live. Public search, details and exact-release checks passed. Packaged Hay’s built-in browser also reached the native overview and inline installation request from a live marketplace link; that demonstration was declined to preserve the existing workspace. Approved installations were tested separately in an isolated end-to-end environment. Read the operator verification record for the exact production and test scope.