---
title: Find and install plugins
description: Browse the marketplace, choose a release, and review installation in Hay.
group: Start here
---

# Find and install plugins

The public marketplace at [plugins.hay.so](https://plugins.hay.so/) lets you search published plugins and inspect a release before opening Hay. Browsing needs no account or browser sign-in; using the desktop app still requires a [Hay account](accounts/).

## Browse what a plugin does

Search by name, ID, author or description. Results show the latest numeric version of each public plugin. Open a plugin to read its description, included views, requested access, package size and release history. Choose a version to inspect that release’s permissions and checksum.

The author name is display metadata, not a code-safety guarantee. Installation leaves permissions off until you review them in Hay.

## Install in Hay

1. Open a plugin’s marketplace page and choose the release version.
2. Select **Install in Hay**. Your browser may ask to open Hay.
3. In Hay, check the overview’s plugin ID, version, registry and destination workspace.
4. Choose **Review installation**. Hay downloads the exact release and checks its manifest, size and SHA-256 against the link and registry.
5. Review the inline installation request and approve it if you want the plugin. Open its task and review any permissions it needs.

Opening a link does not install a plugin, grant access or change your saved registry selection. Existing source, version and view-preservation checks still apply to updates. If Hay refuses a changed checksum, unavailable version or conflicting source, fix the release or select the correct source rather than bypassing review.

**Copy install link** copies the same exact-version link for a deliberate handoff. It contains no credentials. A private registry address is not a shareable access grant; see [personal registries](personal-registries/).

## Install-link contract

An install link has exactly four query parameters:

```text
hay://install?registry=<encoded-base>&id=<plugin-id>&version=<version>&sha256=<digest>
```

Use a complete registry base address and URL-encode values. For a validated registry entry, a website can construct the link without handling Hay credentials:

```js
function installLink(entry, registryBase) {
  const url = new URL('hay://install');
  url.search = new URLSearchParams({
    registry: registryBase,
    id: entry.manifest.id,
    version: entry.manifest.version,
    sha256: entry.bundle.sha256
  });
  return url.href;
}
```

Offer it as an explicit link or copy action. Do not launch it automatically on page load, after a search, or from plugin content. Duplicate or unknown parameters, embedded credentials, fragments, malformed identities and invalid digests are refused. Versions use canonical three-part numeric values; digests use 64 lower-case hexadecimal characters.

## Public and personal plugins

The marketplace profile button uses the [central Hay account](accounts/) for web identity and account actions. Its **Sign out** affects that browser session, not the native app. Browsing public releases still needs no sign-in.

The web marketplace lists public releases only. Private releases live in your account’s **Personal registry · Only you** in Hay; the public marketplace does not browse private artifacts or ask for a token.

To publish, choose the audience in [Share & publish](publishing/). Local creation, source folders and installed records remain local unless you deliberately export or publish code.

## Rollout status

The marketplace and [documentation](https://plugins.hay.so/docs/) are live. Public search, details and exact-release checks passed. Packaged Hay’s built-in browser also reached the native overview and inline installation request from a live marketplace link; that demonstration was declined to preserve the existing workspace. Approved installations were tested separately in an isolated end-to-end environment. Read the [operator verification record](account-service/) for the exact production and test scope.