[yoyoismee]

Plugin Submission

Plugin information

• Author: paxalabs
• Plugin name: paxa
• Version: 0.0.1
• Source repository: https://github.com/paxalabs/dify-plugin-paxa
• Contact: hello@paxalabs.com

Submission type

• New plugin
• Version update

What changed

This adds Paxa Labs as a model provider for text to speech and speech to text. I'm one of the founders of Paxa Labs, so this is our own plugin for our own API.

Why it's needed: I couldn't find a Thai-focused speech provider in the Marketplace. We build our models in Thailand for Thai, English, and Mandarin Chinese, and every Paxa TTS Flash v2 voice speaks all three, including sentences that mix them. That mix is common in Thai support and business content.

What's in the package:

• Text to speech. Paxa TTS Flash v2 (paxa-tts-flash-v2, the default: 50 voices, reads direction tags such as [whispering]) and Paxa TTS Flash (paxa-tts-flash-v1: 34 single-language voices, including Isan, Northern, and Southern Thai accents). Audio streams as MP3 from POST /v1/tts. Text over the 5,000-character request limit is split at sentence ends and sent as consecutive requests.
• Voices. Fetched at runtime from our public catalog (GET /v1/voices, no key), so new voices show up without a plugin update. A bundled copy in the model YAML covers the screens that read voices from the model schema, and stands in if the catalog can't be reached.
• Speech to text. Paxa STT Lite (paxa-stt-lite-v1-preview). It's a research preview, and the README says so.
• Credentials. One API key, checked with GET /v1/me, which costs no credits.

Risk level

• Low risk
• Medium risk
• High risk

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Developer Agreement.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

• The plugin sends the text to speak, or the recording to transcribe, to one fixed host, https://api.paxalabs.com, over HTTPS, with the workspace's Paxa API key in the Authorization header. Requests also carry an x-paxa-client header with the plugin name and version, and no user identifiers. There's no user-configurable URL, and the manifest declares the host under network.domains.
• No command or code execution, SQL, file system access, browser automation, or arbitrary URL fetching. The only input it reads is the audio Dify hands to the speech-to-text model.
• Text and recordings can contain personal data, which is why I picked Medium risk. PRIVACY.md lists what is sent and links our privacy policy, including that we may keep model inputs and outputs, without account identity, to train our models.
• The plugin stores and logs no user content. Every request has a timeout, and error messages carry the API's error code and request ID, never the key.

Local validation

• uv run pytest: 67 passed. The unit tests use mocked API responses (respx) and cover the TTS and STT request shapes, error mapping, the voice list and its fallback, text splitting, and credential checks.
• uv run ruff check . and uv run ruff format --check .: clean.
• dify plugin package (CLI v0.6.12) on a clean export of the source at 003d036: 18 runtime files, each byte-identical to that commit. SHA-256 cbaa0b780edf3c18fcce1c95cbcfe93a21a86624290fa8d8cb50b641253b8751.
• dify-marketplace-toolkit validate-difypkg.py with this PR body: 0 blocking findings. The warnings are the declared domain api.paxalabs.com, no known vulnerabilities in dify_plugin==0.10.2, and two Python-safety notes on the lines that pass the API key to our HTTP client, which only puts it in the Authorization header.
• Toolkit PR checks (check-pr-body, check-pr-review-notes, check-version-update): passed.
• Toolkit packaging check (uploader --test): packaged; the scan found 1 domain, 0 undeclared, and 0 sensitive-capability categories.
• test-plugin-install.py in a clean Python 3.12 venv with only requirements.txt installed: success.
• dify plugin run (the daemon's local runtime): the plugin loads, lists voices from the live catalog (50 on v2, 34 on v1), and maps a rejected key to Dify's credential and authorization errors on all three calls.

Reviewer notes

• I tested it end to end on Dify Cloud through remote debugging with a live key: adding the provider and checking the key, a chatflow that reads Thai replies aloud with auto-play, the speaker button on an earlier reply, a mixed Thai and English reply read in one voice, switching voices from the live voice list, and Thai voice input transcribed by Paxa STT. All of that worked. I haven't tested Community Edition.
• The package is the official CLI's output, built from the commit linked above. Nothing was zipped by hand.