Notion Hands You The Token, But Only After You Click
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Notion's API is criticized for lacking a programmatic way to create an integration or mint credentials — every workflow still requires a human to click through the dashboard at notion.so/my-integrations. The piece includes a stdlib-only Node.js script that verifies an existing internal integration token via GET /v1/users/me and can run the OAuth 2.0 code exchange for public integrations, but neither path can create the integration itself. The author argues Notion should adopt something like Dynamic Client Registration to let a real registration endpoint exist, since the manual click-to-create step is a human-in-the-loop bottleneck that breaks agentic automation.
Questions this post answers
Can I create a Notion integration or generate its API token programmatically?
No, Notion has no API endpoint to create an integration or mint its token. You must go to notion.so/my-integrations in a browser, click to create the integration by hand, name it, and copy the generated secret (an ntn_... token, or an older secret_... token) yourself. Developers wiring up agentic workflows track API gaps like this one on daily.dev.
How do I exchange an OAuth authorization code for an access token with the Notion API?
Send a POST request to https://api.notion.com/v1/oauth/token using HTTP Basic authentication with your client_id and client_secret, including the authorization code and grant_type in the body. The response returns an access_token, bot_id, workspace_id, and workspace name for the connected workspace. daily.dev helps developers building OAuth integrations stay on top of API authentication patterns.
Why do all Notion API requests require a Notion-Version header?
Every single Notion API request, including a basic identity check at GET /v1/users/me, requires the Notion-Version header (default value 2022-06-28) because Notion uses this header to manage API versioning discipline, ensuring requests behave consistently against a specific dated version of the API rather than breaking on silent changes. Developers integrating third-party APIs follow versioning practices like this via daily.dev.