Notion

Instant: create a public connection in the developer portal with no review. The catch is per-user, per-page grants: each user picks pages in a page picker, and the agent sees nothing else.

Difficulty

1/5 · Instant

Approval

none

Confidence

high

Test before approval

Yes

Why this score

• Create a public connection in the developer portal (self-serve, weight 1)

• Pick installation scope and capabilities (both) — done when: Scope and capability list are written down.
• Create the public connection (human) — done when: The connection exists.
• Copy credentials into Composio (both) — done when: A Composio session uses your auth config ID for notion.

• mediumThe agent only sees pages each user picks in the OAuth page picker, and every workspace member must authorize separately. Agents expecting workspace-wide access find nothing. (Pilot-ready)Workaround: Tell users which pages to grant during onboarding, or offer a Notion template in the auth flow.An agent can help with this.
• lowInstallation scope is fixed at creation. "Selected workspaces only" connections can't list on the Marketplace. (Production-ready)Workaround: Create a new connection with "Any workspace".

• Notion account and a development workspace (human · Dev-ready): You choose the development workspace when creating the connection.
• Decide installation scope up front (both · Dev-ready): "Any workspace" (Marketplace-eligible) or "Selected workspaces only". It can't be changed later; changing it means creating a new connection.
• Redirect URI (both · Dev-ready): From the Composio dashboard if you use Composio.

• Create a public connection in the developer portal (self serve)Applies when: always. Required for Pilot-ready, Production-ready.

1. Pick installation scope and capabilities (decide · both · ~5 min)
   • Choose "Any workspace" if you might ever list on the Marketplace.
   • Enable only the capabilities the agent uses.
   Done when: Scope and capability list are written down.
2. Create the public connection (create · human · ~5 min)
   • Developer portal → Build → Public connections → Create new connection.
   • Fill connection name, development workspace, redirect URI(s), installation scope and capabilities.
   Done when: The connection exists.
3. Copy credentials into Composio (configure · both · ~5 min)
   • Configuration tab → copy OAuth client ID and client secret.
   • In Composio, Create Auth Config → Notion, paste them, and pass the auth config ID in your session.
   Done when: A Composio session uses your auth config ID for notion.
4. Authorize and confirm page scoping (test · both · ~10 min)
   • Authorize from a second workspace and grant one page.
   • Confirm the agent can read that page and gets an error on an ungranted page.
   Done when: Grant scoping behaves as expected.

Redirect URIs:

Register one or more redirect URIs on the connection; Notion redirects there with the code or an error parameter.primarysource

PKCE:

Not mentioned in the authorization guide; the token exchange uses HTTP Basic auth with the client secret.inferred

Token lifetime:

unknown

Refresh:

The token response includes a refresh_token used to get a new access_token.primarysource

Rate limits:

Per connection: 600 requests/minute on Business and Enterprise workspaces, 180 requests/minute on all other plans. A per-workspace limit also applies.primarysource

• GET https://api.notion.com/.well-known/oauth-authorization-server → 400JSON error invalid_request_url: no RFC 8414 discovery document. (2026-10-19T20:37:17Z)
• GET https://api.notion.com/v1/oauth/authorize?client_id=oauth-atlas-probe&response_type=code&owner=user&redirect_uri=https%3A%2F%2Fexample.com%2Fcb → 302 → https://app.notion.com/install-integration?response_type=code&client_id=oauth-atlas-probe&redirect_uri=https%3A%2F%2Fexample.com%2Fcb&owner=userAuthorize endpoint is live and hands off to the install-integration page without validating the client_id server-side. (2026-10-19T20:37:17Z)

• [ev-create] Create new connection asks for name, development workspace, redirect URIs, installation scope and capabilities. primary high confidence

  Click Create new connection and fill in the required fields, including: Connection name and development workspace Redirect URI(s) for the OAuth flow

  https://developers.notion.com/guides/get-started/public-connectionsofficial-doc · retrieved 2026-10-19T20:38:01Z
• [ev-install-scope] Installation scope is set once and can't be changed. primary high confidence

  Installation scope is set once, at creation time, and can’t be changed afterward.

  https://developers.notion.com/guides/get-started/public-connectionsofficial-doc · retrieved 2026-10-19T20:38:01Z
• [ev-page-picker] Users pick pages during authorization, and each workspace member authorizes separately. primary high confidence

  If multiple members in a workspace want to use the same public connection, each user needs to complete the authorization flow individually.

  https://developers.notion.com/guides/get-started/public-connectionsofficial-doc · retrieved 2026-10-19T20:38:01Z
• [ev-refresh] The token response includes a refresh_token. primary high confidence

  Notion responds to the request with an access_token , refresh_token , and additional information.

  https://developers.notion.com/docs/authorizationofficial-doc · retrieved 2026-10-19T20:38:02Z
• [ev-rate] Per-connection rate limits depend on the workspace plan. primary high confidence

  Each connection has a fixed budget of requests per 60-second window, based on the workspace’s plan

  https://developers.notion.com/reference/request-limitsofficial-doc · retrieved 2026-10-19T20:38:03Z
• [ev-probe-authorize] The authorize endpoint redirects to app.notion.com/install-integration. tested high confidencehttps://api.notion.com/v1/oauth/authorizetest · retrieved 2026-10-19T20:37:17Z
• [ev-composio-byo] For OAuth toolkits, the Composio dashboard shows the redirect URI to register with the provider. primary high confidence

  For OAuth toolkits, the dashboard shows the redirect URI to add in the provider's developer portal.

  https://docs.composio.dev/docs/authentication/custom-app-vs-managed-appofficial-doc · retrieved 2026-10-19T20:38:04Z

• PKCE support: not documented in the pages we fetched.
• Access and refresh token lifetimes: not stated in the authorization guide.
• Exact developer-portal URL and form fields today: pending the T-011 attempt (seed consoleUrl is notion.so/my-integrations).
• Notion Marketplace listing review process and timeline (optional path; not researched).

• 2026-10-20: Notion API rate limit — An average of three requests per second per connection. → Per connection, per 60-second window: 600/min on Business and Enterprise, 180/min (about 3/s) on other plans, plus a per-workspace limit. (Notion's request-limits page now ties the budget to the workspace plan.)