Notion Release Notes

New identity fields in OAuth token responses

User objects now include an email_verified boolean next to person.email, indicating whether Notion has verified that email address. The field appears anywhere person emails do, including the owner in OAuth token responses and List all users results.

Notion MCP token responses now include top-level user_id, workspace_id, and email_domain fields on successful authorization-code exchanges, so MCP clients can associate a connection with a Notion user and workspace without an extra call. See Integrating your own MCP client.

New response fields like these are backwards-compatible additions and appear on every API version. Parse responses leniently: ignore fields you don't recognize rather than rejecting them.

Notion app links in API responses use the new app domain …

We released v5.23.0 of @notionhq/client, our SDK for JavaScript and TypeScript. Here's what's new:

Verify webhook signatures with one call

The new verifyWebhookSignature() helper confirms that a webhook event really came from Notion, so you no longer need to hand-write the HMAC check. Pass the raw request body, the X-Notion-Signature header, and your subscription's verification_token; the helper compares signatures in constant time and returns false instead of throwing on malformed input. It works without configuration in Node.js 18+, Bun, Deno, Cloudflare Workers, Vercel Edge Functions, and browsers. A companion signWebhookPayload() generates signatures for testing your handler.

Read every row in a large data source

A single data source query returns at most 10,000 results, so plain pagination can silently miss rows. The new iterateAllDataSourceRows() and collectAllDataSourceRows() helpers page past the limit using the windowing approach from the Query large data sources guide, de-duplicating rows along the way. Stream rows with the iterator, or collect them into an array when the full result fits in memory.

Start and poll async page writes …