Notion Webhooks Skill

When to Use This Skill

• Setting up Notion webhook handlers for an internal integration
• Debugging Notion signature verification failures
• Completing the one-time verification_token handshake to activate a subscription
• Handling page, comment, database, or data source events from a Notion workspace

Essential Code (USE THIS)

Notion uses HMAC-SHA256 over the raw request body with the integration's verification_token as the signing key. The signature is sent in the X-Notion-Signature header in the format sha256=<hex_digest>.

The first POST to a new subscription is a handshake: it contains a verification_token in the JSON body and has no signature. The handler must capture the token (log it, store it, surface it in your dashboard), then the developer pastes it into the Notion integration UI to activate the subscription. All subsequent deliveries are signed with that token.

Notion Signature Verification (JavaScript)

const crypto = require('crypto');

function verifyNotionSignature(rawBody, signatureHeader, verificationToken) {
  if (!signatureHeader || !verificationToken) return false;

  // Notion sends: sha256=<hex>
  const expected = `sha256=${crypto
    .createHmac('sha256', verificationToken)
    .update(rawBody)
    .digest('hex')}`;

  try {
    return crypto.timingSafeEqual(
      Buffer.from(expected),
      Buffer.from(signatureHeader)
    );
  } catch {
    return false;
  }
}

Express Webhook Handler

const express = require('express');
const app = express();

// CRITICAL: Use express.raw() - Notion requires raw body for signature verification
app.post('/webhooks/notion',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['x-notion-signature'];
    const token = process.env.NOTION_VERIFICATION_TOKEN;

    // Handshake: first delivery has no signature and contains verification_token
    if (!signature) {
      try {
        const parsed = JSON.parse(req.body.toString('utf8'));
        if (parsed && parsed.verification_token) {
          console.log('Notion verification_token (paste into Notion UI):', parsed.verification_token);
          return res.status(200).json({ received: true });
        }
      } catch { /* fall through */ }
      return res.status(400).send('Missing X-Notion-Signature');
    }

    if (!verifyNotionSignature(req.body, signature, token)) {
      return res.status(401).send('Invalid signature');
    }

    const event = JSON.parse(req.body.toString('utf8'));

    switch (event.type) {
      case 'page.content_updated':
        console.log('Page content updated:', event.entity?.id);
        break;
      case 'page.properties_updated':
        console.log('Page properties updated:', event.entity?.id);
        break;
      case 'comment.created':
        console.log('Comment created:', event.entity?.id);
        break;
      case 'data_source.schema_updated':
        console.log('Data source schema updated:', event.entity?.id);
        break;
      default:
        console.log('Unhandled event:', event.type);
    }

    res.json({ received: true });
  }
);

Python (FastAPI) Verification

import hmac, hashlib, json
from fastapi import FastAPI, Request, HTTPException

def verify_notion_signature(raw_body: bytes, signature_header: str, token: str) -> bool:
    if not signature_header or not token:
        return False
    expected = "sha256=" + hmac.new(
        token.encode("utf-8"), raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature_header)

@app.post("/webhooks/notion")
async def notion_webhook(request: Request):
    raw = await request.body()
    signature = request.headers.get("x-notion-signature")

    # Handshake: first delivery has no signature and contains verification_token
    if not signature:
        try:
            data = json.loads(raw)
            if "verification_token" in data:
                print("Notion verification_token:", data["verification_token"])
                return {"received": True}
        except Exception:
            pass
        raise HTTPException(status_code=400, detail="Missing X-Notion-Signature")

    if not verify_notion_signature(raw, signature, os.environ["NOTION_VERIFICATION_TOKEN"]):
        raise HTTPException(status_code=401, detail="Invalid signature")

    event = json.loads(raw)
    # handle event.type ...
    return {"received": True}

For complete working examples with tests, see:

• examples/express/ - Full Express implementation
• examples/nextjs/ - Next.js App Router implementation
• examples/fastapi/ - Python FastAPI implementation

Common Event Types

For full event reference, see Notion Webhook Events

Important Headers

Environment Variables

# verification_token captured during the handshake (NOT the integration's API token)
NOTION_VERIFICATION_TOKEN=secret_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Local Development

# Start tunnel (no account needed, Notion does NOT support localhost)
npx hookdeck-cli listen 3000 notion --path /webhooks/notion

Use the public URL Hookdeck prints as the Webhook URL in the Notion integration UI. The first POST will contain the verification_token.

Reference Materials

• references/overview.md - Notion webhook concepts and events
• references/setup.md - Integration setup, subscription, handshake
• references/verification.md - Signature verification details