RealComposer
START FREE
Upstream APIsOfficial Notion docs

Notion Safe & Unsafe Practices

Direct Answer

Notion internal integration secrets and OAuth tokens are server-only. An integration can only see pages explicitly shared with it, so share the minimum set, call Notion from a server or edge proxy, and cache responses because the API averages about 3 requests per second.

Credentials & Where They Belong

Server only
Internal integration secret

Access to every page and database shared with the integration.

Server only
Public integration OAuth token

Per-workspace access granted by another user.

Safe Practices

  • Share only the databases the integration needs

    Integrations inherit access to child pages, so connect them at the narrowest level.

  • Use read-only capabilities for public content

    Disable insert and update capabilities for integrations that only power websites.

  • Cache and flatten responses

    Notion blocks are deeply nested. Flatten and cache them at the edge for fast pages.

Unsafe Practices

  • Exposing the integration secret in a frontend

    Visitors could read every shared page or write to your databases.

  • Connecting the integration at the workspace root

    Private docs nested below become readable through the API.

The RealComposer Pattern

Store NOTION_TOKEN in the vault, query a single database through a cached pipeline, and map rich text properties into flat strings before returning them.

START BUILDING FREE

Frequently Asked Questions

Q:Why does my Notion integration return object not found?

The page or database has not been shared with the integration. Add it from the page Connections menu.

Notion Recipes

All Notion recipes (4)
Mobile App (iOS & Android)Notion
Security & Secret Vault

Call Notion API from Mobile App without Token Leakage

To solve call notion api from mobile app without token leakage, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe
Frontend / WebNotion
Multi-API Aggregation

Merge Notion Database with Google Calendar API

To solve merge notion database with google calendar api, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe
Frontend / WebNotion
Payload Slimmer

Notion API Block Children Response Payload Slimming

To solve notion api block children response payload slimming, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe

Related Concepts

Headless CMS

A headless CMS is a content management system that stores and manages content but delivers it only through APIs, with no built-in presentation layer. Frontends such as websites, mobile apps, and kiosks fetch content as JSON and render it however they choose.

JSON Flattening

JSON flattening is converting a deeply nested JSON object into a flat structure where nested values are lifted to top-level keys. For example, data.attributes.profile.name becomes name, making responses easier to bind to UI components and low-code data mappings.

API Rate Limiting

API Rate Limiting is a traffic control mechanism that caps the number of requests a client, IP address, or API token can execute within a specified time window. Rate limiting prevents server overloading, protects against credential brute-forcing, and shields upstream APIs from exceeding subscription quotas.