---
title: "Notion Oauth Callback"
method: GET
path: "/api/oauth/notion/callback"
tags: ["Connections"]
---

# Notion Oauth Callback

`GET /api/oauth/notion/callback`

## Request

- Base URL: `https://app.getdot.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://app.getdot.ai/api/oauth/notion/callback`
- Auth: none declared

Exchange the authorization code for tokens, persist on the connection.

State carries org_id + a timestamp (max 5 min old) and is HMAC-signed with
``Config.SECRET_KEY``. The signature is verified before any field is
trusted — without it, a caller who knew another org's id could bind tokens
to the wrong org. On success we POST code + grant_type=authorization_code
to ``/v1/oauth/token`` with HTTP Basic ``client_id:client_secret``. The
response includes ``access_token``, ``refresh_token``, ``workspace_name``,
``workspace_icon``, ``workspace_id``, ``bot_id``, and ``owner`` — we
persist all of those.

## Query parameters

- `code` string, nullable
- `state` string, nullable
- `error` string, nullable
- `error_description` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/getdot/apis/dot-api-2.md) · [All operations](https://skmtc.dev/getdot/apis/dot-api-2/llms.txt) · [OpenAPI document](https://skmtc.dev/getdot/apis/dot-api-2/revisions/d26fe7163a7f?raw)