---
title: "Notion Oauth Start"
method: GET
path: "/api/oauth/notion/start"
tags: ["Connections"]
---

# Notion Oauth Start

`GET /api/oauth/notion/start`

## Request

- Base URL: `https://app.getdot.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://app.getdot.ai/api/oauth/notion/start`
- Auth: one of:
  - API key in header `X-API-KEY`
  - API key in cookie `Authorization`
  - OAuth 2 (password, token URL `/api/auth/token`)

Begin the Notion Public-OAuth flow.

Generates a CSRF-bound state token (org_id + nonce + 5-minute timestamp)
HMAC-signed with ``Config.SECRET_KEY``, and returns the Notion authorize
URL. The frontend redirects (or pops a window) to that URL. Notion bounces
back to ``/api/oauth/notion/callback`` with ``code`` + ``state``.

Signing the state prevents cross-tenant binding: an attacker cannot forge a
state that points at a different org_id without the secret key.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/getdot/apis/dot-api-2.md) · [All operations](https://skmtc.dev/getdot/apis/dot-api-2/llms.txt) · [OpenAPI document](https://skmtc.dev/getdot/apis/dot-api-2/revisions/d26fe7163a7f?raw)