hookdeck/webhook-skills/notion-webhooks

const crypto = require('crypto');
function verifyNotionSignature(rawBody, signatureHeader, verificationToken) {
  if (!signatureHeader || !verificationToken) return false;
  // Notion sends: sha256=<hex>
  const expected = `sha256=${crypto
    .createHmac('sha256', verificationToken)
    .update(rawBody)
    .digest('hex')}`;
  try {
    return crypto.timingSafeEqual(
      Buffer.from(expected),
      Buffer.from(signatureHeader)
    );
  } catch {
    return false;
  }
}

const express = require('express');
const app = express();
// CRITICAL: Use express.raw() - Notion requires raw body for signature verification
app.post('/webhooks/notion',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['x-notion-signature'];
    const token = process.env.NOTION_VERIFICATION_TOKEN;
    // Handshake: first delivery has no signature and contains verification_token
    if (!signature) {
      try {
        const parsed = JSON.parse(req.body.toString('utf8'));
        if (parsed && parsed.verification_token) {
          console.log('Notion verification_token (paste into Notion UI):', parsed.verification_token);
          return res.status(200).json({ received: true });
        }
      } catch { /* fall through */ }
      return res.status(400).send('Missing X-Notion-Signature');
    }
    if (!verifyNotionSignature(req.body, signature, token)) {
      return res.status(401).send('Invalid signature');
    }
    const event = JSON.parse(req.body.toString('utf8'));
    switch (event.type) {
      case 'page.content_updated':
        console.log('Page content updated:', event.entity?.id);
        break;
      case 'page.properties_updated':
        console.log('Page properties updated:', event.entity?.id);
        break;
      case 'comment.created':
        console.log('Comment created:', event.entity?.id);
        break;
      case 'data_source.schema_updated':
        console.log('Data source schema updated:', event.entity?.id);
        break;
      default:
        console.log('Unhandled event:', event.type);
    }
    res.json({ received: true });
  }
);

import hmac, hashlib, json
from fastapi import FastAPI, Request, HTTPException
def verify_notion_signature(raw_body: bytes, signature_header: str, token: str) -> bool:
    if not signature_header or not token:
        return False
    expected = "sha256=" + hmac.new(
        token.encode("utf-8"), raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature_header)
@app.post("/webhooks/notion")
async def notion_webhook(request: Request):
    raw = await request.body()
    signature = request.headers.get("x-notion-signature")
    # Handshake: first delivery has no signature and contains verification_token
    if not signature:
        try:
            data = json.loads(raw)
            if "verification_token" in data:
                print("Notion verification_token:", data["verification_token"])
                return {"received": True}
        except Exception:
            pass
        raise HTTPException(status_code=400, detail="Missing X-Notion-Signature")
    if not verify_notion_signature(raw, signature, os.environ["NOTION_VERIFICATION_TOKEN"]):
        raise HTTPException(status_code=401, detail="Invalid signature")
    event = json.loads(raw)
    # handle event.type ...
    return {"received": True}

# verification_token captured during the handshake (NOT the integration's API token)
NOTION_VERIFICATION_TOKEN=secret_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Start tunnel (no account needed, Notion does NOT support localhost)
npx hookdeck-cli listen 3000 notion --path /webhooks/notion

// Generated with: notion-webhooks skill
// https://github.com/hookdeck/webhook-skills