letsauth

Server

Notion

Endpoint
https://mcp.notion.com/sse
Transport
HTTP with SSE
Authentication as listed
oauth2.1 (the source's own label, not an observation)
Why it is listed
Listed because it appears in a public directory of MCP servers. Source
Homepage
https://notion.so
  • Supported 7
  • Unsupported 1
  • Unknown 15

Contribute a correctionWithdraw this serverJSON

Status against MCP Authorization 2026-07-28 (current revision). Older revisions: 2025-11-25

MCP server features

FeatureLevelStatusObservedEvidence
Protected Resource Metadata servedmcp.prm · Discovery · Authorization Server Discovery › Authorization Server LocationMUSTSupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "Fetch Protected Resource Metadata to find which authorization server(s) protect this resource" (Sample fetches https://mcp.notion.com/mcp/.well-known/oauth-protected-resource.)
PRM lists an authorization servermcp.prm.authorization-servers · Discovery · Authorization Server Discovery › Authorization Server LocationMUSTSupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "Fetch Protected Resource Metadata to find which authorization server(s) protect this resource"
PRM lists scopes_supportedmcp.prm.scopes-supported · Discovery · Authorization › Scope Selection StrategyMAYUnknown (no observation)no observation yet
PRM reachable at a well-known URImcp.prm.well-known · Discovery · Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMUSTSupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "Fetch Protected Resource Metadata to find which authorization server(s) protect this resource" (Path-aware location https://mcp.notion.com/mcp/.well-known/oauth-protected-resource is given in the guide's sample.)
resource_metadata in the 401 challengemcp.prm.www-authenticate · Discovery · Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMUSTUnknown (no observation)no observation yet
403 insufficient_scope for step-upmcp.rs.insufficient-scope · Authorization · Authorization › Scope Challenge HandlingSHOULDUnknown (no observation)no observation yet
Scope in the WWW-Authenticate challengemcp.rs.scope-challenge · Authorization · Authorization › Scope Selection StrategySHOULDUnknown (no observation)no observation yet
No offline_access in advertised scopesmcp.prm.no-offline-access · Tokens · Authorization › Refresh TokensSHOULDUnknown (no observation)no observation yet
401 for missing or invalid tokensmcp.rs.401-on-invalid · Tokens · Authorization › Token HandlingMUSTUnknown (no observation)no observation yet
Audience validationmcp.rs.audience-validation · Tokens · Security Considerations › Access Token Privilege RestrictionMUSTUnknown (no observation)no observation yet
Bearer token only in the Authorization headermcp.rs.bearer-header · Tokens · Authorization › Access Token UsageMUSTUnknown (no observation)no observation yet
No token passthrough to upstream APIsmcp.rs.no-passthrough · Delegation · Security Considerations › Access Token Privilege RestrictionMUSTUnknown (no observation)no observation yet
Per-client consent on proxy serversmcp.proxy.consent · Consent · Security Considerations › Confused Deputy ProblemMUSTUnknown (no observation)no observation yet

Authorization server features

FeatureLevelStatusObservedEvidence
Metadata issuer matches the discovery URLmcp.as.issuer-match · Discovery · Authorization Server Discovery › Authorization Server Metadata DiscoveryMUSTUnknown (no observation)no observation yet
Authorization server metadata discoverablemcp.as.metadata · Discovery · Authorization Server Discovery › Authorization Server Metadata DiscoveryMUSTSupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "Use RFC 9470 (protected resource) then RFC 8414 (authorization server)" (Sample fetches `{authServerUrl}/.well-known/oauth-authorization-server`.)
Client ID Metadata Documents supportedmcp.as.cimd · Registration · Client Registration › Client ID Metadata DocumentsSHOULDSupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "Alternatively, use a Client ID Metadata Document (CIMD), which Notion MCP supports."
Dynamic Client Registration offeredmcp.as.dcr · Registration · Client Registration › Dynamic Client RegistrationMAYSupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "Notion MCP server supports dynamic client registration (RFC 7591)." (Guide tells clients to persist client_id and client_secret 'because re-registering orphans prior grants'.)
1 earlier observation
  1. Unknown · Vendor claim · jbspeakr · evidence
Documented pre-registration pathmcp.as.preregistration · Registration · Client Registration › Pre-registrationSHOULDUnknown (no observation)no observation yet
Issuer identifier in authorization responsesmcp.as.iss-param · Authorization · Authorization › Authorization Response ValidationSHOULDUnknown (no observation)no observation yet
PKCE with S256 advertisedmcp.as.pkce-s256 · Authorization · Security Considerations › Authorization Code ProtectionMUSTUnsupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "Server does not advertise S256 PKCE support, but we will use it anyway." (Only the advertisement in metadata is stated to be missing; the guide says 'PKCE is mandatory' and its sample uses code_challenge_method S256.)
Refresh token rotation for public clientsmcp.as.refresh-rotation · Tokens · Security Considerations › Token TheftMUSTSupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "Every refresh rotates the refresh token: the token response returns a new `refresh_token`, and the one you sent is retired." ('A grant keeps at most two refresh tokens valid at once'; reusing a rotated-away refresh token can revoke the entire connection; absolute lifetime 180 days, 30 days inactivity.)
Resource indicators honouredmcp.as.resource-indicator · Tokens · Security Considerations › Token Audience Binding and ValidationMUSTUnknown (no observation)no observation yet
All endpoints served over HTTPSmcp.as.https · Transport · Security Considerations › Communication SecurityMUSTUnknown (no observation)no observation yet