Leaked Notion API Token? Refresh the Secret Now

A Notion API token, also called an integration secret, lets whoever holds it act as an integration in your workspace. It can read and, depending on the capabilities you gave it, edit, create or delete the pages and databases that were shared with that integration. It does not see the rest of the workspace: access in Notion is granted page by page, so the damage is bounded by what you connected. For many teams that still means project notes, customer lists or internal wikis. Refresh the secret first, then audit what was reachable.

Check your GitHub account for leaked secrets — free

Provider: Notion
Severity: High
Impact: SaaS account access and billing
Checked live by LeakWatch: No

What a Notion API token looks like

Current Notion integration secrets start with ntn_, followed by a run of digits and letters:

ntn_…XXXX   Notion integration secret (masked, 11 digits then 35 letters and digits)

Older tokens used a different prefix, secret_, and a handful of those are probably still in use in old scripts. If your leaked token starts with secret_, the steps below apply in the same way, but be aware that it will not be matched by the pattern described later. The variable that normally holds one is NOTION_TOKEN or NOTION_API_KEY. Do not confuse an integration secret with a Notion page link or a public share link, which expose a single page and are a separate matter.

How Notion API tokens get leaked

A committed .env file that holds NOTION_TOKEN next to the database ID it is used with.
Automation scripts. A sync job, a backup or a blog generator that reads from Notion, with the secret hardcoded for convenience.
No-code and workflow exports. An exported workflow, a webhook payload or a config shared to ask for help, with the token inside.
Front-end code. A site that fetches from Notion in the browser and ships the secret in its bundle.
Logs and screenshots. A header printed by a debug option, or a screenshot of an integration page with the secret revealed.

What to do in the first hour

Find the integration. Open your integrations list in Notion (see the link below) and locate the integration that owns the leaked secret. If you use several, match them by name and by the pages they are connected to.
Refresh the secret. The integration’s configuration page has a way to generate a new secret, which invalidates the previous one. If you do not need the integration any more, delete it instead.
Deploy the new secret to the script or secret store, and confirm that the integration can still read its pages.
Review the connections. Open the pages and databases the integration was connected to and check which ones it had access to. Remove the connection from any page that no longer needs it, so the next secret covers less.
Look at the capabilities. An integration can be limited to read-only content. If this one could edit or delete, consider whether it needed to, and reduce the capabilities.
Audit what changed. Use page history on the pages that were reachable, and look for edits, deletions or new pages you did not make. Notion keeps version history for pages, which lets you restore content.
Clean the repository only after the secret is dead, and check the same files for other keys. See I accidentally pushed an API key to GitHub.

Want to see what else the repository exposes? Run a free scan.

Not sure what else leaked? Run a free scan.

Revoke it at Notion

Notion integration secrets are managed from the integrations page of your Notion workspace, after you sign in as a member allowed to manage that integration. Open the integration and generate a new secret, or delete the integration. A person has not confirmed the exact menu wording for this guide, and Notion’s interface changes regularly, so if the page you see differs from this description, look for the place where internal integrations are listed, and follow Notion’s developer documentation. Workspace owners can also review the connections installed in the workspace settings.

How LeakWatch detects it

The rule is called Notion API Token. It recognizes the ntn_ prefix followed by 11 digits and 35 letters and digits, and requires the token to be followed by a delimiter such as a quote, a space, a semicolon, a line break or the end of the text, so it does not report the beginning of a longer string. The older secret_ format is not covered by this rule. The severity is high. This type is not checked live: LeakWatch does not send any request to Notion with the token it found.

LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.

FAQ

Can someone read my whole Notion workspace with this token?

No. An integration only sees the pages and databases explicitly shared with it. What matters is which pages were connected, which is why step 4 is worth the time.

Is a leaked token enough to delete my pages?

Only if the integration had the capability to edit content. Even then, page history lets you restore earlier versions, but do not rely on it for everything: refresh the secret first.

Do I need to tell anyone?

If the connected pages hold personal data of customers or colleagues, you may have notification duties. Talk to a qualified adviser rather than deciding alone.