Source · Notion · Verified November 1, 2026
Notion
Short answer: Notion webhooks report page, database, data source, and comment changes inside a workspace integration.
Hooks verifies Notion deliveries with hmac-sha256, lowercase hex over the raw body and normalizes them into the unified event format.
Set up the webhook in Notion
- Create an internal integration in Notion and grant it access to the pages or databases you want to watch.
- Add a webhook subscription with your Hooks endpoint URL (
https://api.hooks.events/in/<endpoint-id>). - Leave the endpoint secret empty: Notion sends a one-time
verification_token, and Hooks encrypts and stores it automatically before answering the handshake.
Signature verification
| Header | X-Notion-Signature |
|---|---|
| Algorithm | HMAC-SHA256, lowercase hex over the raw body |
| Replay window | none |
| Delivery id | Body `id` |
- HMAC-SHA256, lowercase hex over the raw body
Events Hooks normalizes
| event.type | subject | What it means |
|---|---|---|
notion.received | event | Notion webhooks report page, database, data source, and comment changes inside a workspace integration. |
Normalized payload
Every adapter produces this shape before filters or templates run. The raw payload and sanitized headers stay attached for audit, but filters and templates read the normalized fields.
Normalized event
{
"id": "evt_demo",
"source": "notion",
"type": "notion.received",
"action": "received",
"deliveryId": "delivery_demo",
"subject": {
"title": "Notion event"
},
"raw": {}
}Filter and template examples
Filter
type equals "notion.received"Template
"Notion event: {{event.subject.title}}"Retries and the delivery log
408, 425, 429, and 5xx responses retry with backoff and honor Retry-After; other 4xx responses fail permanently with a named code. Every attempt keeps the rendered request and the target response, so a failure points at one field or one status instead of a guess.

Common errors
| Symptom | Fix |
|---|---|
SIGNATURE_INVALID | Use the signing secret Notion shows when the webhook is created, and send X-Notion-Signature for the exact raw body. |
Nothing arrives | Confirm the webhook points at the endpoint's /in/<endpoint-id> URL and that the endpoint is active. |
Pair with a target
Reference
- Receiving eventshttps://developers.notion.com/reference/webhooks
- Verify signatureshttps://hooks.events/docs/signatures.md
- Payload templateshttps://hooks.events/docs/templates.md
Other sources
<event>.<action> (for example issues.opened) before any destination filter runs.StripeA Hooks Stripe endpoint verifies Stripe-Signature as HMAC-SHA256 over <timestamp>.<raw body> with a five-minute tolerance, then normalizes each event to <resource>.<action> such as invoice.payment_failed.SlackA Hooks Slack endpoint verifies X-Slack-Signature as HMAC-SHA256 over v0:<timestamp>:<raw body>, answers the url_verification handshake itself, and normalizes messages to app_mention.received or message.<channel_type>.LinearA Hooks Linear endpoint verifies Linear-Signature as hex HMAC-SHA256 over the raw body, rejects payloads whose webhookTimestamp is more than 60 seconds old, and normalizes events to issue.create, issue.update, and comment.create.SentryA Hooks Sentry endpoint verifies Sentry-Hook-Signature as hex HMAC-SHA256 with the Integration's Client Secret, deduplicates by Request-ID, and normalizes events to issue.created or event_alert.triggered.GitLabGitLab project webhooks cover pushes, merge requests, pipelines, issues, notes, and releases.HubSpotHubSpot CRM webhooks report contact, company, deal, and ticket creation and property changes.ShopifyShopify app webhooks send topic-scoped events such as orders/create, products/update, and refunds/create.IntercomIntercom sends conversation and contact notification topics, signed with the app client secret.ZendeskZendesk webhooks cover ticket, user, and organization events, signed with a timestamp plus body HMAC.JiraJira Cloud webhooks cover issue creation, updates, comments, and sprint changes.PagerDutyPagerDuty v3 webhooks cover incident trigger, acknowledge, resolve, and annotation events.Standard WebhooksStandard Webhooks deliveries carry webhook-id, webhook-timestamp, and base64 v1 signatures.SvixSvix Play and the Svix dispatcher use the Standard Webhooks headers with svix- prefixes.VercelVercel webhooks cover deployment, integration, project, and domain events.TwilioTwilio status callbacks cover messages, calls, and recordings, signed over the URL and form parameters.DiscordDiscord interaction webhooks use Ed25519 signatures plus a PING handshake.Generic HMACGeneric sources sign timestamp.deliveryId.body with HMAC-SHA256 and send the signature in x-signature.BitbucketBitbucket Cloud repository webhooks cover pushes, pull request changes, and issue events.TypeformTypeform webhook deliveries report form responses with the form id, response token, and submitted answers.CalendlyCalendly webhook deliveries report scheduled-event invitee bookings, cancellations, and no-shows.ResendResend email webhooks report sent, delivered, delayed, bounced, complained, opened, and clicked messages.ClerkClerk user-lifecycle webhooks report users, sessions, organizations and memberships as they are created, updated, or removed.CloudflareCloudflare Alerts webhooks deliver platform notifications such as health-check, load-balancing, WAF, Workers and billing alerts to a generic webhook destination.PolarPolar billing webhooks report checkout, order, subscription, customer and benefit-grant events for digital products.Lemon SqueezyLemon Squeezy webhooks report orders, subscriptions, subscription payments, license keys and affiliates for digital products.PaddlePaddle Billing webhooks report subscription, transaction, customer, adjustment and payout events for SaaS billing.SupabaseSupabase database webhooks report table inserts, updates and deletes, while Auth HTTP hooks send signed user lifecycle payloads.PostHogPostHog webhook destinations forward product analytics events and person properties to any HTTP endpoint.Azure DevOpsAzure DevOps service hooks send git pushes, pull requests, work items, builds and releases to a public webhook endpoint.ZoomZoom webhooks cover meeting, webinar, recording and user events, with a URL-validation handshake during app setup.Fireflies.aiFireflies.ai Webhooks V2 report meeting transcription, summary, and bot-join events for a transcript id.Recall.aiRecall.ai sends bot lifecycle webhooks (joining, recording, done, fatal) through Svix with Standard Webhooks signatures.Auth0Auth0 custom log streams POST tenant log events (login, signup, logout, token exchange, user changes) to a webhook.StytchStytch project webhooks cover user, session, organization, member, SAML/OIDC and SCIM changes, delivered through Svix.AsanaAsana webhooks cover task, project, section, story, team and goal changes, established by a one-time X-Hook-Secret handshake.ClickUpClickUp webhooks cover task, list, folder, space and goal changes, signed with a per-webhook secret over the raw body.monday.commonday.com webhooks cover item, column, subitem and update changes; app webhooks carry a JWT in Authorization.SquareSquare webhooks cover payments, refunds, orders, invoices and catalog changes, signed with the subscription's signature key over the notification URL and body.PayPalPayPal webhooks cover payment, sale, capture, refund, subscription and invoice events, signed with an RSA certificate that can be verified locally.GrafanaGrafana Alerting webhooks deliver firing and resolved alert groups, optionally signed natively with HMAC-SHA256.AirtableAirtable webhooks notify you when records in a watched table change; the changed records are fetched separately from the webhook payloads API.Cal.comCal.com booking webhooks wrap the booking in a triggerEvent envelope and sign each delivery with an HMAC-SHA256 of the raw body.AWS SNSAWS SNS delivers JSON notifications and subscription confirmations to HTTP(S) endpoints, signed with an RSA certificate published under an sns.<region>.amazonaws.com URL.PlanetScalePlanetScale organization webhooks cover branch, deploy request, backup, storage and maintenance events.ElevenLabsElevenLabs webhooks report post-call transcriptions, voice removals and image/video generation completions.