| name | auth-guide |
| description | Guide to setting up third-party authentication for a Notion Worker. Covers brokered credentials for external-service API keys / personal access tokens, OAuth, and plaintext environment secrets only when worker code needs the value. Use when the worker needs credentials for a non-Notion API, not for Notion API tokens or `ntn login`. |
| user-invocable | false |
What this guide is for
This guide is for authentication against the third-party service your worker integrates with — the place data is coming from or going to (GitHub, Stripe, Salesforce, Google, Slack, etc.).
Use it when the worker needs credentials for a non-Notion API. Do not use it for Notion API tokens, ntn login, or general Notion workspace setup.
Never ask the user to send secret or environment-variable values in chat. For environment secrets, tell the user which variables are needed and have them enter the values directly in .env themselves. Do not open or print .env after they add them.
Most workers will use one of two auth patterns from the upstream service:
- personal API key / personal access token
- OAuth
For a personal API key / PAT, use a brokered credential unless worker code must read the plaintext value.
Decision framework
Before recommending anything, check the provider's current developer docs. Confirm whether it offers:
- personal API keys / personal access tokens
- OAuth
- neither
Always research the provider's current auth docs on the web before advising the user. Do not rely on memory for auth availability, setup steps, or settings locations.
Then choose mechanically:
