particle-academy/notion-php

Notion for PHP — the service descriptor, its faker, its webhook verification, and one class per operation. Plain HTTP on particle-academy/fancy-connector-core; no vendor SDK.

Maintainers

Package info

github.com/Fancy-Friends/notion

Language:Python

pkg:composer/particle-academy/notion-php

Transparency log

Statistics

Installs: 1

Dependents: 0

Suggesters: 0

Stars: 0

Open Issues: 0

Security

Advisories: 0

Aikido package health analysis

v0.1.0 2026-08-31 17:07 UTC

Requires

Requires (Dev)

MIT afcffd4323e1a0b4eca91b42840c3308608d1e2e

apiconnectorproductivitynotionparticle-academyfancy-ui

Published on Packagist.org on 2026-09-01 01:07 UTC

This package is auto-updated.

Last update: 2026-09-01 01:07:48 UTC

README

Notion for fancy-flow — as four imported, versioned packages, one per runtime. Not vendored source: a copy cannot be upgraded, and third-party APIs change.

Runtime Package Install
Authoring surface (every host) @particle-academy/notion-ui npm install @particle-academy/notion-ui
Node @particle-academy/notion-js npm install @particle-academy/notion-js
PHP 8.4+ particle-academy/notion-php composer require particle-academy/notion-php
Python 3.11+ fancy-notion pip install fancy-notion

The ui package is the editor surface and is React on every host — a PHP or Python project installs it and its own runtime package, and never the js one.

What it costs you

One dependency: @particle-academy/fancy-connector-core (or particle-academy/fancy-connector-core on Composer), which the js and php packages pull in themselves. The Python package has zero runtime dependencies.

No Notion SDK. Plain HTTP, deliberately: a vendor SDK is third-party code subject to the kit's full approval bar, and one per provider is hundreds of dependencies nobody is tracking.

Setting it up

Everything below is generated from provider/manifest.json, so it cannot disagree with what the packages do.

Credentials

A Notion connection holds 4 values.

Two kinds of value, and mixing them up matters. A provider credential is ONE value for the whole installation — an OAuth app's client secret serves every connected account. An account credential is one per connected account. A host that stores the second where it stores the first lets one account's credentials reach another's.

Field Scope Secret Where it comes from
OAuth client ID per installation not secret The public connection's OAuth client ID from its Configuration tab.
OAuth client secret per installation secret The matching secret used by the host for code exchange and token refresh.
Access token per connected account secret The bearer token for one user's installation in one Notion workspace.
Refresh token per connected account secret The rotating refresh token. Replace it atomically with the new value returned by every refresh.

Authorising

Notion uses OAuth2 (authorization_code). The package DECLARES the exchange; the HOST performs it — a consent screen needs a browser, a redirect URI and somewhere to persist the result, and all three belong to the host.

  • Authorize URL — https://api.notion.com/v1/oauth/authorize
  • Token URL — https://api.notion.com/v1/oauth/token
  • Configured capabilities — Read content. This provider does not accept OAuth scope strings; configure these permissions on the integration itself.
  • Access token lifetime — not documented by the provider. The host must retain the refresh token and refresh in response to expiry rather than scheduling from an invented TTL.

The refresh tokens ROTATE, and they are single use. Every refresh returns a new one and spends the one submitted, so replaying a spent token revokes the ENTIRE grant — the user is signed out, with nothing in the failure that says why.

Two consequences, both of which a host gets wrong by default:

  1. Do not RETRY a failed refresh with the same token. A response that arrived but was not persisted — a crash between the reply and the write — turns the reflexive retry into a replay.
  2. Do not refresh CONCURRENTLY. Two workers refreshing at once means one of them replays.

Persist the returned token before using the access token it came with.

The estate

Notion has a test estate on the same host, reached with credentials from a SEPARATE test account you register. Selecting sandbox mode uses those credentials.

Install the public connection into a dedicated Notion development workspace and grant it only test pages. Calls use the live API and create or read real content inside that workspace.

What it can do

Actions

page_markdown_get — Notion page Markdown

Retrieve a Notion page's content as enhanced Markdown.

GET /v1/pages/{pageId}/markdown · reads only — safe to replay

Input Required What it is
pageId yes The Notion page UUID, with or without hyphens. The connection must have Read content capability and access to this page.
includeTranscript no Include meeting-note transcripts when the connection and caller are permitted to read them.

Run it before you have credentials

Every operation ships a faker, whether or not Notion has a sandbox. Set a node's mode to fake and it returns the shape Notion actually publishes — the same field names, deterministically — so you can wire the downstream nodes before touching an account, a key, or a network.

This repository is generated

provider/ is the source. Everything under packages/ is emitted from it and must not be hand-edited — CI regenerates and diffs on every push, and the next protocol sync destroys anything it finds. See AGENTS.md.

Two namespaces, which do not match on purpose

The repo is github.com/Fancy-Friends/notion; the packages publish under particle-academy. Nothing derives one from the other — the names come from weaver's friends.json and nowhere else.

Licence

MIT.