[Bug Report for notion-mcp-server] Critical Bug: MCP Server Not Passing Authorization Header to Notion API

[ThiagoDallacqua]

🐛 Bug Report for makenotion/notion-mcp-server

This issue is created here as a fallback to manually submit to the official Notion MCP server repository.

---

Description

The Notion MCP server fails to include the required Authorization header when making API calls to the Notion API, resulting in consistent 401 "unauthorized" errors despite having a valid integration token.

Environment

• Package: @notionhq/notion-mcp-server (latest via npx)
• Node Version: 22.14.0
• OS: Linux (WSL2)
• MCP Client: Claude Code 0.2.9

Steps to Reproduce

1. Configure the MCP server with a valid Notion integration token:

{
  "notion": {
    "command": "npx",
    "args": ["-y", "@notionhq/notion-mcp-server", "--transport", "stdio"],
    "env": {
      "NOTION_TOKEN": "ntn_XXXXXXXXXXXXXXXXXXXXX"
    }
  }
}

2. Call any MCP tool, e.g., API-get-self
3. Observe 401 error: "API token is invalid."

Expected Behavior

The MCP server should include the Authorization header and successfully authenticate with the Notion API.

Actual Behavior

The server makes requests WITHOUT the required headers, as shown in the actual HTTP request captured during debugging:

GET /v1/users/me HTTP/1.1
Accept: application/json, text/plain, */*
User-Agent: notion-mcp-server
Host: api.notion.com

Missing headers:

• Authorization: Bearer [TOKEN]
• Notion-Version: 2022-06-28

Root Cause Analysis

Through debugging, I discovered the MCP server's HTTP client is not adding the Authorization header from the environment variable. The error trace shows:

Error in http client O [AxiosError]: Request failed with status code 401
    at file:///.../@notionhq/notion-mcp-server/bin/cli.mjs:10:1027

When inspecting the actual request object, the headers are missing the Authorization field entirely.

Verification

The token is 100% valid. Direct API call works perfectly:

curl -X GET 'https://api.notion.com/v1/users/me' \
  -H 'Authorization: Bearer ntn_XXXXXXXXXXXXXXXXXXXXX' \
  -H 'Notion-Version: 2022-06-28'

# Returns: 200 OK with bot user information
{
  "object": "user",
  "id": "4e016876-643c-4edd-afce-ea30672dd0f9",
  "name": "MCP server",
  "type": "bot",
  "bot": {
    "workspace_name": "Mustech"
  }
}

Impact

This bug makes the MCP server completely unusable with internal integration tokens, forcing users to implement custom workarounds for basic Notion API access.

Workaround

Created custom helper functions that properly include headers:

const options = {
  headers: {
    'Authorization': `Bearer ${NOTION_TOKEN}`,
    'Notion-Version': '2022-06-28',
    'Content-Type': 'application/json'
  }
};

Helper functions available at:

• JavaScript: ~/.claude/mcp-servers/notion-wrapper/notion-helpers.js
• Python: ~/.claude/mcp-servers/notion-wrapper/notion_helpers.py

Suggested Fix

The MCP server needs to properly read the NOTION_TOKEN environment variable and include it in all API requests as an Authorization header, along with the required Notion-Version header.

Additional Context

• The MCP server correctly initializes and lists all available tools
• The token is being passed to the MCP server process via environment variable
• The issue appears to be in the HTTP client implementation within the MCP server
• This affects all users trying to use internal integration tokens with the MCP server

Related Issues in notion-mcp-server

• 401 using mcp.notion.com/mcp #106 - 401 using mcp.notion.com/mcp
• it's need to public auth #68 - it's need to public auth
• NOTION_TOKEN not working in Docker Hub image due to outdated build #94 - NOTION_TOKEN not working in Docker

This is a critical bug that prevents the primary use case of the MCP server - authenticating with Notion API using integration tokens.

[michaelschaffer-doka]

A workaround I used was to use the OPENAPI_MCP_HEADERS env variable instead:

"OPENAPI_MCP_HEADERS": "{\"Authorization\":\"Bearer ${input:NOTION_TOKEN}\", \"Notion-Version\":\"2022-06-28\"}"

[mquan]

@ThiagoDallacqua I just released version 1.9.0, please use the latest version which supports NOTION_TOKEN

[japuerto35]

Testing comment access