Use a signed edge gate to turn Notion property changes into n8n jobs

The trick: verify at the edge, automate in n8n

Before you build it

npm install @notionhq/client@5.23.0

The edge Worker

1. Read the request as text, before any JSON parsing.
2. Accept the one-time verification request, then verify every later event against the saved token.
3. Use Notion's event id as an idempotency key.
4. Relay the original JSON to n8n only after the checks pass.

import { verifyWebhookSignature } from "@notionhq/client";

export default {
  async fetch(request, env) {
    if (request.method !== "POST") {
      return new Response("Method not allowed", { status: 405 });
    }

// Do not call request.json(). Signature verification needs these exact bytes.
    const rawBody = await request.text();
    let payload;

try {
      payload = JSON.parse(rawBody);
    } catch {
      return new Response("Invalid JSON", { status: 400 });
    }

// Notion's one-time subscription check sends this field in the body.
    if (payload.verification_token) {
      return new Response("Verification token received", { status: 200 });
    }

const signature = request.headers.get("X-Notion-Signature");
    const trusted = signature && await verifyWebhookSignature({
      body: rawBody,
      signature,
      verificationToken: env.NOTION_WEBHOOK_VERIFICATION_TOKEN,
    });

if (!trusted) {
      return new Response("Invalid signature", { status: 401 });
    }

if (payload.type !== "page.properties_updated") {
      return new Response("Ignored event", { status: 200 });
    }

const eventKey = `notion-event:${payload.id}`;
    if (await env.EVENT_KEYS.get(eventKey)) {
      return new Response("Duplicate event", { status: 200 });
    }

const relay = await fetch(env.N8N_WEBHOOK_URL, {
      method: "POST",
      headers: {
        "content-type": "application/json",
        "x-notion-relay-secret": env.N8N_RELAY_SECRET,
      },
      body: rawBody,
    });

if (!relay.ok) {
      return new Response("Relay failed", { status: 502 });
    }

await env.EVENT_KEYS.put(eventKey, "1", { expirationTtl: 86400 });
    return new Response("Accepted", { status: 200 });
  },
};

The n8n half

1. Webhook: receive the verified Notion event.
2. Edit Fields: copy {{$json.entity.id}} into page_id and {{$json.id}} into event_id. Keep {{$json.data.updated_properties}} for logging.
3. IF: continue only when updated_properties contains Automation state. This avoids fetching the page for unrelated edits.
4. HTTP Request, retrieve page: send GET https://api.notion.com/v1/pages/{{$json.page_id}} with the Notion bearer token and Notion-Version: 2026-03-11.
5. IF: continue only when the returned page property is Ready:

   {{$json.properties["Automation state"]?.status?.name === "Ready"}}

6. Slack: post a review request containing the page title and the page ID. Keep the message link generated from the page response; do not parse a page ID out of a URL.
7. HTTP Request, update page: set the same page's Automation state to Notified.

PATCH https://api.notion.com/v1/pages/{{page_id}}
Authorization: Bearer {{NOTION_TOKEN}}
Notion-Version: 2026-03-11
Content-Type: application/json

{
  "properties": {
    "Automation state": {
      "status": { "name": "Notified" }
    }
  }
}

What changes for the PM

1. Set one launch brief's Automation state to Ready.
2. Confirm that n8n posts one Slack message and changes the page to Notified.
3. Inspect the second event caused by that write-back. It should pass signature verification, then stop at the Ready condition.
4. Replay the first event body with the same id. The Worker should return Duplicate event and n8n should not run.

Gotchas

Smallest test