npm / @notionhq/client
@notionhq/client
What changed in @notionhq/client 5, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.
3 breaking11 new APIs and options1 behavior and defaults1 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@notionhq/client 516 changes
Breaking changes 3
In browsers, constructing a client with auth, passing per-request auth, or using OAuth client credentials throws BrowserTokenNotAllowedError before sending anything.
The stream.end event no longer has last_sequence; resume with event IDs.
A personal agent's name is now typed as string because owners can rename it.
New APIs and options 11
Insights responses now allow notion_ai for agent_type.
Insights responses now allow notion_ai for id.
Adds an API to list plugins.
Adds an API to retrieve a plugin; the method returns a signed archive URL and does not download or extract files.
Adds an API to retrieve a skill; the method returns a signed archive URL and does not download or extract files.
Pass this option to opt out of the browser token restriction, for example in jsdom tests.
Database creation accepts tasks, projects, or skills, and database and data source responses include a read-only database_type.
Adds methods to retrieve, query, delete, and batch agents, read insights, and update status or credit limits.
Adds methods to retrieve, update, cancel, and query sessions, query session events, and stream responses.
Returns an async iterable of server-sent events and retries eligible HTTP failures before a stream opens, without replaying events after streaming begins.
Adds typed committed and provisional session events, including user messages with text or file content; status events can include token usage and artifact metadata, and tool events expose lifecycle metadata.
Behavior and default changes 1
The personal agent ID is now notion_ai instead of the previous UUID; requests still accept the old UUID.
Fixes and other changes 1
Cloudflare Workers and Deno workers can again create authenticated clients and send the user-agent header; server runtimes no longer need dangerouslyAllowBrowser as a workaround.