notion oauth restricted_to_workspace install error

Not specified by the original author.

Fix Notion OAuth failing with restrictedtoworkspace

TL;DR

The Notion integration is restricted to a specific workspace - either it is an internal integration, which by design installs only in its home workspace, or the target workspace blocks outside integrations. Install it in the allowed workspace, or convert it to a public integration and complete Notion's review for cross-workspace distribution. The workspace admin decides which path applies.

The error

OAuth callback error: "restricted_to_workspace"
The integration cannot be installed in this workspace

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=notion%20oauth%20restricted_to_workspace%20install%20error"

Fix it

Step 1: Check the integration type

Open notion.so/my-integrations, select the integration, and check whether it is internal or public.

Expected: the type is confirmed. Internal integrations can only ever install in their home workspace; that restriction is not a bug.

Step 2: Install in the correct workspace if internal is fine

Have a workspace owner of the home workspace add the integration under Settings / Connections.

Expected: the install succeeds there. If the product only ever serves one workspace, stop here.

Step 3: Convert to public for multi-workspace distribution

In the integration settings, change the distribution to public and submit it for Notion's review.

Expected: after approval, the integration installs in any workspace. Plan for review time; it is not instant.

Step 4: Check the target workspace's integration policy

In the target workspace's Settings, confirm whether workspace owners allow public integrations or require approval for each one.

Expected: the policy allows the install, or the approval request is submitted. A workspace-level block overrides everything else.

Step 5: Retry the OAuth flow from the right workspace

Start the OAuth flow while acting in the correct workspace context and complete the authorization.

Expected: authorization completes and the token works.

When this applies

• OAuth fails with restrictedtoworkspace
• The integration installs in one workspace but not another
• Distributing a Notion integration to customer workspaces

When it doesn't

• The error is invalid authorization code (code reuse or expiry)
• The redirect URI mismatches (app config issue)
• API calls fail after a successful install (capability or permission issue)

Compatibility

Notion API OAuth 2.0, internal vs public integrations.

Variant phrasings

notion integration restricted to workspace

Check the integration type first; the fix depends entirely on internal vs public.

notion oauth error restrictedtoworkspace

The error names the restriction. Match the distribution model to where it must install.

Why it happens

Notion scopes internal integrations to a single workspace by design: they are meant for first-party, single-workspace use. Cross-workspace installation requires the public distribution model plus Notion's review. The error fires whenever the install target falls outside the integration's allowed distribution, which is working as intended.

Edge cases

• Only workspace owners can install integrations; members hit a permissions wall that looks similar
• Review turnaround for public integrations varies; do not promise customers a date
• Duplicating an internal integration per workspace is a common workaround for a handful of workspaces

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstdg56RzQRnKJCFAnJCiwGQ

Resolved from the public thread: https://vectle.com/posts/pstdg56RzQRnKJCFAnJCiwGQ

Thread query: notion oauth restrictedtoworkspace install error

TL;DR: The Notion integration is restricted to a specific workspace - either it is an internal integration, which by design installs only in its home workspace, or the target workspace blocks outside integrations. Install it in the allowed workspace, or convert it to a public integration and complete Notion's review for cross-workspace distribution. The workspace admin decides which path applies.

Not specified by the original author.

Fix Google OAuth 403 access denied by admin policy

TL;DR

Access denied by admin policy means the Google Workspace admin has blocked the app, not that your code is wrong. The admin must allow-list the app in the Admin console under API controls. End users cannot fix this themselves.

The error

Google OAuth failed
Error 403: access_denied. The administrator has blocked this app.

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=google oauth error 403 access denied admin policy"

Fix it

Step 1: Confirm the block in the Admin console

Google Admin -> Security -> Access and data control -> API controls -> Third-party access.

Expected: The app shows as blocked for the user's org unit.

Step 2: Allow-list the app

Change the app's access setting to trusted for the relevant org units and save.

Expected: The app shows as trusted.

Step 3: Check the OAuth scopes requested

Confirm the scopes the app requests are ones the admin policy permits.

Expected: No requested scope is on the restricted list without approval.

Step 4: Have the user retry the OAuth flow

The user runs the Google OAuth flow again.

Expected: The flow completes instead of showing 403.

Step 5: Document the allow-list requirement

Add the allow-list step to your onboarding docs for Google Workspace customers.

Expected: Future installs include the admin step up front.

When this applies

• Google OAuth fails with 403 access denied by admin policy
• An app works for consumers but not for Workspace users
• You are onboarding Google Workspace customers

When it doesn't

• The error is about unverified app screens (that is the verification flow)
• The admin allowed it and it still fails (check the org unit scoping)
• The error names a specific scope (request a narrower scope)

Compatibility

Google OAuth 2.0 with Google Workspace admin API controls.

Variant phrasings

google oauth blocked by administrator

Same condition. Only a Workspace admin can unblock; the user and the developer cannot.

error 403 access_denied google workspace app

The 403 wrapper is the same admin block. Check third-party access settings first.

google admin blocked third party app oauth

Bulk blocks happen when admins restrict all third-party access. The app needs an explicit trust entry.

Why it happens

Google Workspace admins can block third-party API access org-wide. When they do, every OAuth flow for the blocked app fails with 403 before the user even sees a consent screen. It is a policy decision on the customer's side, not a defect in the app.

Edge cases

• Blocks can be scoped per org unit; the app may work for one team and fail for another
• Restricted scopes need admin approval even for trusted apps; check the scope classification
• After allow-listing, propagation can take several minutes

If it still fails

• Reproduce with one API call in isolation, outside the agent, to separate platform issues from agent issues.
• Check the platform status page and changelog; OAuth and webhook behaviors change without warning.
• Capture the full request and response with timestamps for the vendor ticket, redacting credentials.
• Test in a second workspace or sandbox to rule out workspace-specific policy blocks.
• If the integration is business-critical, build the fallback now: cached data, a manual trigger, or a second provider.

Prevention

• Store OAuth credentials in a secrets manager with rotation reminders.
• Build the reconnect flow before you need it; every integration gets revoked eventually.
• Log token ages so expiring grants are visible ahead of time.
• Keep a sandbox integration for testing config changes.
• Document the required scopes per integration so reinstalls request the right ones.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstirEQvfcK366ER04Gi0Lpg

Resolved from the public thread: https://vectle.com/posts/pstirEQvfcK366ER04Gi0Lpg

Thread query: google oauth error 403 access denied admin policy

TL;DR: Access denied by admin policy means the Google Workspace admin has blocked the app, not that your code is wrong. The admin must allow-list the app in the Admin console under API controls. End users cannot fix this themselves.

Not specified by the original author.

TL;DR

Open each page or database, add the integration under Connections, then retry the search. When Notion search comes back empty, dont debug the query, check sharing.

Steps

1. When Notion search comes back empty, dont debug the query, check sharing. The search endpoint only sees content shared with your integration. Open each page or database, add the integration under Connections, then retry the search. Agents should treat an empty search result as a sharing problem before assuming the workspace is empty.

When to use

You are seeing this: When Notion search comes back empty, dont debug the query, check sharing. Use this skill when you run into "Notion API search returns nothing until you share pages with the integration".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Stack Overflow #69358435 (accepted answer, 9 votes): the asker's notion.search() call returned an empty response even though the workspace had pages. The accepted answer: the search endpoint only returns pages and databases that have been shared with the integration. Even in your own workspace, you have to share each page with the integration first.

Verified resolution: When Notion search comes back empty, dont debug the query, check sharing. The search endpoint only sees content shared with your integration. Open each page or database, add the integration under Connections, then retry the search. Agents should treat an empty search result as a sharing problem before assuming the workspace is empty.

Source URL: https://stackoverflow.com/questions/69358435/notion-api-search-method-returns-nothing