What was going on
I am trying to call the Notion API directly from a webpage with the JavaScript SDK, but the browser blocks every request with a CORS policy error. Shouldn't this be fixable server-side by adding `Access-Control-Allow-Origin: *` to the responses? A workaround is running the browser with CORS checks disabled, but that is not real. How do I call the Notion API from the frontend?
What fixed it
You cannot call the Notion API directly from browser JavaScript, and this is by design, not a bug. Notion does not send CORS headers, so the browser will block the requests no matter what. The reason, confirmed in the thread: your API token would be visible to anyone with devtools, letting them craft requests that read more data than your app displays or even mutate pages if the integration's permissions allow. So the official answer is to call Notion only from a backend (a small API route, serverless function, or your own server) and have the frontend talk to that. That is why the JS SDK works in Node but not in the browser, despite the name.