Authentication

Every request carries your Radical Notion access token as a Bearer credential in the Authorization header.

The token is the access token for your account session. Obtain one by signing in with the Supabase client library, then reuse it until it expires and refresh as usual. Requests without a valid token receive 401 unauthenticated.

While the API is in preview it is limited to administrators: an authenticated non-admin token receives 403 forbidden on every endpoint. See the access model for details.

With curl

curl "https://radicalnotion.ai/api/v1/cves/CVE-2025-55182" \
  -H "Authorization: Bearer $RN_TOKEN"

From JavaScript

import { createClient } from '@supabase/supabase-js'

const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY)
await supabase.auth.signInWithPassword({ email, password })

const { data: { session } } = await supabase.auth.getSession()
const res = await fetch(
  'https://radicalnotion.ai/api/v1/cves/CVE-2025-55182',
  { headers: { Authorization: `Bearer ${session.access_token}` } },
)
const cve = await res.json()

How tokens are verified

Tokens are verified locally against the platform’s signing keys on every request — a bad token is rejected outright and never falls back to any ambient browser session, so an integration sending an invalid token always sees 401 rather than silently riding a cookie.

If you are signed in to the app, you can also open any GET endpoint directly in the browser; the session cookie authenticates the request the same way as a Bearer token.