# Notion > Connect Notion so MergeHarbor reviews each pull request against the specs and engineering docs it links to, read-only and cited in its comments. When a pull request, or the Jira or Linear issue it implements, links to a Notion page, MergeHarbor reads the page and gives it to the review as the specification for the change. ## What it does in reviews - **Finds the pages a pull request refers to.** MergeHarbor looks for Notion links (`notion.so`, `notion.site` and `notion.com` URLs, including pages opened from a database view) in the pull request title and description, and in the descriptions of its linked Jira and Linear issues. A page named in quotes also counts: `Notion page "Checkout spec"`, `Notion: 'Refund policy'`. MergeHarbor looks for a page with exactly that title. - **Reads the page text.** The page title and its blocks: headings, paragraphs, lists, to-dos, quotes, callouts, code, tables and toggles, including nested blocks up to three levels deep. Sub-pages and databases inside the page are listed by name but not read. Each page is trimmed to about 8,000 characters, and at most two pages are read per pull request and per issue by default. - **Uses it as the specification.** Pages linked from the pull request are sent to the review as the documents describing the change, and the reviewer flags code that contradicts them. Pages linked from an issue are added to that issue alongside its acceptance criteria. Text that looks like a secret is redacted before it reaches the model. - **Costs no extra model call.** The page text is part of the review's existing context budget (3,000 tokens by default), and nothing is read when nothing links to Notion. - **Cites what it used.** A comment that relied on a page ends with a "Source used:" link to it, and the requirements check lists the pages read under **Docs read**. ## Connect 1. In the console, open **Integrations** and choose **Connect** on **Notion**. You need the `settings.manage` permission. 2. In Notion, choose the workspace and the pages MergeHarbor may read, then allow access. Choosing a parent page includes its child pages. 3. Choose **Test connection** to check that MergeHarbor can see at least one page. MergeHarbor asks Notion only for the **Read content** capability. It never edits, inserts or comments on pages, and does not read people's email addresses. ### Share more pages later MergeHarbor sees only the pages shared with it. A connection made with **Connect** sees the pages picked in Notion's page picker when you signed in; it does not appear in a page's **•••** → **Connections** menu. To add pages, choose **Reconnect** on **Notion** and select them (or their parent pages) in the page picker; child pages are included. If **Test connection** says MergeHarbor cannot see any pages, or a review does not pick up a page you linked, share the page this way. With an internal connection (below), open the page in Notion, choose **•••** (top right) → **Connections** → **Add connection**, and select your connection instead. ### Internal connection instead of OAuth Choose **Use a connection secret**. A workspace owner creates an internal connection at [app.notion.com/developers/connections](https://app.notion.com/developers/connections) (**Build → Internal connections → Create a new connection**), gives it the **Read content** capability, copies the secret from its **Configuration** tab, and grants it access to pages under **Content access** or with **•••** → **Connections** on each page. A Notion personal access token also works, but it reads everything its owner can read; prefer an internal connection limited to your spec pages. ## What is read and stored - Page title, link and text, as described above. Page text is cached for a short time (10 minutes by default; a page that has not been edited since is reused without reading it again), deleted within 24 hours, and never written to logs. If an administrator turns on **Keep linked documents in the knowledge base**, text that [issue triage](https://mergeharbor.com/docs/issue-triage) reads is kept for the days they choose (1–365) after last use instead. - The connection is named after the Notion workspace. Tokens are encrypted at rest and never shown again. - In **Settings**, you can limit the integration to some repositories. Reviews of other repositories never read Notion. ## Disconnect Open the integration in **Integrations** and choose **Disconnect**. MergeHarbor revokes its OAuth token with Notion and deletes its tokens and cached page text. If you connected with a connection secret, also delete the connection (or refresh its secret) in Notion's developer portal. ## Self-hosted installations To offer **Connect** with OAuth, create a public connection at [app.notion.com/developers/connections](https://app.notion.com/developers/connections) (**Build → Public connections → Create new connection**): 1. Set the redirect URI to `{PUBLIC_URL}/integrations/connect/notion/callback`. 2. Choose the **Read content** capability, and no user information. 3. Copy the **OAuth client ID** and **OAuth client secret** from the **Configuration** tab into `NOTION_OAUTH_CLIENT_ID` and `NOTION_OAUTH_CLIENT_SECRET` on the API, and make sure `SECRETBOX_KEYS` is set. Without a public connection, teams can still connect with an internal connection secret. Optional server settings: `INTEGRATIONS_CACHE_TTL` (default `10m`), `INTEGRATIONS_MAX_TICKETS` (`3`), `INTEGRATIONS_MAX_PAGES` (`2`), `INTEGRATIONS_CONTEXT_TOKENS` (`3000`) and `INTEGRATIONS_FETCH_TIMEOUT` (`8s`).