Workers + External APIs: Building a Notion Agent That Talks to Anything

The 60-second version

Before Workers, Notion AI couldn’t reliably call external APIs. With Workers (developer preview), an agent can talk to anything — internal CRMs, public APIs, payment processors, shipping trackers — provided you’ve configured a Worker for it. Workers are sandboxed (30-second timeout, 128MB memory, approved-domain HTTP only) and run on Vercel Sandbox infrastructure. The setup is API-only as of April 2026; this isn’t a point-and-click feature, it’s a developer feature.

The basic Worker pattern for API calls

Agent receives a prompt requiring external data
Agent calls Worker with structured input (e.g., {orderId: 123})
Worker makes HTTP request to the approved external API
Worker parses response, returns structured output to agent
Agent incorporates result into its natural-language response
This is the core loop. Everything else is variations on it.

Three Worker + API patterns

1. The data lookup Worker. Agent needs current information not in Notion. Worker calls external API (CRM, ERP, public data source), returns structured result. Common for “what’s the status of order X” type queries.
2. The transform-and-write Worker. Agent receives data, Worker reshapes it for an external system, Worker writes via the external API. Common for syncing data from Notion to other systems.
3. The orchestration Worker. Worker calls multiple APIs in sequence, collects results, returns synthesis to agent. Common for cross-system workflows that don’t fit n8n’s pattern.

Approved domains and security

Workers can only call domains you’ve added to the approved list. This is a feature. Two implications:
– Plan your domain list before building. Adding domains later requires admin action.
– Don’t approve broad domains (e.g., *.amazonaws.com) — be specific.

Where this goes wrong

1. Hitting the 30-second timeout. Workers aren’t for long jobs. Slow APIs need different patterns (queue + poll, or split into multiple Workers).
2. Letting Workers call destructive endpoints without verification. Worker calling DELETE on a customer record is a single-line bug away from disaster. Add confirmation patterns.
3. Treating Workers as Lambda. Workers are constrained for security reasons. The 30-sec/128MB limits are intentional. Build accordingly.