Block Kit expands as Notion locks down browser tokens

Notion closes a token-leak door

The week's most consequential change for anyone embedding Notion is a security default that flips. Constructing a client with auth inside a browser page, web worker, or service worker now throws BrowserTokenNotAllowedError — the same error fires for per-request auth and OAuth client credentials before a request ever leaves the machine. It's a blunt fix for a real problem: any script that can load the page can read the token and act as the integration. Server-side code is untouched, and browser code that genuinely needs the old behavior can pass dangerouslyAllowBrowser: true, but the naming is the point — the SDK wants you to mean it.

The same SDK also picked up client.plugins and client.skills methods returning signed archive URLs, typed databases via a database_type field, and refreshed agent response types, including the notion_ai personal agent ID. The desktop and mobile apps churned quietly alongside with bug fixes and performance improvements and a second round of the same — worth a mention only because the SDK work is what actually changes how you build.

Slack builds out agent and block primitives

Slack's SDKs spent the week laying groundwork for agents that live inside conversations. The Python SDK added the agents.conversations.* methods alongside new model types, and Node's Web API client followed with the same surface — create, archive, setProperties, and more — giving both languages parity for Code agents.

Block Kit got the other half of the attention. Node's type package landed a ContainerBlock interface plus a data_table block type, raw_number cells in table rows, and optional action_id fields; Python's models mirrored the container and raw-number work. Anyone building layout-heavy messages should check which of these are typed before reaching for a workaround. Separately, the socket-mode client added support for undici@8 and pinned WebSocket connections to HTTP/1.1 by default, and stopped a spurious ping/pong warning that had been firing off other undici WebSockets. The Slack app itself fixed duplicate bookmarked workflows by quietly collapsing them into one.

Figma makes motion shareable

Figma pushed two features that both answer the same question — how does work leave the file? Community riffs let you post animations, prototypes, and experiments to the Figma Community and your profile, turning one-off experiments into a portfolio piece. And Figma Motion gained custom styles, audio, text animations, and Lottie export, which matters most for handoff: Lottie output means an animation built here can ship in production without being rebuilt. The mobile app picked up smaller collaboration and navigation improvements in the same batch.