Bailian Notion Agent Behind Cloudflare Edge Gateway

# Bailian Notion Agent Behind Cloudflare Edge Gateway

Scenario

Use this workflow when you need a globally distributed, low-latency AI agent that securely reads/writes Notion workspaces without exposing backend credentials. The Cloudflare Worker acts as a zero-trust edge gateway handling user auth and traffic shaping, while Alibaba Cloud Bailian executes AI logic and IDaaS manages credential-less machine-to-machine authentication.

Integration steps

1. Register Notion Integration: In the Notion Developer Portal, create an Internal Integration. Copy NOTION_API_KEY and grant access via ••• → Add connections on your target database.
2. Configure IDaaS M2M OIDC: In IDaaS, provision an M2M application with keyless auth enabled. Record CLIENT_ID, ISSUER_URL, and AUDIENCE. The token endpoint will be POST https://<tenant>.idaas.aliyuncs.com/oauth2/token.
3. Set Up Bailian MCP Agent: In the Bailian console, create an agent and attach a custom MCP tool. Configure the tool to call Notion's API (https://api.notion.com/v1/databases/{id}/query) and inject IDaaS variables: IDAAS_CLIENT_ID, IDAAS_ISSUER, NOTION_API_KEY.
4. Initialize Cloudflare Worker: Run npx wrangler init notion-edge-gateway. In wrangler.toml, define routing vars:

``toml name = "notion-edge-gateway" compatibility_date = "2024-01-01" [vars] BAILIAN_ENDPOINT = "https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions" ``

5. Implement Edge Auth & Routing: In src/index.ts, verify JWTs against IDaaS JWKS, apply Cloudflare Rate Limiting, and route by geography:

``ts export default { async fetch(req, env, ctx) { const token = req.headers.get("Authorization")?.split(" ")[1]; if (!await verifyOIDC(token, env.IDAAS_JWKS_URL)) return new Response("401", { status: 401 }); const region = req.cf?.country === "CN" ? env.BAILIAN_ENDPOINT : env.BAILIAN_FALLBACK; return fetch(region, { method: "POST", headers: req.headers, body: req.body }); } } ``

6. Bind Secrets & Deploy: Run npx wrangler secret put NOTION_API_KEY and npx wrangler secret put IDAAS_CLIENT_SECRET. Deploy via npx wrangler deploy.

Architecture

End-users request *.workers.dev. The Cloudflare Worker validates JWTs via IDaaS JWKS, enforces rate limits, and proxies traffic to the Bailian agent based on request.cf.country. Bailian executes AI prompts, dynamically invoking Notion MCP tools. Instead of static keys, Bailian exchanges IDaaS OIDC credentials for short-lived access tokens to query Notion. Responses traverse back through the Worker to the client.

Prerequisites

• Alibaba Cloud Bailian workspace with MCP tooling enabled
• IDaaS tenant with M2M OIDC application provisioned
• Notion Internal Integration (NOTION_API_KEY) and target DATABASE_ID
• Cloudflare account with Workers enabled and wrangler CLI installed

Common pitfalls

• Token Expiry Mismatch: IDaaS short-lived tokens expire during long MCP chains. Cache tokens in Cloudflare KV with a 5-minute TTL buffer.
• CORS Blocking: Workers strip Origin by default. Explicitly return Access-Control-Allow-Origin: * in preflight handlers.
• Notion Rate Limits: Notion caps at 3 req/sec. Enable exponential backoff in Bailian's MCP client config to avoid 429 drops.
• Missing Geo Data Locally: request.cf is undefined in wrangler dev. Mock cf.country in wrangler.toml [dev.vars] for testing.

Typical questions

• expose bailian notion agent via cloudflare
• cloudflare worker gateway to bailian agent
• secure notion AI agent edge deployment
• bailian agent behind cloudflare
• notion AI agent edge gateway
• Bailian Agent通过Cloudflare暴露
• 安全Notion AI Agent边缘网关
• IDAAS认证Agent加Cloudflare网关

Q: How do I deploy a Bailian Notion AI agent behind a Cloudflare edge gateway? A: You can deploy a Bailian Notion AI agent behind a Cloudflare edge gateway by using a Cloudflare Worker as an API gateway that routes requests to your Bailian backend. The Cloudflare Worker handles end-user authentication, rate limiting, and geographic routing, while the Bailian agent securely accesses Notion data via MCP tools authenticated through IDaaS keyless OIDC.