Pasted keys stay in your browser. Notion sign-in is handled server-side; the Notion secret and bot token never reach this page.