Definition
Notification permission states
Notification.permission returns one of three strings: "default" (the user has not yet decided, so the site may still call Notification.requestPermission() to ask), "granted" (the site may show notifications), or "denied" (the site is blocked from showing notifications and, critically, cannot re-prompt programmatically once denied).
Once a user denies permission, calling Notification.requestPermission() again resolves immediately with "denied" and shows no browser prompt at all — the only way for the user to change their mind is through the browser's own site-settings UI, which the page cannot open programmatically.
Because a denial is effectively permanent from the page's perspective, requesting permission the moment a page loads (rather than after a relevant user action) is widely discouraged; a rejected prompt at that point burns the one chance to ask.
requestPermission() must be called in response to a user gesture on most modern browsers, and returns a Promise resolving to the same three-value string, replacing the older callback-based signature from early API drafts.
You can check the current state without prompting via Notification.permission directly, which is the right way to decide whether to show your own "Enable notifications" call-to-action button versus assuming the OS prompt is still available.