Error with authentication header causing 500 error on Vercel deployment

The error you're seeing is related to an invalid character in the authorization header of your Sanity client configuration. This typically happens when there are whitespace characters (like newlines or spaces) in your token or when environment variables aren't being read correctly in production.

Here are the most common causes and solutions:

1. Check your environment variable for whitespace

The most likely culprit is extra whitespace in your Sanity token environment variable. In Vercel, go to your project settings → Environment Variables and make sure your SANITY_API_TOKEN (or whatever you named it) doesn't have any:

• Leading or trailing spaces
• Newline characters
• Tab characters

Re-paste the token directly from your Sanity dashboard to ensure it's clean.

2. Trim the token in your code

As a safeguard, explicitly trim your token when initializing the client:

import {createClient} from '@sanity/client'

const client = createClient({
  projectId: process.env.NEXT_PUBLIC_SANITY_PROJECT_ID,
  dataset: process.env.NEXT_PUBLIC_SANITY_DATASET,
  apiVersion: '2023-05-03', // This also fixes your deprecation warning
  token: process.env.SANITY_API_TOKEN?.trim(),
  useCdn: false
})

3. Specify an API version

Your logs show a deprecation warning about not specifying an API version. While this isn't causing your error, you should add apiVersion to your client configuration (as shown above) using today's date or the date you want your queries to be locked to.

4. Check environment variable naming

Make sure your environment variable in Vercel matches exactly what you're calling in your code. If you're using the token in an API route, it should NOT be prefixed with NEXT_PUBLIC_ (that would expose it to the browser). Server-side environment variables should be named something like SANITY_API_TOKEN or SANITY_WRITE_TOKEN.

5. Redeploy after changing environment variables

After updating environment variables in Vercel, you need to trigger a new deployment for the changes to take effect. Simply saving them isn't enough.

The "Invalid character in header content" error specifically points to the authorization header having unexpected characters, so cleaning up that token should resolve your issue. Let me know if you're still seeing problems after trying these steps!