Hi all, one quick question. The "robot user token" with write access should never be used in frontend bundle (like gatsby). Only correct way to use the write token is to...

Hi all, one quick question.The "robot user token" with write access should never be used in frontend bundle (like gatsby). Only correct way to use the write token is to implement an API endpoint and hide the token behind that API. client code invokes the api and then api uses the write token to make modification in sanity.... is my understanding correct?
or is there some other safe way to use write tokens in "font-end-client-only" implementations?

I’ve put the token in an ENV variable, and written a server side serverless function that accepts form input, does sanitization, error checking, etc, and then writes to Sanity.

AFAIK this is completely correct! Any code on your frontend runs in the client so there’s no way to secure a token to my knowledge that couldn’t be retrieved by any third-party visiting the website.
A little serverless function makes it fairly painless
🙂

Got it. thanks guys