How to read and write to Sanity Content Lake using tokens from custom app

Great question! You can absolutely read and write to your Content Lake from your own application without using Sanity Studio. Here's how it works:

Reading Data

For reading data, you'll use the HTTP Query API to execute GROQ queries. Yes, you do need to use GROQ (not "GRAQ") to query your content, but it's actually quite intuitive once you get started.

A basic query looks like:

GET https://<projectId>.api.sanity.io/<apiVersion>/data/query/<dataset>?query=*[_type == "post"]

You can also use parameters in your GROQ queries (prefixed with $) which is safe for user input since they're JSON literals that get substituted into the query.

Writing Data

For writing data, you'll use the Mutation API, and here's the good news: you write simple JSON objects, not GROQ! The Mutation API accepts standard JSON documents.

You have several mutation operations available:

• create - Creates a new document (fails if ID exists)
• createIfNotExists - Only creates if the ID doesn't exist
• createOrReplace - Creates or overwrites existing document
• patch - Updates specific fields in existing documents
• delete - Removes documents

Example JSON for creating a document:

{
  "mutations": [
    {
      "create": {
        "_type": "post",
        "title": "My Post",
        "content": "Post content here"
      }
    }
  ]
}

For drafts, prefix the ID with drafts.:

{
  "create": {
    "_id": "drafts.post-123",
    "_type": "post",
    "title": "Draft Post"
  }
}

Authentication

You'll need to create an API token in Sanity Manage:

1. Run npx sanity@latest manage or access Manage from your Studio
2. Go to the API tab
3. Create a token with appropriate permissions (Viewer for read-only, Editor for write access)
4. Store it securely in environment variables

Important security note: Never expose write tokens in frontend code! Use them only in server-side environments, API routes, or serverless functions.

Add the token to your requests via the Authorization header:

Authorization: Bearer <your-token>

Quick Summary

• Reading: Use GROQ queries via the Query API
• Writing: Use simple JSON objects via the Mutation API
• Auth: API tokens with appropriate permissions
• Security: Keep write tokens server-side only

The Mutation API supports transactions too, so you can perform multiple operations atomically. One thing to note: when using the HTTP API directly, you're responsible for your own validation - the Studio's schema validation doesn't automatically apply at the API level.