Issue accessing drafts from Astro SSR on Vercel with Sanity client token.

5 replies
Last updated: Mar 6, 2025
I’m trying to access drafts from Astro SSR on Vercel, I created a client with client with a token
const sanityAuthClient = sanityClient.withConfig(
  { 
    token: import.meta.env.SANITY_API_TOKEN, 
    useCdn: false
  }
);
with
Contributor permissions. Looks like that’s not enough. If I click on my preview link from studio in dev mode it actually loads fine.
AI Update

Looking at your setup, the issue is that the Contributor role doesn't have sufficient permissions to read drafts. According to the roles documentation, the Contributor role only has "create" mode access, which allows reading and writing to draft content but cannot read published documents or use the previewDrafts perspective.

Here's what's happening:

Contributor permissions:

  • Mode: create (can create/edit drafts but limited read access)
  • Cannot use perspective: 'previewDrafts'
  • Cannot read documents with periods in their IDs (like drafts.)

Why it works in dev mode: In development, you're likely authenticated with your personal user account (which probably has Administrator or Editor role), so you have full access.

Solution options:

  1. Use a Viewer or Editor token (recommended for preview):

    • Viewer role: Can read all documents including drafts with mode: 'read' and history: true
    • Editor role: Full publish permissions including draft access

    Create a new API token in Sanity Manage with Viewer or Editor role instead of Contributor.

  2. Add the perspective parameter to your client config:

    const sanityAuthClient = sanityClient.withConfig({
      token: import.meta.env.SANITY_API_TOKEN,
      useCdn: false,
      perspective: 'previewDrafts', // This requires Viewer+ role
    });
  3. For Astro SSR on Vercel specifically, you'll want to:

    • Use a Viewer token (read-only is fine for preview)
    • Set useCdn: false (you already have this ✓)
    • Add perspective: 'previewDrafts' to prioritize drafts over published
    • Optionally set apiVersion to match your dataset

Quick fix: Go to your project's API settings, create a new token with Viewer role, and use that instead. Viewer tokens can read both drafts and published documents, which is exactly what you need for preview functionality on Vercel.

The Contributor role is designed for users who can create/edit content but shouldn't necessarily see everything - it's more restrictive than you need for a preview environment. For accessing drafts via the API (especially with perspectives like previewDrafts), you need at least Viewer-level permissions.

Something sounds off here. In our docs we define that role as:> • Contributor: Read and write access to draft content within all datasets, with no access to project settings.
So I’d assume it would work.

Are you saying that same set up works locally, though? If that’s the case then I’d double check that your deployed version has access to your var.
Working now. Sorry I was assuming that when I ran
sanity deploy
the project was built before being deployed.
which actually shouldn’t have made a difference, anyway ya i think it was something about access to the env var.
Great!
user B
hi there, sorry this is an old thread but im actually running into the same issue currently. i have a contributor token and i can preview in dev mode, on vercel i have the same token (contributor permissions). my build and deployment was successful, however in my studio in production it is giving me an invalid secret. i was wondering if you had any tips or suggestions on how to debug this? I'm running Nextjs /react on the frontend deployed with vercel. the backend is actually in a separate repo which i deploy using the cli.

Sanity – Build the way you think, not the way your CMS thinks

Sanity is the developer-first content operating system that gives you complete control. Schema-as-code, GROQ queries, and real-time APIs mean no more workarounds or waiting for deployments. Free to start, scale as you grow.

Was this answer helpful?