Using tokens to deploy APIs

Great questions! Let me break down the deployment permissions for GraphQL APIs (and Studio deployment):

1. Non-admin roles for deploying

Unfortunately, only users with the Administrator role can deploy the GraphQL API using sanity graphql deploy. According to the CLI errors documentation, if you try to run this command with only Write or Read+Write access, you'll get an "Unauthorized" error.

However, there is a workaround using deploy tokens:

You can create a robot token (API token) with Administrator permissions specifically for deployment purposes. Your collaborator can use this token to deploy without being added as a full Administrator:

# Set the token as an environment variable
export SANITY_AUTH_TOKEN=your-deploy-token

# Then run the deploy command
sanity graphql deploy

To create a deploy token:

1. Go to sanity.io/manage or run npx sanity manage
2. Navigate to API → Tokens
3. Create a new robot token with Administrator permissions
4. Share this token securely with your collaborator (use environment variables, never commit it to code!)

This approach is mentioned in the schema deployment docs and follows the same pattern for other deployment commands like sanity schema deploy.

2. Dataset-level deployment restrictions

Unfortunately, you cannot restrict GraphQL deployment to specific datasets at the permission level. The Administrator role (or deploy token with Admin permissions) grants access to deploy for all datasets in the project.

Workarounds:

• Use separate projects for production vs. development environments, each with their own access controls
• Implement a CI/CD pipeline that controls which datasets get deployed based on branch/environment
• Use custom roles (Enterprise feature) to restrict overall dataset access, though this won't specifically limit deployment permissions

The sanity graphql deploy command does support a --dataset <name> flag to specify which dataset to deploy for, but the permission to run the command itself is all-or-nothing at the project level.

Hope this helps! The deploy token approach is probably your best bet for controlled deployment access without full Administrator privileges.