Use tokens in the browser

Don't put a Sanity token in JavaScript that runs in the browser. Anyone who loads the page can read the token and use it with the permissions the token grants.

If your application needs a token, use an organization-wide robot token scoped to only the permissions the application needs, rather than a personal token tied to your own account.

Before you use a token in browser code, read how to keep your data safe.

If you have taken steps to keep the access token from leaking, you can disable the warning in @sanity/client by setting the ignoreBrowserTokenWarning option to true. Note that @sanity/client only prints this warning when it detects a token in a browser on localhost, 127.0.0.1, or 0.0.0.0. A deployed site never prints it, so the absence of a warning in production is not a sign that exposing the token is safe:

import {createClient} from '@sanity/client'

const client = createClient({
  projectId: 'YOUR_PROJECT_ID',
  dataset: 'production',
  apiVersion: '2026-08-17',
  useCdn: true,
  // Only with a token you have confirmed is safe to expose
  token: process.env.SANITY_API_TOKEN,
  ignoreBrowserTokenWarning: true,
})

Replace <your-project-id> with your project ID, and supply the token through SANITY_API_TOKEN in your environment rather than as a literal in source.