Using listener with tokens is not supported in browsers
This page is out of date
Token-authenticated listeners work in browsers. @sanity/client stopped using the browser's native EventSource in version 3 and now sets the Authorization header on the listen request, so passing a token to listen() no longer prevents the connection, and you don't need a server-side proxy to work around it. The security consideration below still stands: a token sent to the browser is readable by anyone who loads your site. See Use tokens in the browser and Listening to content updates with @sanity/client.
The browser implementation of EventSource does not allow for sending custom headers. Therefore, authenticating a listener request using a token will not work in browsers.
Gotcha
Configuring the sanity client using a token in the browser has security implications, and should only be done after a careful consideration.
Instead consider setting the visibility of your dataset to public or make sure users are logged in using cookies when accessing your frontend.