Using listener with tokens is not supported in browsers
This page is out of date
Token-authenticated listeners work in browsers. @sanity/client stopped using the browser's native EventSource in version 3 and now sets the Authorization header on the listen request, so passing a token to listen() no longer prevents the connection, and you don't need a server-side proxy to work around it. The security consideration below still stands: a token sent to the browser is readable by anyone who loads your site. See Use tokens in the browser and Listening to content updates with @sanity/client.
The browser implementation of EventSource does not allow for sending custom headers. Therefore, authenticating a listener request using a token will not work in browsers.
Gotcha
Configuring the sanity client using a token in the browser has security implications, and should only be done after a careful consideration.
Instead consider setting the visibility of your dataset to public or make sure users are logged in using cookies when accessing your frontend.
Was this page helpful?
Feedback submitted, thanks for helping us improve the docs. Have you tried these alternatives?