What is the recommended strategy for managing token lifecycles in Sanity Content Lake?

Confirmed Facts

Sanity Content Lake allows you to create API tokens that can be scoped to Viewer, Editor, or Administrator permissions. Tokens can be configured with an explicit expiration date either through the Sanity Management Console or via the createToken mutation in the GraphQL API. The backend does not automatically rotate or expire tokens; you must revoke or delete them manually.

Likely Best Practice

For automated systems that require least‑privilege access, the recommended pattern is a two‑token approach:

• Short‑lived access token (15–30 min) for actual API calls.
• Long‑lived refresh token stored securely on the server to request new access tokens when the short token expires.

This mirrors OAuth2 flows and keeps client‑side code free of long‑term secrets while allowing the server to maintain continuous access.

Implementation Steps

1. Create a dedicated service account with only the permissions needed for the integration.
2. Generate an access token with a short expiration (e.g., 30 min) using the createToken mutation or the console.
3. Store the token in an environment variable or a secret manager; never hard‑code it in source.
4. When the token expires, call a secure endpoint that uses the stored refresh token (or re‑authenticate the service account) to obtain a new access token. Example GraphQL mutation:

   mutation {
     createToken(
       name: "service-access",
       scopes: ["read", "write"],
       expiresAt: "2026-12-31T23:59:59Z"
     ) {
       token
     }
   }
   

5. Schedule a rotation job (e.g., nightly) that revokes the old access token and creates a new one before the old one expires.
6. Audit logs: enable Sanity audit logging and monitor for unexpected token usage.

Verification Steps

• Decode the JWT payload (e.g., jwt.io) and confirm the exp claim matches the configured expiration.
• Simulate token expiry in a test environment and verify the refresh flow returns a fresh token without manual intervention.
• Check the project’s audit logs to ensure a revoked token is rejected and that no unauthorized requests succeed after revocation.

Security & Monitoring Notes

• Always transmit tokens over HTTPS. Never expose them to client‑side code.
• Purge old tokens from logs and rotate secrets in your secret manager regularly.
• Set alerts for anomalous token usage patterns (e.g., spikes in failed requests).
• Be aware of Sanity’s per‑project token limits; keep the number of active tokens low to avoid hitting the cap.

Diagnostic Question

Do you currently have a refresh‑token or re‑authentication mechanism in place for your service account, or would you prefer to rely solely on manual revocation and recreation of tokens?

Reference Table

Token Type	Purpose	Expiration
Access Token	Immediate API calls	15–30 min
Refresh Token	Obtain new access token	Long‑term (weeks/months)