Sanity draft mode preview on Next.js App Router works fine when your secret is baked into an environment variable — until a client accidentally pastes the preview URL into a Slack channel and you have to redeploy to rotate it. Vercel Edge Config solves that: you update a single key in the dashboard and the new secret is live in under a second, no rebuild required. Here is exactly how I wire it up.
Why the standard env-var approach breaks down
The Next.js docs show a route handler that reads SANITY_PREVIEW_SECRET from process.env and sets the draft-mode cookie. That works for a single developer. It breaks down in two ways on real projects:
Secret leaks are sticky. Rotating a process.env value means a new Vercel deployment, which takes 60–90 seconds even with Turbopack. During that window the old secret still works on the live deployment.
You cannot audit access. Every stakeholder shares one secret. You cannot tell which link a leaked URL came from.
