Your Storyblok preview token is exposed. Now what?
Anyone with the preview token can read every draft and unpublished story in your space. Here is how to check it, rotate it and keep it out of your front-end for good.
What the preview token can do
Storyblok gives every space a few kinds of access tokens. The public token only reads published content, so it is fine in the browser. The preview token also reads drafts. It cannot change anything, but it does show work in progress: a launch page before launch, prices before they change, a job post before it is announced.
Check if your site exposes it
The usual leak is a STORYBLOK_TOKEN that ends up in the JavaScript bundle, often because the variable has a NEXT_PUBLIC_ or VITE_ prefix and is also used to fetch drafts.
Check if your site exposes its token
Paste your URL. Cojack reads the public pages like a visitor would and flags a preview token if it finds one. Free, no account needed.
Prefer to look yourself? Open your site, open the network tab and search for version=draft or token= on requests to api.storyblok.com.
Fix it in four steps
- 1
Create a new preview token
In Storyblok go to Settings → Access tokens, add a token with access level Preview and copy it. Leave the old one for now so nothing breaks while you deploy.
- 2
Use a public token in the browser
Anything that ships to visitors should fetch published content with a Public token. Only the server, or the Visual Editor preview route, should know the preview token.
- 3
Rename the env variable and deploy
Drop the public prefix so the bundler can no longer inline it, update the value in your host and redeploy.
- NEXT_PUBLIC_STORYBLOK_TOKEN=… + STORYBLOK_PREVIEW_TOKEN=… + NEXT_PUBLIC_STORYBLOK_PUBLIC_TOKEN=…
- 4
Delete the old token
Once the new build is live, remove the leaked token in Access tokens. From that moment the copy in old bundles, caches and archives stops working.
Checklist
Questions you asked
QCan someone edit my content with a preview token?
No. Preview tokens only read. They show drafts, they can’t change them.
QDoes rotating the token break the Visual Editor?
Only until the new token is deployed to your preview environment. That’s why you create it before deleting the old one.
QWill Google still have my old bundle?
Possibly, but once the token is deleted in Storyblok that copy no longer works.
