> For the complete documentation index, see [llms.txt](https://www.cakewalk.security/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.cakewalk.security/docs/human-access/connections-and-integrations/integration-guides/sanity.md).
# Sanity
Set up Sanity Auto Provisioning and Access Sync with an organization level robot token and your organization ID.
### :sparkles: Auto Provisioning
| **Authentication method** | API token. Organization level robot token |
| ------------------------- | ------------------------------------------------------------------------------------------- |
| **Required permissions** | `Manage Access` on the token. Developer role or equivalent in the organization to create it |
| **Required metadata** | `Organization ID` |
| **Optional metadata** | `Default Project ID` and `Default project role` |
| **MFA** | Not applicable. The token authenticates, not a user account |
Agent Cake invites the user to your Sanity organization at the permission level you granted, and removes them when access is revoked. Pending invites are withdrawn the same way.
Use an organization level token. Provisioning runs against your organization unless you scope it to a single project, and a project token cannot invite or remove users at organization level.
Available permission levels: `Member`, `Billing manager` and `Developer`.
How can I create a Sanity API token?
Create the token on your organization, not on a project. Sanity shows a **Tokens** screen in both places and they look identical, but a project token only ever sees that one project.
1. Sign in to Sanity and open the [management console](https://www.sanity.io/manage).
2. Select your organization.
3. Go to **Settings** > **API** > **Tokens**.
4. Click **Add new token**.
5. Enter a name, for example `Auto Provisioning`.
6. Select the **Manage Access** checkbox.
7. Save the token, then copy it. Sanity shows it once and it cannot be recovered later.
8. Paste it into the `API Secret` field in Cakewalk.
You need a Developer role or equivalent in the organization to create an organization token. Being an admin on a project does not grant this. If the organization **Tokens** screen tells you that you have insufficient privileges, ask whoever administers your Sanity organization to grant you that role or to create the token for you.
The token is not tied to your user account, so you do not need a service account for it and it keeps working after the person who created it leaves.
Where do I find my Organization ID?
Open your organization in Sanity and read the ID from the address bar. In `https://www.sanity.io/organizations/oB93YoV6I`, the Organization ID is `oB93YoV6I`.
Can I provision into a single project instead?
Yes. Set both **Default Project ID** and **Default project role** in the configuration. Users are then invited to that project with that role instead of to the organization. Project roles are `editor`, `viewer`, `developer` and `contributor`. Leave both empty to invite at organization level.
Set one without the other and the configuration is rejected. An organization level token covers both paths, so use one even if you scope provisioning to a single project.
***
### :arrows\_counterclockwise: Access Sync
Access Sync for Sanity allows you to automatically synchronize user data with Cakewalk, including permission levels. A single organization level API token covers every project in your organization.
| **Authentication method** | API key. Organization level robot token |
| -------------------------- | ------------------------------------------------ |
| **Synced user attributes** | Email, Name and Permissions |
| **Non-human identities** | Supported. Robot tokens and webhooks |
| **Required permissions** | Developer role or equivalent in the organization |
How can I create a Sanity API token?
Cakewalk reads your Sanity users with an organization wide robot token. Use a robot token rather than a personal token: personal tokens expire after a year and are tied to your own user.
Create the token on your organization, not on a project. Sanity shows the same **Tokens** screen under a project, and a project token is the easiest one to create by mistake. Cakewalk syncs at organization level so that you see every Sanity user regardless of project membership, and a project token only returns the members of that one project.
1. Sign in to Sanity and open the [management console](https://www.sanity.io/manage).
2. Select your organization.
3. Go to **Settings** > **API** > **Tokens**.
4. Click **Add new token**.
5. Give the token a recognizable name.
6. Leave **Expiration** unset so the sync continues without interruption. If your policy requires an expiry, choose a date and rotate the token before it lapses.
7. Copy the token value. Sanity shows it exactly once and it cannot be recovered later.
8. Navigate back to Cakewalk and paste the token into the `API Key` field.
You need a Developer role or equivalent in the organization to create an organization token. A project admin role does not carry over, so the organization **Tokens** screen can report insufficient privileges even when you administer every project.
An organization wide token covers every project in your organization, so you do not need a separate token per project.
#### Learn more
* [Sanity: Authentication and tokens](https://www.sanity.io/docs/content-lake/http-auth)
#### Quick Setup
1. Navigate to **App Governance** → **Sanity** → **Users table** → **Sync Users**
2. Enter your Sanity API key
3. Users will sync automatically
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://www.cakewalk.security/docs/human-access/connections-and-integrations/integration-guides/sanity.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.