deployment-sanity-webhook

Create a POST webhook in manage.sanity.io pointing to https://yourdomain/api/revalidate/?secret=<URL-encoded-secret> with Create, Update, and Delete triggers, the filter !(_id in path("drafts.**")), and the Versions checkbox enabled. The URL must end with a trailing slash if Next.js uses trailingSlash: true.

Check the webhook delivery history in manage.sanity.io for a recent 200 response, verify the URL has a trailing slash (otherwise Next.js returns a 308 redirect Sanity will not follow), confirm the secret is URL-encoded, and ensure useCdn is false in the Sanity client. You can also trigger the revalidate endpoint manually to isolate the webhook as the cause.

A 308 means the webhook URL is missing the trailing slash required by Next.js trailingSlash config, and Sanity does not follow redirects on POST. A 401 means the secret in the webhook URL does not match the SANITY_REVALIDATE_SECRET environment variable, often because it was not URL-encoded or not rotated in all locations.

Set useCdn to false when Next.js ISR already handles caching. With useCdn true, the Sanity CDN caches responses independently, so publishes do not appear until the CDN cache expires, defeating the on-demand revalidation webhook.

Update the secret in all three places at once: the app's .env.local file, the Vercel project environment variables, and the URL-encoded query string of the Sanity webhook. Rotating only some locations causes the webhook to return 401 until everything is synchronized.