Preview drafts in Next.js

The dashboard appends preview_token to the preview URL. Pass it to the client and ask for drafts. The full header and cookie notes are in Preview tokens.

// lib/cosmic.ts
import { createBucketClient } from '@cosmicjs/sdk';

export function getCosmic(previewToken?: string) {
  return createBucketClient({
    bucketSlug: process.env.BUCKET_SLUG,
    readKey: process.env.BUCKET_READ_KEY,
    ...(previewToken ? { previewToken } : {}),
  });
}
// app/posts/[slug]/page.tsx
import { getCosmic } from '@/lib/cosmic';

export default async function Post({
  params,
  searchParams,
}: {
  params: Promise<{ slug: string }>;
  searchParams: Promise<{ preview_token?: string }>;
}) {
  const { slug } = await params;
  const { preview_token: previewToken } = await searchParams;
  const cosmic = getCosmic(previewToken);
  const { object } = await cosmic.objects
    .findOne({ type: 'posts', slug })
    .status('any')
    .props(['title', 'slug', 'metadata']);

  if (!object) return null;
  return <h1>{object.title}</h1>;
}

Allow the dashboard to frame the site. Set Content-Security-Policy: frame-ancestors 'self' https://app.cosmicjs.com https://*.cosmicjs.com. Do not send X-Frame-Options: DENY.

FAQ

How long is a preview token valid?

One hour. The dashboard issues it when someone opens Preview.

What happens with no token?

Reads stay published-only, which is the default. status=any without a token still returns drafts to anyone who has the read key, so only pass it on purpose.

Can the token go in a client component?

No. Read it from the query string or the cosmic_preview cookie inside a server component or route handler.

How much does Cosmic cost?

Project plans are Free ($0), Builder ($99/mo), Team ($299/mo), Business ($499/mo), Enterprise (custom pricing). Yearly billing saves 10%. Workspace plans are Small Workspace ($999/mo) and Large Workspace ($2,999/mo), and they start with a 30-day free trial. Allowances, add-on rates, and the rest of the pricing FAQ are plain text at https://www.cosmicjs.com/pricing.md.

Are API keys required, and is content private?

Each Bucket has a read key and a write key in Bucket Settings > API Access. GET requests use the read key. POST, PATCH, and DELETE use the write key as Authorization: Bearer. Do not put the write key in a browser bundle, a mobile app, or a NEXT_PUBLIC_ variable. SAML single sign-on is on Large Workspace and Enterprise. The audit log is append-only. Text versions: https://www.cosmicjs.com/security.md and https://www.cosmicjs.com/docs/dashboard/audit-log.md.

Can an agent create a Cosmic project without an existing account?

Yes. POST https://dapi.cosmicjs.com/v3/agents/sign-up provisions a free-tier project and bucket tied to a human email, with no existing Cosmic account. The human claims it with the emailed one-time code. The playbook is https://www.cosmicjs.com/docs/ai-onboarding.md.