fix: auth race condition when using the SDK in the Studio structure

[ryanbonial]

Description

This PR improves Studio Mode authentication by using project-specific storage keys for tokens and properly handling authentication in Studio Mode contexts. It ensures that Studio Mode authentication works correctly by using the appropriate storage keys, bypassing organization verification, and using project hostnames for API requests when in Studio Mode.

What to review

• Check the changes in subscribeToStateAndFetchCurrentUser.ts where project hostname is now used when Studio Mode is enabled
• Review the AuthBoundary.tsx modifications that disable organization verification when in Studio Mode
• Verify the comment update in ComlinkTokenRefreshProvider that clarifies when token refresh is not needed

Testing

The easiest way to test this is by using the code in the SDK movie procurement studio
https://github.com/sanity-io/sdk-movie-procurement-studio/blob/main/sanity.config.ts#L24

Tested the authentication flow with Studio Mode enabled and verified that:

• Organization verification is skipped
• The project hostname is used for user fetching

Fun gif

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
sdk-docs	Ready	Preview	Comment	Oct 3, 2025 5:09pm
sdk-kitchensink-react	Ready	Preview	Comment	Oct 3, 2025 5:09pm

[cngonzalez]

What's the best way to test this in the procurement studio? pnpm link? Afraid I'm still getting the 403 but could be on me

[ryanbonial]

The best way to test is to

1. pull down this branch
2. run pnpm run build of this branch
3. clone https://github.com/sanity-io/sdk-movie-procurement-studio
4. add the sdk-movie-procurement-studio package.json

     "pnpm": {
       "overrides": {
         "@sanity/sdk-react": "../sdk/packages/react"
       }
     },
   

5. run pnpm i
6. run pnpm run deploy to deploy the studio to https://www.sanity.io/@oblZgbTFj/studio/x8vnqr5igs0l6nd9bfc0vu8d/default/structure (this bug seems to only happen when deployed)
7. Reload the studio via the browser, click in and out of the studio, etc to test it

[cngonzalez]

Nothing in the code sticks out as strange, but just reporting that I did get the 403 on first load (I think I did a login flow first). Refreshing / pressing retry did help. Not sure if that is the intended result.

I wasn't able to recreate by logging out of the dashboard and trying again, so it could also have been a case of staleness somewhere (I did get a 502 in one of my attempts to recreate 😬 )

[ryanbonial]

@cngonzalez I have made some changes and I'm pretty sure that I have resolved the race condition thoroughly now.