If the permanent access token is exposed, do you know if someone can use it with the prismic rest api to access data from draft pages or is it only used to fetch data from published pages?
Thanks for reaching out to us.
You can only have data from the published pages in the Rest API from Prismic even though a permanent access token is exposed.
Let me know if you have any questions.
The access token is different than the master ref, which dictates whether you get the latest content or not, you can learn more about the here:
If you want to get the ref for documents in a release, which is a group of drafts, you can find the ref for the releases in the API browser:
If you're are just trying to preview draft content, then you should check out our previews feature here:
Let us know if you have any further questions.