diff --git a/packages/@sanity/client/src/http/requestOptions.js b/packages/@sanity/client/src/http/requestOptions.js
index aa007b419a1..9445bd7a51d 100644
--- a/packages/@sanity/client/src/http/requestOptions.js
+++ b/packages/@sanity/client/src/http/requestOptions.js
@@ -14,11 +14,17 @@ module.exports = (config, overrides = {}) => {
     headers[projectHeader] = config.projectId
   }
 
+  const withCredentials = Boolean(
+    typeof overrides.withCredentials === 'undefined'
+      ? config.token || config.withCredentials
+      : overrides.withCredentials
+  )
+
   const timeout = typeof overrides.timeout === 'undefined' ? config.timeout : overrides.timeout
   return assign({}, overrides, {
     headers: assign({}, headers, overrides.headers || {}),
     timeout: typeof timeout === 'undefined' ? 5 * 60 * 1000 : timeout,
     json: true,
-    withCredentials: Boolean(config.token || config.withCredentials)
+    withCredentials
   })
 }