Set up a Cursor connector

ConductorOne provides identity governance for Cursor. Integrate your Cursor instance with ConductorOne to run user access reviews (UARs) and enable just-in-time access requests.

The Cursor connector requires the Cursor Enterprise plan. The Admin API used by this connector is only available to Enterprise teams. Teams on the Business plan do not have access to the Admin API and cannot use this connector.

Capabilities

The Cursor connector syncs the following resources:

Resource	Sync	Provision
Account
Role

Notes:

• The connector syncs team members and their assigned roles (Owner, Member, Free Owner).
• Provisioning is not currently supported. The connector provides read-only visibility into Cursor team membership and role assignments.

Additional functionality:

None.

Prerequisites

Before setting up the Cursor connector, confirm the following:

• Your Cursor team is on the Enterprise plan. The Admin API is not available on Business or other plans.
• You have the administrator role in your Cursor team. Only administrators can create API keys.

If your organization uses Cursor on the Enterprise plan with SSO enabled, you can also configure SCIM provisioning directly in Cursor to manage user lifecycle through your identity provider. The ConductorOne connector complements SCIM by providing access visibility and review capabilities.

Gather Cursor credentials

To configure the Cursor connector, you need administrator permissions in your Cursor team.

1. Log in to the Cursor dashboard.

2. Navigate to Settings > Advanced > Admin API Keys.

3. Click Create New API Key and provide a descriptive name (for example, ConductorOne).

4. Copy the generated API key and save it securely. The key follows the format key_ followed by a 64-character string. You cannot retrieve the key after leaving the page.

For more information, see the Cursor Admin API documentation.

Configure the Cursor connector

To complete this task, you need:

• The Connector Administrator or Super Administrator role in ConductorOne
• The Cursor API key gathered in the previous section

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by ConductorOne.

1. In ConductorOne, navigate to Integrations > Connectors and click Add connector.

2. Search for Cursor and click Add.

3. Choose how to set up the new Cursor connector:

   • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)
   • Add the connector to a managed app (select from the list of existing managed apps)
   • Create a new managed app
4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.

   If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Enter your Cursor API key in the API Key field.

8. Click Save.

9. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

That’s it! Your Cursor connector is now pulling access data into ConductorOne.

Self-hosted

Follow these instructions to use the Cursor connector, hosted and run in your own environment.

When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with ConductorOne, automatically syncing and uploading data at regular intervals. This data is immediately available in the ConductorOne UI for access reviews and access requests.

Step 1: Set up a new Cursor connector

1. In ConductorOne, navigate to Integrations > Connectors > Add connector.

2. Search for Baton and click Add.

3. Choose how to set up the new Cursor connector:

   • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)
   • Add the connector to a managed app (select from the list of existing managed apps)
   • Create a new managed app
4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.

   If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.

5. Click Next.

6. In the Settings area of the page, click Edit.

7. Click Rotate to generate a new Client ID and Secret.

   Carefully copy and save these credentials. You need them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Cursor connector deployment:

Secrets configuration

# baton-cursor-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-cursor-secrets
type: Opaque
stringData:
  # ConductorOne credentials
  BATON_CLIENT_ID: <ConductorOne client ID>
  BATON_CLIENT_SECRET: <ConductorOne client secret>

  # Cursor config
  BATON_CURSOR_API_KEY: <Cursor API key>

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-cursor.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-cursor
  labels:
    app: baton-cursor
spec:
  selector:
    matchLabels:
      app: baton-cursor
  template:
    metadata:
      labels:
        app: baton-cursor
        baton: true
        baton-app: cursor
    spec:
      containers:
      - name: baton-cursor
        image: ghcr.io/conductorone/baton-cursor:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-cursor
        envFrom:
        - secretRef:
            name: baton-cursor-secrets

Step 3: Deploy the connector

1. Create a namespace in which to run ConductorOne connectors (if desired), then apply the secret config and deployment config files.

2. Check that the connector data uploaded correctly. In ConductorOne, click Apps. On the Managed apps tab, locate and click the name of the application you added the Cursor connector to. Cursor data should be found on the Entitlements and Accounts tabs.

That’s it! Your Cursor connector is now pulling access data into ConductorOne.

Known limitations

• Enterprise plan required. The Cursor Admin API is only available on Enterprise plans. Teams on the Business plan cannot use this connector.
• No provisioning. The connector provides read-only access. It cannot invite users, remove members, or modify role assignments through the Cursor API.
• No role management API. Cursor does not expose an API for changing user roles. Role assignments are synced for visibility only.
• SCIM requires Enterprise and SSO. SCIM-based user provisioning in Cursor is only available on Enterprise plans with SSO enabled. SCIM is configured directly in Cursor, not through this connector. See the Cursor SCIM documentation for setup guidance.