API / add-and-revoke-origin-app-signing-keys-via-api

Add and revoke Origin App signing keys via the API

add-and-revoke-origin-app-signing-keys-via-apiUpdated 2026-09-19

Register another Ed25519 public key with POST https://api.cursor.com/v1/origin/apps/{appId}/signing_keys, and retire one with DELETE https://api.cursor.com/v1/origin/apps/{appId}/signing_keys/{kid}. Official reference: Origin API → Add App Signing Key and Revoke App Signing Key.

Origin is in Early Beta and subject to change. Both calls take a Cursor user access token with app:settings:write. An app cannot add or revoke its own keys with an app JWT. Availability: Early Beta per the API overview.

An app can hold up to 10 active signing keys. Generate the key pair locally; send only the PEM SPKI public key. Never upload the private key.

Generate a key pair

openssl genpkey -algorithm ED25519 -out origin-app-private.pem
openssl pkey -in origin-app-private.pem -pubout -out origin-app-public.pem

The public key file starts with -----BEGIN PUBLIC KEY-----. Store the private key in a secrets manager and use it only to sign app JWTs.

Add App Signing Key

Path parameters

Param	Required	Meaning
`appId`	yes	App identifier prefixed `app_`

Request body

Field	Required	Meaning
`publicKey`	yes	PEM SPKI Ed25519 public key

curl --request POST \
  --url 'https://api.cursor.com/v1/origin/apps/APP_ID/signing_keys' \
  --header 'Authorization: Bearer YOUR_USER_ACCESS_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "publicKey": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAq9zTf3hL6wXe1cVj0bYs5mKR8uDnG2oAaPp4NiEkKlM=\n-----END PUBLIC KEY-----"
}'

Response

Field	Meaning
`kid`	Key ID: base64url-encoded SHA-256 digest of the key's SPKI DER encoding. Use it as the JWT `kid` header and to revoke the key.
`createdAt`	RFC 3339 registration time

A key that is already registered returns AlreadyExists (HTTP 409). Adding a key beyond the active-key limit returns FailedPrecondition (HTTP 400) until another key is revoked. Cost: 5 points.

When signing app JWTs with a key registered through this endpoint, put the returned kid in the JOSE header and set iss to the app ID. Keys registered at Create App time still use the app ID as both iss and kid (see App JWT in the Origin API docs).

Revoke App Signing Key

Path parameters

Param	Required	Meaning
`appId`	yes	App identifier prefixed `app_`
`kid`	yes	Key ID of the signing key to revoke

curl --request DELETE \
  --url 'https://api.cursor.com/v1/origin/apps/APP_ID/signing_keys/KID' \
  --header 'Authorization: Bearer YOUR_USER_ACCESS_TOKEN'

Response

Successful requests return 204 No Content with an empty body. App JWTs signed with a revoked key stop authenticating. The last active signing key cannot be revoked; that request returns FailedPrecondition (HTTP 400). Cost: 5 points.

Rotate safely: add the new key first, switch JWT signing to the new private key, confirm minting works, then revoke the old kid.

Base URL: https://api.cursor.com/v1/origin.