Add an Origin SSH Certificate Authority via the API

Register an SSH certificate authority an owner trusts with POST https://api.cursor.com/v1/origin/owners/{ownerSlug}/ssh-certificate-authorities. Official reference: Origin API (OpenAPI OriginService_AddSshCertificateAuthority) and changelog (added 2026-09-22).

Origin is in Early Beta and subject to change. Authenticate with a Cursor user access token that carries namespace:settings:write (installation tokens are not accepted for this write). Availability: Early Beta per the API overview.

Team members can then use git over SSH on the owner's repositories with user certificates the authority signed, without registering an SSH key. Authorities can be added to team-owned owners only; other owners return FailedPrecondition (HTTP 400). Cost: 5 points against the principal budget (ordinary write).

Path parameters

Param	Required	Meaning
ownerSlug	yes	Owner slug

Request body

Field	Required	Meaning
publicKey	yes	One OpenSSH authorized_keys line (<key_type> <base64> [comment]). Accepted types: ssh-ed25519, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, and ssh-rsa with modulus ≥ 2048 bits. Certificates are rejected.
name	yes	Label for the authority, at most 255 characters

A certificate, unsupported key type, or shorter RSA key returns InvalidArgument (HTTP 400). A key the owner already lists returns AlreadyExists (HTTP 409 Conflict); the check is scoped to the owner.

curl --request POST \
  --url 'https://api.cursor.com/v1/origin/owners/OWNER_SLUG/ssh-certificate-authorities' \
  --header 'Authorization: Bearer YOUR_USER_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPwoQNzBuiWhDF4EKwRyt8h48XRY7Bc4yWbQ9s3Tnj7Q acme-ssh-ca",
  "name": "Acme production CA"
}'

Response

200 returns the stored SshCertificateAuthority (id, name, keyType, fingerprint, publicKey without comment, createdAt).

{
  "id": "nsca_01k2ja2000e0080000000000s5",
  "name": "Acme production CA",
  "keyType": "ssh-ed25519",
  "fingerprint": "SHA256:D5vlIclvaSZlwq4gmckavfLE7n7F542Eyhk/PvXkRq0",
  "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPwoQNzBuiWhDF4EKwRyt8h48XRY7Bc4yWbQ9s3Tnj7Q",
  "createdAt": "2026-08-02T14:45:00Z"
}

After at least one authority exists, you can require certificates with Set SSH Certificate Requirement. Base URL: https://api.cursor.com/v1/origin.