Create an Origin installation access token via the API

Mint a short-lived installation credential with POST https://api.cursor.com/v1/origin/app/installations/{installationId}/access_tokens. Official reference: Origin API → Create Installation Access Token.

Origin is in Early Beta and subject to change. Authenticate with an app JWT. The named installation must belong to the authenticated app. Tokens begin with oit_ and expire after at most 15 minutes (and never outlive the app JWT used to mint them). Availability: Early Beta per the API overview.

Cost: 1 rate-limit point. No installation scope is required beyond presenting a valid app JWT.

Path parameters

Param	Required	Meaning
installationId	yes	Installation to scope the token to. Must belong to the authenticated app.

Request body

Field	Required	Meaning
scopes	no	Scope strings to grant. Must be unique and included in the installation's accepted scopes. Empty or omitted inherits the full scope grant.
repositoryIds	no	Repository IDs to grant. Must be unique, accessible to the installation, and at most 50 entries. Empty or omitted inherits all accessible repositories.

You can attenuate a token to fewer scopes or repositories than the installation holds. You cannot add a scope or repository the workspace admin did not approve. repositoryIds may name a mirrored repository; Origin still applies the mirror ceiling on each subsequent request.

curl --request POST \
  --url 'https://api.cursor.com/v1/origin/app/installations/INSTALLATION_ID/access_tokens' \
  --header 'Authorization: Bearer YOUR_APP_JWT' \
  --header 'Content-Type: application/json' \
  --data '{
  "scopes": [
    "repository:contents:read",
    "repository:pull_requests:read"
  ],
  "repositoryIds": [
    "repo_01k2ja2000e0080000000000q4"
  ]
}'

Response fields

Field	Meaning
token	Short-lived installation credential with the oit_ prefix.
expiresAt	RFC 3339 expiration time.

Example:

{
  "token": "oit_2v8xkq4m1c7p9t3w5y0z6r4b",
  "expiresAt": "2026-08-01T10:30:00Z"
}

Using the token

Send it as a Bearer credential on repository-scoped REST calls:

curl --request GET \
  --url 'https://api.cursor.com/v1/origin/installation/repos' \
  --header 'Authorization: Bearer oit_...'

For Git over HTTPS, use HTTP Basic auth with username x-access-token and password equal to the installation token (Bearer is rejected on Git HTTPS). Mint just before the Git operation; rewrite the remote after clone so an expired secret is not left in .git/config.

Treat the token like a password: never log it, mint just in time, and refresh before expiresAt. Deleting the installation or the app invalidates outstanding tokens before expiry — subsequent REST and Git calls return 401. Do not retry with the same token; the app must be reinstalled before it can mint a working one again.

The installation receipt JWT from the install callback is not an installation access token. Never send it as a Bearer credential; always mint through this endpoint.

Base URL: https://api.cursor.com/v1/origin.