Cursor Custom API Endpoint: Verify the Real Data PathCursor / Cline 自定义 API 端点：先核实真实数据路径
A custom key or endpoint does not prove that a coding assistant connects directly to the model provider. Verify each product's backend path, feature limits, code exposure and tool behavior before trusting it with a repository.
自定义 Key 或 Endpoint 并不能证明编程助手会直连模型供应商。在让它接触代码库前，应分别核实产品的后台路径、功能限制、代码暴露范围与工具行为。
TL;DR
Source, prompts, paths, errors and tool arguments may leave the machine.
Use separate credentials with limited models, lifetime and budget.
Verify streams, context, tools, errors and rate limits in the actual client.
Keep a known-good config and revoke compromised keys.
源码、提示词、路径、错误与工具参数可能离开本机。
使用限制模型、生命周期与预算的独立凭证。
在真实客户端验证流、上下文、工具、错误与限流。
保留已知可用配置，并撤销泄露密钥。
What the coding assistant sends—and where it goes编程助手会发送什么，以及数据去了哪里
Depending on enabled features, requests can contain selected code, retrieved repository context, conversation history, terminal output, diagnostics, tool schemas and generated actions. The configured model provider is only one participant in that path. The editor's own backend, context-building services, telemetry and any proxy also become part of the repository trust boundary.
根据启用功能，请求可能包含所选代码、检索到的仓库上下文、会话历史、终端输出、诊断、工具 Schema 与生成动作。配置的模型供应商只是这条路径中的一方；编辑器自身后端、上下文构建服务、遥测和任何 Proxy 也都会进入代码库信任边界。
Cursor's current data-use documentation states that requests still go through its backend even when users bring their own API key, and its security documentation says this is not equivalent to direct routing from the app to an enterprise model deployment. Cline and other coding clients can expose different endpoint controls. Treat them as separate products: verify the actual network path and supported feature set instead of copying one setup assumption to all clients.
Cursor 当前的数据使用说明明确表示，即使使用自带 API Key，请求仍会经过 Cursor 后端；其安全说明也指出，这并不等同于从应用直接路由到企业模型部署。Cline 等其他编程 Client 可能提供不同的 Endpoint 控制。应把它们视为不同产品，核实真实网络路径与功能范围，而不是把同一套配置假设复制到所有 Client。
Use only approved hosts and provider accounts, document retention and training terms for every processor, exclude or redact sensitive files and test capability behavior before enabling tools or broad workspace access. A successful key verification confirms authentication, not privacy, feature parity or a direct connection.
只使用批准的 Host 与供应商账户，为每个数据处理方记录保留和训练条款，排除或脱敏敏感文件，并在启用工具或广泛 Workspace 访问前测试能力行为。Key 验证成功只能证明认证可用，不能证明隐私条件、功能等价性或直连路径。
Setup decisions设置决策
| Area领域 | Best fit最适合 | Verify before choosing选择前验证 |
|---|---|---|
| Host主机地址 | Approved HTTPS base URL or trusted gateway.批准 HTTPS 基础地址（Base URL）或可信网关。 | Validate certificate, redirects, operator and data region.验证证书、重定向、运营者与数据区域。 |
| Credential凭证 | Dedicated scoped key for the coding client.面向编程客户端的独立受限密钥。 | Set budget, model allowlist, rotation and revocation.设置预算、模型 Allowlist、轮换与撤销。 |
| Capabilities能力 | Context, streams, tools, models and error handling.上下文、流、工具、模型与错误处理。 | Test the exact client workflow; compatibility claims are insufficient.测试准确客户端工作流；兼容声明不足。 |
| Data and logs数据与日志 | Repository context, prompts, outputs and telemetry.仓库上下文、提示词、输出与遥测。 | Exclude secrets, define retention and redact safe logs.排除上游密钥、定义保留并脱敏安全日志。 |
Preflight checklist预检清单
Define allowed projects, file classes and data handling.
Require confirmation, sandboxing and idempotency for actions.
Bound timeouts and retries; surface rate-limit errors clearly.
Version non-secret settings across environments.
定义允许项目、文件类别与数据处理。
为动作要求确认、沙箱与幂等。
限制超时与重试；清晰呈现限流错误。
跨环境版本化非上游密钥设置。
Test before broad workspace access广泛访问 Workspace 前测试
Use a disposable organization and repository first. Include representative source files, a synthetic secret, ignored paths and a harmless tool action so the test can reveal both over-collection and missing functionality without exposing production code.
先使用一次性组织与仓库。放入代表性源码、合成 Secret、应排除路径和无害工具动作，让测试既能发现过度收集，也能发现功能缺失，同时不暴露生产代码。
- Capture approved network telemetry and identify every service that receives prompts, context or tool metadata.
- Test long context, streaming, structured output, tool calls, cancellation and rate limits for the exact client feature.
- Confirm ignored files, secrets and terminal output are absent or redacted in accessible logs.
- Compare behavior with custom credentials enabled and disabled; note features that continue using the vendor service.
- Exercise endpoint rollback, session invalidation and key revocation, then verify old credentials no longer work.
- 采集经过批准的网络遥测，识别所有接收 Prompt、上下文或工具元数据的服务。
- 针对具体 Client 功能测试长上下文、流式输出、结构化输出、工具调用、取消与限流。
- 确认可访问日志中不存在被忽略文件、Secret 与终端输出，或这些内容已被脱敏。
- 比较启用与关闭自定义凭证时的行为，记录哪些功能仍使用厂商服务。
- 演练 Endpoint 回滚、Session 失效与 Key 撤销，并确认旧凭证不再可用。
Model the complete client-to-model path对完整的 Client 到模型路径建模
Document the actual sequence for each product and feature: editor client → vendor backend or context service → optional enterprise gateway → model provider. If the client supports an endpoint override, register an approved endpoint ID, scoped key and model alias rather than accepting arbitrary URLs. If the vendor backend remains in the path, include it explicitly in the security and data-processing review.
应按产品与功能记录真实顺序：Editor Client → 厂商后端或上下文服务 → 可选企业 Gateway → 模型供应商。如果 Client 支持 Endpoint Override，应登记批准的 Endpoint ID、受限 Key 与模型别名，而不是接受任意 URL；如果厂商后端仍在路径中，也必须明确纳入安全与数据处理审查。
At the gateway, validate identity, tenant, allowed model and feature before forwarding. Restrict redirects and private-network destinations, set bounded timeouts and response sizes, and keep safe route evidence without source code or secrets. Record which layer performed prompt construction, retrieval, model inference and tool execution so an incident can be traced to the correct operator.
Gateway 转发前应验证身份、租户、允许模型与功能，并限制 Redirect 和私有网络目标，设置有界超时与响应大小；安全日志只保留路由证据，不记录源码或 Secret。还要记录哪一层执行了 Prompt 构建、检索、模型推理与工具执行，以便事故发生时定位到正确运营方。
Production rule: never grant an unverified data path broad code and tool access at the same time.
生产规则：绝不能同时向未经验证的数据路径授予广泛代码与工具访问。
Separate coding tools from the model endpoint把编程工具与模型端点分离
QVeris can provide governed external APIs, tools, services and live data. Treat those calls as separate capabilities with scoped credentials, explicit schemas, approval requirements and action evidence instead of hiding them inside the model endpoint. A custom model key should never inherit repository write, deployment or ticket-system permissions.
QVeris 可提供治理化外部 API、工具、服务与实时数据。应把这些调用视为独立能力，分别设置受限凭证、明确 Schema、审批要求与动作证据，而不是隐藏在模型 Endpoint 内。自定义模型 Key 绝不能继承仓库写入、部署或工单系统权限。
Link model and capability calls with a parent trace while keeping separate action IDs and idempotency keys. Inspect the capability before use, validate returned evidence and require human approval for consequential writes. If the model path changes, re-test tool argument generation without automatically changing the tool's credential or policy.
模型与能力调用可通过父 Trace 关联，但应保持独立 Action ID 与幂等密钥。使用前检查能力，验证返回证据，并对重要写入要求人工审批。如果模型路径变化，应重新测试工具参数生成，但不能自动改变工具凭证或策略。
Verify the Cursor path before trusting the model picker在信任模型 Picker 前验证 Cursor 路径
Cursor documents BYOK for standard chat models and an --endpoint flag for Cursor CLI. Treat IDE BYOK, Cursor CLI, Tab Completion, and background agents as different products: a custom endpoint working in one path does not prove it powers the others.
Cursor 文档说明 BYOK 适用于标准 Chat 模型，Cursor CLI 另提供 --endpoint。应把 IDE BYOK、Cursor CLI、Tab Completion 与 Background 智能体视为不同产品；某一路径成功并不能证明其他路径也使用该端点。
# Keep the key out of shell history where your platform supports a secret store.
export CURSOR_API_KEY="<cursor-api-key>"
cursor-agent status
cursor-agent --endpoint "https://approved-cursor-endpoint.example" "Return exactly CURSOR_ENDPOINT_OK"
# Record the endpoint shown by status, request time, and resulting model path.- In Cursor Settings > Models, enter the supported provider key and click Verify.
- Confirm which features still use Cursor-hosted models before making compliance claims.
- Test certificate validation, model ID mapping, rate limits, and secret rotation on managed devices.
- 在 Cursor Settings > 模型中输入受支持供应商密钥并点击 Verify。
- 在做合规声明前确认哪些功能仍使用 Cursor 托管模型。
- 在受管设备上测试证书、模型 ID 映射、限流与上游密钥轮换。
Verified implementation reference: Cursor API keys.
实施参考已根据官方资料核验：Cursor API keys。
FAQ
Only after operator, data handling, host security and logging are approved.
No. Use a dedicated scoped credential with a limited lifetime and budget.
Restore known-good settings, stop tool access and revoke the custom key.
只有运营者、数据处理、主机地址安全与日志获批后才适合。
不应。使用限制生命周期与预算的独立受限凭证。
恢复已知可用设置、停止工具访问并撤销自定义密钥。