New permission-based Cursor API keys run CLI and SDK agents again

Update, Oct 15, 5:36 AM ET: Fixed. Colin said "the change that fixes agent runs with the new permission-based API keys (the ones starting with grok_) is now live." He said cursor-agent -p with CURSOR_API_KEY set to the new key "should return KEY_OK," that Agent.create plus local runs in the SDK "should work with the same key," and "you no longer need the older key or the browser login workaround." The workarounds below are kept for the record. Our suggestion, not Colin's: once the new key works, revoke any older key you kept only for this.

New Cursor user API keys that grant "Run agents" and "Sign in to the Cursor CLI and SDK" could authenticate and list models, then failed every local agent run with Service Unavailable. On Oct 13 at 8:24 AM ET, Cursor staff member Colin said the team can see it: "agent runs started with the new permission-based keys are failing on our servers, while sign-in and model listing work." He flagged it to the team.

Why it matters#

People who rotated to a new key after moving to The X Subscription can lose unattended CLI and SDK agents even though cursor-agent about looks healthy.

How to use it#

Colin's workarounds (no longer needed after the Oct 15 fix):

1. Keep using an older API key for CLI and SDK runs, or
2. Sign in with the browser instead of the key: run cursor-agent login, then run your command without setting CURSOR_API_KEY.

My new permission-based CURSOR_API_KEY lists models but agent runs return Service Unavailable. Switch this session to cursor-agent login without CURSOR_API_KEY, or tell me to export my older key, then retry a one-line plan-mode prompt.

Eric_III reported the failure on Oct 13 after switching to The X Subscription (Premium): cursor-agent about and --list-models worked, then cursor-agent -p --mode plan returned NonRetriableError: Service Unavailable. An older key on the same account (no permissions shown on its page) still ran. Environment: cursor-agent 2026.10.01-e373342 on macOS.

We could not reproduce without a Cursor API key on this box.

Good to know#

• Status: Fixed, per staff on Oct 15 (5:36 AM ET). Was open from Oct 13; staff confirmed a server-side failure.
• First seen: Eric_III report Oct 13, 8:02 AM ET; staff 8:24 AM ET.
• Symptoms: New permission-based key authenticates; model list works; agent runs fail with Service Unavailable / HTTP 503. Older key works.
• Related context: Eric_III tied the key rotation to an X Subscription Premium switch the same day. Staff did not say the bug is limited to that plan.

What to watch#

Whether anyone in the thread reports new keys still failing after the fix.