Admin API key returns "Invalid Team API Key" (not an auth-encoding issue — already verified)

Support Help
1

Hi Cursor team,

I’m trying to use the Team Admin API to pull our spend/usage data programmatically, and every API key I generate is rejected.

What I did:

  • Generated an Admin API key from the team’s dashboard settings, scope admin:* (“Admin” — the only option available to me).
  • Call the API using HTTP Basic Auth with the key as the username and an empty password: Authorization: Basic base64(API_KEY + “:”) — exactly as documented at Admin API | Cursor Docs.

What’s failing:
Every request — including the simplest one, GET /teams/members — returns:

401 Unauthorized
{“code”:“error”,“message”:“Invalid Team API Key”}

This happens immediately on a freshly generated key, and happened again after I revoked it and generated a second one. Same result both times.

I’ve already ruled out the known encoding pitfall (I saw the forum thread about btoa(KEY+‘:’) — our implementation already does exactly that, byte for byte; I re-verified it directly against the live API before writing this). The error we get is the distinct “Invalid Team API Key” message, not a generic auth-parsing failure, which suggests Cursor’s server is evaluating and rejecting the key itself rather than failing to parse the header.

My question: Is Admin API access actually enabled for our team’s plan? Or is there a role requirement (e.g., only the team owner, not an admin, can generate a working key) that isn’t surfaced by the key-creation UI?

Key prefix for reference: crsr…6bb5 (not sharing the full key)
Timestamps of both failed attempts: [fill in]

Thanks for your help.

5

Hey @support_guy, thanks for the details, this helped us pin it down quickly.

The keys you generated are personal API keys, not team Admin API keys. Both use the same crsr_ format, and the dashboard unhelpfully shows “Admin” as the scope on personal keys, which is misleading (sorry about that, we’ve flagged it). Personal keys work for the Cloud Agents API, but the Admin API endpoints like /teams/members only accept team API keys, which is why you get “Invalid Team API Key”.

Team Admin API keys can only be created by a team admin, from Dashboard → API Keys → Team tab. Your account is a member on the team rather than an admin, so that tab isn’t available to you.

To get unblocked, ask one of your Cursor admins to either create a team Admin API key for your integration, or grant you the admin role so you can create one yourself. Your existing Basic auth code should then work as is.