Hey, I’ll answer point by point:
-
We don’t publicly publish static egress IPs for BYOK or custom Base URL. The pool on this path isn’t static and it’s not in
cursor.com/docs/ips.json. That file only listscloudAgentsandgitEgressProxy, and those aren’t related to BYOK traffic. -
We can’t share IP ranges for the same reason. There’s no public guarantee these addresses stay stable, so you shouldn’t rely on them for production allowlisting.
-
Recommended approach is app level auth, not network level:
- a strong API key or bearer token in the Authorization header (you already have this)
- optional mTLS between Cursor backend and your proxy
- rate limiting and audit logs on the proxy side
The flow Cursor IDE → Cursor Server → your LLM proxy is by design. The final request is built on our backend, so your proxy will always see Cursor server IPs, not the user’s IP.
-
Docs wise, there’s currently no public table of egress IPs specifically for BYOK. Static egress routing for custom models is being worked on internally, mostly for enterprise scenarios, but I can’t share an ETA or public availability. If and when it ships, it’ll show up in
ips.jsonand in Network Configuration | Cursor Docs.
Related threads for context: Using local model with cursor, Use on-prem model.