Continuous Refresh Token API Requests After Logout - Cursor.com

[Arun_Kumar_9034 (Arun Kumar)]

Where does the bug appear (feature/product)?

Somewhere else…

Describe the Bug

After logging out of Cursor and attempting to change the email address, the application gets into a continuous loop of requests to the refresh-token API.

The browser keeps sending repeated requests to the refresh-token endpoint without stopping. This continues until the API rate limit is reached, after which the API starts returning a Too many requests error.

Steps to Reproduce

Log in to Cursor.
Log out from the account.
Navigate to the account/email change flow.
Attempt to change the email address.
Open the browser’s Network tab.
Observe the requests being made to the refresh-token endpoint.

Actual Behavior

The application continuously sends requests to the refresh-token API in a loop.

The request pattern appears to repeatedly alternate between the login and refresh-token endpoints, with the refresh-token request receiving a 307 redirect.

Eventually, the rate limit is reached and the API returns:

{“code”:“too_many_requests”,“message”:“Too many requests. Please try again shortly.”}

Expected Behavior

After logout, the application should clear/expire the existing authentication state and should not continuously attempt to refresh an invalid or expired session.

If the refresh token is invalid or unavailable, the application should stop retrying and gracefully redirect the user to the login/authentication flow instead of creating an infinite request loop.

Screenshots / Screen Recordings

Operating System

Other

Version Information

Website Issue

Additional Information

The issue is consistently visible in the browser Network tab, where multiple refresh-token requests are generated continuously until the rate limit is exhausted.

I have attached screenshots showing:

The repeated refresh-token requests in the Network tab.
The Too many requests response after the rate limit is reached.

Please investigate the refresh-token retry/redirect logic after logout, particularly the interaction between the logged-out authentication state and the email-change flow.

Does this stop you from using Cursor

Yes - Cursor is unusable

[deanrie]

Hey, thanks for the detailed report and the screenshot. I can see both the request loop to refresh-token and the too_many_requests at the end.

First, about what you were trying to do. Cursor doesn’t have a separate email change flow. You can’t change the email on an existing account, especially if you sign in with Google. In that case, the email is tied to your Google account. If you need a different email, the only option is to create a new account with that email. Details here: Change your email address | Cursor Docs

Now about the loop. What you’re seeing is the session state after logout, and it’s not caused by your settings or your browser. It usually fixes itself after a fresh sign-in. Please sign in again in one clean attempt, and the loop should stop. If you still can’t sign in, clear cookies for the cursor.com domain or try signing in in a private window, then try again.

I’ve shared the loop with the team so we can review the post-logout logic. If you hit this state again, please send the exact sequence of pages where it happens, and let me know if signing in again helps. I’ll reply in the thread if there’s an update.