Skip to content

Cursor BYOK provider billing

Cursor BYOK contributes provider billing and usage-export rows for AI API usage that originates from Cursor bring-your-own-key (BYOK) workflows. With BYOK, the model provider bills you directly for model cost, so the provider’s record is the source of truth for model cost. On Cursor Teams and Enterprise plans, Cursor also charges its Cursor Token Rate of USD 0.25 per million tokens on every BYOK request, and that charge appears under Other Models in Cursor’s Spending tab. This connector reads only provider records, so it does not collect the Cursor Token Rate charge.

Onboarding scope

This guide covers the read-only cursor_byok connector in the Venturi platform connector package. It reads provider billing and usage records and never creates, rotates, or revokes provider keys.

Required access

The names below are Venturi capability identifiers, not provider scopes:

Venturi capability Purpose
provider_billing.readonly Read provider billing export rows.
provider_usage_metadata.readonly Read usage metadata needed for attribution context.

Where a provider offers read permissions for the selected reporting surface, do not grant key creation, key deletion, spend-limit mutation or provider administration permissions. The provider table distinguishes selectable OpenAI permissions from Anthropic reporting credentials with wider capability.

Supported sources are the billing and usage records of the providers Cursor accepts BYOK keys for: OpenAI, Anthropic, Google (Gemini API), Azure OpenAI, and Amazon Bedrock. Cursor lists them in its BYOK documentation. Connect each provider account first, using Provider setup. The vendor-side authorization is each provider’s own usage or billing credential:

Provider Usage or billing credential Read-only
OpenAI A dedicated API Platform organization Admin API key with only the required reporting read permissions. The organization owner selects permissions when creating it. This is distinct from a ChatGPT workspace Admin key; audit logging is not required for usage or cost reporting. See OpenAI’s Admin and Audit Logs API. Use the provider’s available read permissions and the connector endpoint allowlist.
Anthropic An Admin API key (sk-ant-admin...), or another Admin API credential, which the Usage and Cost API requires. The same credential manages organization members, workspaces, invites, and API keys. See Anthropic’s Usage and Cost API and Admin API. No
Google (Gemini API) Read access to your Cloud Billing export in BigQuery: roles/bigquery.dataViewer on the export dataset and roles/bigquery.jobUser on the project that runs the queries. See Cloud Billing export to BigQuery. Yes
Azure OpenAI The Cost Management Reader role at the subscription or resource group scope. See Assign access to Cost Management data. Yes
Amazon Bedrock Cost Explorer read access (ce:GetCostAndUsage), which the read-only role from AWS onboarding includes. See GetCostAndUsage. Yes

For either provider, create the reporting credential for Venturi alone, select the narrowest supported read permissions, store it only as an encrypted credential reference and rotate it on your provider schedule. The connector calls only the allowlisted usage and cost read endpoints. A credential that also permits administration still requires independent egress enforcement. Cursor’s separate Admin API supplies team usage and spending context but does not replace the provider bill. You never paste the capability names above into Cursor or a provider console.

Setup

  1. Enable provider billing or usage exports for the provider accounts whose keys Cursor BYOK uses.
  2. Create the usage or billing credential in the table above for each provider.
  3. Store each credential as an encrypted credential reference in Settings / Admin / Credentials.
  4. The default lookback is 24 hours. Set VENTURI_CURSOR_BYOK_LOOKBACK_HOURS to change it; see sync windows and failure behavior.
  5. In Venturi, go to Integrations / Cursor BYOK and run Test connection.

Verification

  • Test connection passes the read-only boundary check: billing and usage reads succeed, and the Google, Azure OpenAI, and Amazon Bedrock credentials cannot create, rotate, or revoke provider keys.
  • OpenAI and Anthropic Admin API keys, if connected, are dedicated to Venturi and appear only as encrypted credential references in Settings / Admin / Credentials.
  • Provider billing rows appear in the latest sync.
  • Usage metadata identifies the API product or service name where the provider exposes it.
  • A provider row qualifies as Cursor BYOK usage only when its user-agent metadata begins Cursor/; otherwise it remains ordinary provider usage.
  • Cursor BYOK usage joins to owner or team context only where matching evidence exists.

Rotation and offboarding

Rotate each provider credential on the provider account’s schedule, then update the credential reference in Settings / Admin / Credentials. Removing the connector stops new Cursor BYOK billing correlation.

Give feedback on this page

Sign in to send feedback. Opens in a new tab.

Copy page details 
Docs feedback: Cursor BYOK provider billing
Page: https://docs.venturi.systems/connectors/cursor-byok/