Cursor Usage Extension — Usage & Privacy

How it gets usage

• Reads your existing Cursor login token locally from Cursor’s globalStorage DB.
• Calls Cursor’s own HTTPS endpoints on cursor.com (the same APIs the dashboard uses):
• GET /api/auth/stripe + POST /api/dashboard/get-team-spend (team detection / IDs)
• GET /api/usage-summary?teamId=… (monthly $used / $limit)
• POST /api/dashboard/get-filtered-usage-events (per-event tokens/requests)
• POST /api/dashboard/get-daily-spend-by-category (spendType: 3, per-model spend)

Why it’s safe

• No PAT / API key is asked for or stored.
• No data is sent anywhere except cursor.com.
• The token stays on your machine and is only used as a cookie to Cursor; it is not logged, uploaded, or forwarded by the extension.