Developer 8 min read

Can’t Connect to Cursor AI Server? Complete Troubleshooting Guide

The “Cannot connect to Cursor server” error appears when Cursor can’t reach its AI backend. The cause is almost always one of four things: a live outage, an expired session, a firewall block, or an HTTP/2 proxy incompatibility. This guide walks through each fix in order of likelihood.

Cursor routes AI requests through both Anthropic and OpenAI. If either provider is degraded, Cursor AI features may fail even when Cursor’s own infrastructure is Operational.

Quick diagnosis: what does the error say?

Cannot connect to server — network block or outage. Start with Step 1.

Invalid API key — bad or expired key / session. Start with Step 2 or Step 3.

Connection timeout — proxy or firewall filtering. Start with Step 4.

Authentication failed — session expired. Start with Step 2.

SSL certificate error — corporate SSL inspection. Start with Step 5.

Step 1: Check if Cursor is down

Before changing any settings, rule out a service-wide outage. If Cursor’s backend is down, no local fix will work — you just have to wait.

1

Visit prismix.dev/service/cursor — live status updated every 5 minutes.

2

Also check prismix.dev/service/anthropic and prismix.dev/service/openai — Cursor proxies requests to both.

3

Inside Cursor: Help → Run Network Diagnostics. This pings each endpoint and tells you exactly which domain is unreachable.

Step 2: Sign out and re-authenticate

Cursor uses short-lived session tokens. When one expires, the AI backend rejects requests with “Authentication failed” or a generic connection error. This is the fix for most users who were connected yesterday but aren’t today.

  1. Open Cursor Settings → Account
  2. Click Sign Out and confirm
  3. Sign back in with the same account
  4. Press Ctrl+Shift+PReload Window
  5. Verify your subscription is Active at cursor.com/settings

Step 3: Fix “Invalid API key” in Bring-Your-Own-Key mode

If you configured Cursor to use your own OpenAI or Anthropic API key (BYOK mode), the “Invalid API key” error means the key is wrong, expired, or lacks credit. Steps to fix:

  1. Go to Cursor Settings → Models
  2. Delete the existing key and generate a fresh one from your provider’s dashboard
  3. For OpenAI: platform.openai.com/api-keys — confirm billing is active
  4. For Anthropic: console.anthropic.com/settings/keys — confirm you have remaining credits
  5. Paste the new key and click Verify

You can quickly test an Anthropic key from the terminal:

# Test Anthropic key validity
curl https://api.anthropic.com/v1/messages \
  -H "x-api-key: YOUR_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "content-type: application/json" \
  -d '{"model":"claude-3-haiku-20240307","max_tokens":16,"messages":[{"role":"user","content":"ping"}]}'

# Expected: {"id":"msg_...","type":"message",...}
# Error: {"type":"error","error":{"type":"authentication_error",...}}
# Test OpenAI key validity
curl https://api.openai.com/v1/models \
  -H "Authorization: Bearer YOUR_API_KEY"

# Expected: {"object":"list","data":[...]}
# Error 401: {"error":{"message":"Incorrect API key provided",...}}

Step 4: Fix HTTP/2 proxy incompatibility

Cursor uses HTTP/2 for streaming AI responses. Many corporate proxies — including older Squid and Zscaler deployments — do not support HTTP/2 and silently drop the connections, producing “connection timeout” or “stream error” messages.

Force Cursor to use HTTP/1.1 by adding this to your settings.json (Ctrl+Shift+POpen User Settings (JSON)):

{
  "cursor.http.httpVersion": "http1.1",
  "cursor.general.gitStrictHostKeyChecking": false
}

After saving, reload the window (Ctrl+Shift+PReload Window). If Cursor then connects, your proxy was the culprit. Report the domain to your IT team so they can add an HTTP/2 exception for *.cursor.sh.

Step 5: Allowlist Cursor domains in your firewall or proxy

Corporate firewalls, DNS filters (Cisco Umbrella, Cloudflare Gateway), and VPNs frequently block AI tool domains by category. Share this list with your IT administrator:

# Cursor required domains — add to proxy/firewall allowlist
cursor_domains:
  - cursor.sh
  - "*.cursor.sh"          # covers api.cursor.sh, auth.cursor.sh, etc.
  - cursor-cdn.anysphere.inc

# AI model backends Cursor routes through
ai_backends:
  - api.anthropic.com      # Claude models
  - api.openai.com         # GPT-4o, GPT-4-turbo
  - "*.openai.com"

# Authentication and telemetry
auth:
  - auth0.cursor.sh
  - sentry.io              # optional: crash reporting

If your proxy requires an explicit HTTPS_PROXY setting, configure it via the environment variable before launching Cursor:

# Windows — set before launching Cursor
set HTTPS_PROXY=http://proxy.company.com:8080
set HTTP_PROXY=http://proxy.company.com:8080
set NO_PROXY=localhost,127.0.0.1

# macOS / Linux
export HTTPS_PROXY=http://proxy.company.com:8080
export HTTP_PROXY=http://proxy.company.com:8080
export NO_PROXY=localhost,127.0.0.1

# Then launch Cursor from the same terminal session
cursor .

SSL inspection note

If your network performs deep SSL/TLS inspection (common with Zscaler, Netskope, Palo Alto SSL Decryption), Cursor’s certificate pinning may reject the intercepted certificate. Ask IT to either exclude *.cursor.sh and api.anthropic.com from SSL inspection, or distribute the corporate root CA so Cursor trusts it via the NODE_EXTRA_CA_CERTS environment variable:

export NODE_EXTRA_CA_CERTS=/path/to/corporate-root-ca.pem

Step 6: Run Cursor’s built-in network diagnostics

Cursor ships a diagnostic tool that tests every endpoint it depends on and outputs a structured report — useful for a support ticket or for showing your IT team exactly what is blocked.

  1. Inside Cursor, open the Command Palette: Ctrl+Shift+P (Windows/Linux) or Cmd+Shift+P (Mac)
  2. Type Network Diagnostics and select Cursor: Run Network Diagnostics
  3. A panel opens showing ping results for each domain, HTTP status codes, and latency
  4. Any domain showing FAILED or TIMEOUT is being blocked

You can also run a quick connectivity test manually to cross-check:

# Test Cursor backend reachability
curl -v --max-time 10 https://api.cursor.sh/health 2>&1 | grep -E "Connected|SSL|HTTP|curl"

# Test Anthropic backend
curl -I --max-time 10 https://api.anthropic.com

# Test OpenAI backend
curl -I --max-time 10 https://api.openai.com

# Check if HTTP/2 is being used
curl -v --http2 https://api.cursor.sh 2>&1 | grep "Using HTTP"

Last resort: switch to Bring-Your-Own-Key mode

If Cursor’s own backend is still blocked after allowlisting, you can bypass it by providing your own API key directly. Cursor then contacts Anthropic or OpenAI directly — which may be on a different network path your firewall allows.

  1. Cursor Settings → Models
  2. Toggle OpenAI API Key or Anthropic API Key
  3. Paste your key and click Verify
  4. Select a model your key has access to (e.g., claude-3-5-sonnet-20241022)

Note: BYOK mode bills against your own API account, separate from your Cursor subscription.

Frequently asked questions

Why does Cursor say “Cannot connect to server”?

Cursor shows this when it cannot reach api.cursor.sh. The five most common causes are: a live service outage, an expired authentication session, a firewall or DNS filter blocking cursor.sh, an HTTP/2-incompatible corporate proxy, and SSL inspection breaking the TLS handshake.

How do I fix “Invalid API key” in Cursor?

If you’re on a Cursor subscription (not BYOK), sign out and back in — your session token is the “key” in this context. If you’re in BYOK mode, generate a fresh key at platform.openai.com/api-keys or console.anthropic.com/settings/keys and paste it into Settings → Models.

Is HTTP/2 incompatibility blocking my Cursor connection?

Yes — this is one of the most common corporate network issues. Add "cursor.http.httpVersion": "http1.1" to your settings.json to force HTTP/1.1. If that fixes it, ask your IT team to add an HTTP/2 exception for *.cursor.sh on the proxy.

How do I allow Cursor through my firewall and corporate proxy?

Add cursor.sh, *.cursor.sh, cursor-cdn.anysphere.inc, api.anthropic.com, and api.openai.com to your allowlist. If SSL inspection is active, exclude those domains from interception or set NODE_EXTRA_CA_CERTS to your corporate root CA path.

🔔

Know the moment Cursor recovers from an outage

Check Cursor status on Prismix — live updates every 5 minutes, free email alerts when status changes, 30-day uptime history.