How to Use Cursor OIDC JWTs for Secure, Secretless Vault Access in Cloud Agents

Cursor cloud agents can authenticate with HashiCorp Vault using short-lived OIDC JWTs minted from a local Unix socket, eliminating the need for static, long-lived Vault tokens. The agent mints a JWT with a five-minute TTL by calling an internal socket endpoint, then exchanges it for a temporary Vault token lasting up to 30 minutes. Vault independently fetches Cursor's JWKS from api.cursor.com to validate the token, meaning no Cursor API callback is required from the Vault side. Vault's JWT auth backend can be configured via Terraform to bind roles to specific Cursor user IDs, team IDs, or repository URLs for fine-grained access control. This approach follows the same dynamic credentials pattern already used by HCP Terraform, leaving no persistent credentials in the agent environment after the run completes.