Support HTTP Basic auth in API-key connections

Cursor's Admin API authenticates with the admin key as the HTTP
Basic auth username (empty password) and rejects Bearer tokens.
The API-key connection previously supported only Bearer and a
custom header (Anthropic's x-api-key); add a Basic-auth mode
selected by Registration.APIKeyBasicAuth, and reject providers
that set both it and APIKeyHeader.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/connector/provider/registry.go

@@ -71,6 +71,13 @@ func (r *Registry) Register(reg *Registration) error {
 		return fmt.Errorf("cannot register connector provider %q: missing DisplayName", reg.Provider)
 	}
 
+	// APIKeyBasicAuth and APIKeyHeader select different presentations of
+	// the same key; setting both is a programmer error with a silent
+	// winner (Client checks BasicAuth first). Reject it at startup.
+	if reg.APIKeyBasicAuth && reg.APIKeyHeader != "" {
+		return fmt.Errorf("cannot register connector provider %q: APIKeyBasicAuth and APIKeyHeader are mutually exclusive", reg.Provider)
+	}
+
 	r.mu.Lock()
 	defer r.mu.Unlock()
 
@@ -132,6 +139,18 @@ func (r *Registry) APIKeyHeader(p coredata.ConnectorProvider) string {
 	return ""
 }
 
+// APIKeyUsesBasicAuth reports whether an API-key connection for the
+// given provider must present its key as an HTTP Basic auth username
+// (empty password) instead of a Bearer token. Returns false for unknown
+// providers and for providers that use the default Bearer scheme.
+func (r *Registry) APIKeyUsesBasicAuth(p coredata.ConnectorProvider) bool {
+	if reg, ok := r.Get(p); ok {
+		return reg.APIKeyBasicAuth
+	}
+
+	return false
+}
+
 // ProviderOAuth2Scopes returns the OAuth2 scopes the access review
 // driver for the given provider needs to list user accounts. Returns
 // nil for providers that do not need any scopes (Notion, Intercom)

pkg/connector/provider/registry_test.go

@@ -81,6 +81,20 @@ func TestRegistry_Register(t *testing.T) {
 		assert.Contains(t, err.Error(), "missing DisplayName")
 	})
 
+	t.Run("APIKeyBasicAuth and APIKeyHeader mutually exclusive", func(t *testing.T) {
+		t.Parallel()
+
+		r := provider.NewRegistry()
+		err := r.Register(&provider.Registration{
+			Provider:        coredata.ConnectorProviderSlack,
+			DisplayName:     "Slack",
+			APIKeyBasicAuth: true,
+			APIKeyHeader:    "x-api-key",
+		})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "mutually exclusive")
+	})
+
 	t.Run("duplicate registration", func(t *testing.T) {
 		t.Parallel()
 

pkg/connector/provider/types.go

@@ -63,6 +63,13 @@ type Registration struct {
 	// (Anthropic). It is consumed when the create-connector resolver
 	// builds the APIKeyConnection.
 	APIKeyHeader string
+	// APIKeyBasicAuth, when true, presents the API key as the username
+	// of an HTTP Basic credential with an empty password instead of a
+	// Bearer token — required by providers such as Cursor whose Admin
+	// API documents `-u <key>:` Basic auth. Mutually exclusive with
+	// APIKeyHeader. Consumed when the create-connector resolver builds
+	// the APIKeyConnection.
+	APIKeyBasicAuth bool
 
 	// Factory closures — wired by Stages 2 and 3.
 	NewDriver               func(context.Context, *http.Client, *coredata.Connector, *log.Logger) (drivers.Driver, error)