Microsoft shortens NuGet API key lifetime to improve supply chain security
Microsoft is reducing the lifetime of new NuGet.org API keys from 365 days to 30 days starting August 17, 2026, to improve the security of NuGet, its package repository for .NET developers. API keys created before August 17 will remain valid until November 1, after which developers will need to generate new keys or switch to NuGet Trusted Publishing.
The change does not eliminate the risks associated with API keys, though it reduces the amount of time a stolen key can be used if exposed.
Why Microsoft is making the change
A NuGet.org API key functions like a password that allows developers to publish software packages. If a key is stored in a code repository, shared between systems, or included in an automated build pipeline, anyone who obtains it could publish malicious or unauthorized package updates.
“Long-lived credentials are convenient, but they also significantly increase the impact of accidental disclosure. The NX Console NPM package was recently compromised using stolen credentials. The attacker published a malicious NX Console package using the stolen credentials. According to the NX Dev Team, the package was activated 6,000 times in 36 minutes before it was taken down. Other similar attacks have had a much wider blast radius,” Microsoft explained.
How Trusted Publishing works
Trusted Publishing, introduced in September 2025, replaces permanent API keys with OpenID Connect (OIDC) authentication. It verifies publishing requests through OIDC, issues a temporary API key for that publishing session, and automatically invalidates it afterward. The approach eliminates long-lived API keys from code repositories and CI/CD systems, verifies that publishing requests originate from approved sources, and aligns with the industry’s move toward keyless publishing.
OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0. It allows an application to verify the identity of a user or service without requiring passwords to be shared with every website or service involved.
What developers need to do
Developers who continue using API keys should identify every workflow that publishes packages to NuGet.org and replace any keys created before August 17, 2026. Microsoft also recommends limiting each key’s permissions, avoiding storing keys in source code or logs, deleting exposed keys immediately, and ensuring expiration notices are sent to an actively monitored account. Manual package publishing through the NuGet.org website will remain available.
Microsoft recommends developers using GitHub Actions or GitLab migrate to Trusted Publishing as soon as possible. Those using other CI/CD platforms should ensure their publishing workflows support API keys that expire every 30 days and replace any remaining long-lived keys before November 1, 2026. The company says it will expand Trusted Publishing support to additional CI/CD platforms over time.