In a significant move to enhance security, Microsoft is shortening the lifespan of NuGet.org API keys. This adjustment aims to fortify supply chain integrity and mitigate the risk of unauthorized usage of compromised credentials in publishing harmful .NET packages.
New API Key Policies Effective August 2026
Commencing August 17, 2026, all newly created NuGet.org API keys will be limited to a 30-day validity period. This change means that the option to generate API keys with a year-long lifespan will be discontinued. Moreover, API keys created prior to this date will see expiration by November 1, 2026.
API keys function similarly to passwords in the context of package publishing. Developers often save these keys within CI/CD platforms, repository settings, build servers, and deployment configurations. Although this facilitates automation, it simultaneously presents a lucrative target for cyber attackers.
Impact of Compromised Credentials
When a threat actor obtains a long-lasting key, they have the potential to distribute a compromised package under a reputable project name for months until the key expires. This new policy by Microsoft is part of a broader strategy to minimize software supply chain risks, aligning with actions taken by other ecosystems like npm.
Incidents of compromised credentials can have rapid and widespread impacts. For instance, the NX Console npm package incident saw malicious elements activated 6000 times within just 36 minutes of release. Such scenarios highlight the vulnerability and potential reach of exposed publishing credentials.
Transition to Trusted Publishing
While the new policy reduces the timeframe during which a stolen NuGet API key is exploitable, it does not completely negate the risks associated with reusable secrets. These can still be disclosed through code commits, CI/CD logs, or insecure storage.
Microsoft advocates for the transition to NuGet Trusted Publishing, launched in September 2025. This system leverages OpenID Connect (OIDC) to authenticate CI/CD workflows without storing long-term NuGet publishing keys. It utilizes signed, short-lived identity tokens for each package-publishing task, verified by NuGet.org under the package owner’s policy requirements.
This method eliminates the need for reusable API keys in repositories or secret stores, minimizing secret rotation effort and limiting credential exposure damage. Users of GitHub Actions and GitLab are urged to adopt Trusted Publishing ahead of the August deadline.
For maintainers unable to adopt OIDC, Microsoft advises auditing all NuGet publishing workflows, identifying pre-August keys, and ensuring support for 30-day credential rotations. Additionally, they should confine keys to essential package scopes and permissions, avoid embedding keys in code or logs, and promptly revoke any exposed credentials.
Microsoft indicates that API key lifespans may continue to decrease as Trusted Publishing support extends to further CI/CD environments.
