Microsoft Shortens NuGet API Key Lifespan to Bolster Supply Chain Security
Microsoft is reducing the validity of new NuGet.org API keys from one year to 30 days, effective August 17, 2026, to mitigate risks from exposed credentials.
Microsoft is implementing a significant security enhancement for its .NET package repository, NuGet.org, by drastically shortening the lifetime of newly generated API keys. Effective August 17, 2026, the validity period for these keys will be reduced from 365 days to just 30 days. This proactive measure aims to bolster the security of the software supply chain by minimizing the window of opportunity for attackers who might gain access to these sensitive credentials.
API keys for NuGet.org function as powerful authentication tokens, granting developers the ability to publish software packages to the public repository. The inherent risk lies in their potential exposure. If an API key is inadvertently stored in a public code repository, shared insecurely across systems, or embedded within automated build pipelines, it can be exploited by malicious actors. Such an exposure could allow an attacker to publish unauthorized or malicious updates to legitimate packages, a scenario that has become increasingly common and impactful in recent years.
Microsoft highlighted the severity of this risk by referencing a recent incident involving the NX Console NPM package. In that case, stolen credentials were used to publish a malicious version of the package, which was reportedly activated thousands of times within minutes before being taken down. The company emphasized that long-lived credentials, while convenient, significantly amplify the damage caused by accidental disclosures, underscoring the need for shorter key lifespans.
To address these risks, Microsoft is also strongly encouraging developers to migrate to a more secure authentication method: NuGet Trusted Publishing. Introduced in September 2025, Trusted Publishing replaces permanent API keys with OpenID Connect (OIDC) authentication. This system verifies publishing requests through OIDC, issues temporary API keys valid only for a single publishing session, and automatically invalidates them afterward. This approach effectively eliminates the need to store long-lived API keys in code repositories and CI/CD systems, ensuring that publishing actions originate from verified sources.
OpenID Connect (OIDC) is a crucial component of this modern authentication strategy. It acts as an identity layer built upon OAuth 2.0, enabling applications to verify the identity of users or services without requiring the sharing of passwords across multiple platforms. This enhances security by reducing the attack surface associated with credential management.
Developers who continue to rely on API keys are urged by Microsoft to take immediate action. They must identify all workflows that publish packages to NuGet.org and replace any keys created before the August 17, 2026, deadline. Keys created before this date will remain valid until November 1, 2026, after which they will be deactivated. Microsoft also advises implementing best practices such as limiting key permissions, avoiding storage in source code or logs, promptly deleting any exposed keys, and ensuring expiration notifications are sent to actively monitored accounts.
For those utilizing CI/CD platforms like GitHub Actions or GitLab, migration to Trusted Publishing is the recommended path. Developers on other platforms are advised to ensure their publishing workflows support the new 30-day API key expiration and to replace any long-lived keys before the November 1, 2026, cutoff. Microsoft has stated its commitment to expanding Trusted Publishing support to additional CI/CD platforms over time, signaling a clear industry shift away from static, long-lived credentials.