Microsoft Hardens NuGet Security with Shorter API Key Lifespans

Key Takeaways

• Microsoft is significantly shortening the lifespan of NuGet.org API keys to enhance software supply chain security.
• Effective August 17, 2026, new API keys will be valid for a maximum of 30 days, down from 365 days, and all existing keys will expire by November 1, 2026.
• This measure aims to mitigate the risk of malicious package injection by limiting the window of opportunity for attackers exploiting stolen credentials.
• Package maintainers are strongly encouraged to adopt NuGet Trusted Publishing, an OpenID Connect (OIDC)-based authentication method, for improved security.

Microsoft Bolsters NuGet Security with Reduced API Key Lifespans

Microsoft has announced a critical policy change for NuGet.org, drastically shortening the validity period of API keys. This strategic move is designed to fortify the software supply chain against credential theft and the subsequent publication of malicious .NET packages.

Beginning August 17, 2026, all newly generated NuGet.org API keys will be capped at a 30-day lifespan. This change eliminates the previous option for publishers to create keys valid for 365 days. Furthermore, any API key established before August 17, 2026, will automatically become invalid by November 1, 2026.

NuGet API keys function as authentication tokens for publishing packages, akin to passwords. Developers frequently embed these keys as secrets within CI/CD platforms, repository configurations, build servers, and deployment scripts to facilitate automated publishing workflows. While convenient, this practice creates attractive targets for adversaries.

Should a long-lived key fall into the wrong hands, an attacker could potentially publish a compromised package under a reputable project name for an extended period, until the credential eventually expires.

Strengthening the Software Supply Chain

Microsoft stated that this policy is an integral part of its broader initiative to mitigate risks within the software supply chain. Other prominent package ecosystems, such as npm, have implemented similar security enhancements. The company highlighted recent incidents involving package compromises due to stolen publishing credentials as clear examples of the potential impact of such vulnerabilities.

A single compromised package can rapidly proliferate throughout a vast network of downstream developers and organizations. A notable incident involved the NX Console npm package, where attackers reportedly leveraged stolen credentials to release a malicious version. This malicious package was activated approximately 6,000 times within a mere 36 minutes before its removal, underscoring how a single exposed publishing credential can have widespread implications across a software ecosystem.

While the new policy will reduce the duration an illicitly obtained NuGet API key remains active, Microsoft warned that shorter expiration periods do not completely eradicate the inherent risks associated with reusable secrets. API keys can still be exposed through various vectors, including accidental commits to source code, CI/CD logs, insecure secret storage practices, or compromised developer workstations.

To address these persistent threats, Microsoft strongly advises package maintainers to transition to NuGet Trusted Publishing, a feature launched in September 2025. Trusted Publishing leverages OpenID Connect (OIDC) to authenticate CI/CD workflows without requiring the persistent storage of a long-lived NuGet publishing key.

Under this OIDC-based model, a supported CI/CD platform generates a signed, ephemeral identity token during a package publishing job. NuGet.org then validates this token against a predefined policy established by the package owner, which can include specific repository, workflow, and optional environment details. Upon successful validation, a temporary API key is issued solely for that particular publishing operation.

This streamlined workflow eliminates the necessity of embedding a reusable NuGet API key within a repository or CI/CD secret store. It also reduces the burden of secret rotation and significantly limits the potential damage from a credential exposure. Microsoft encourages users of GitHub Actions and GitLab to migrate to Trusted Publishing well in advance of the August 2026 deadline.

For maintainers who are currently unable to adopt OIDC-based publishing, Microsoft recommends a thorough audit of all existing NuGet publishing workflows. This audit should identify keys created prior to August 17, 2026, and update automation processes to accommodate a 30-day credential rotation cycle.

Furthermore, maintainers should restrict API keys to the minimal necessary package scope and permissions, avoid embedding keys directly in code or logs, and immediately revoke any credential suspected of being exposed.

Microsoft indicated that API key lifetimes may be further curtailed in the future as NuGet expands Trusted Publishing support across additional CI/CD environments.

What You Should Do

• Adopt NuGet Trusted Publishing: Prioritize migrating your CI/CD workflows to NuGet Trusted Publishing, especially if you use GitHub Actions or GitLab. This OIDC-based solution offers the highest level of security by eliminating the need for long-lived API keys.
• Audit Existing API Keys: Immediately review all NuGet publishing workflows and identify API keys created before August 17, 2026. These keys will expire on November 1, 2026.
• Implement 30-Day Rotation: For workflows not yet transitioned to Trusted Publishing, update your automation to support a 30-day rotation cycle for all NuGet API keys to comply with the new policy.
• Apply Principle of Least Privilege: Ensure all API keys are restricted to the absolute minimum required package scope and permissions necessary for their function.
• Secure Secret Storage: Never hardcode API keys directly into source code or expose them in logs. Utilize secure secret management solutions provided by your CI/CD platform or cloud provider.
• Immediate Revocation: Develop a robust process for immediate revocation of any NuGet API key that is suspected of being compromised or exposed.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.