Microsoft is implementing a significant change to bolster the security of its NuGet package management system by reducing the maximum validity period of NuGet.org API keys. This initiative aims to mitigate the risks associated with stolen credentials being exploited to distribute malicious .NET packages.
Effective August 17, 2026, all newly generated NuGet.org API keys will have a maximum lifespan of 30 days, a substantial decrease from the previous 365-day validity. Additionally, existing API keys created before this date are set to expire on November 1, 2026. This policy shift is designed to limit the window of opportunity for attackers who might gain unauthorized access to these keys.
API keys in NuGet function similarly to passwords, granting developers the ability to publish packages. These keys are often stored in various locations such as CI/CD platforms, repository settings, build servers, and deployment configurations to facilitate automated publishing processes. However, this widespread storage makes them attractive targets for cybercriminals. If an attacker acquires a long-lived API key, they could potentially publish compromised packages under trusted project names for extended periods before the credential expires.
Strengthening Supply Chain Security
This policy update is part of Microsoft’s broader strategy to enhance software supply chain security. Similar measures have been adopted by other package ecosystems, including npm, in response to incidents where stolen publishing credentials led to the dissemination of malicious packages. For instance, the NX Console npm package was compromised through stolen credentials, resulting in the malicious version being downloaded 6,000 times within just 36 minutes before its removal. Such events underscore the rapid and widespread impact that compromised credentials can have on software ecosystems.
By shortening the lifespan of NuGet API keys, Microsoft aims to reduce the duration during which a stolen key remains exploitable. However, the company acknowledges that this measure alone does not entirely eliminate the risks associated with reusable secrets. API keys can still be exposed through various means, including source code commits, CI/CD logs, insecure secret storage, or compromised developer systems.
Transitioning to Trusted Publishing
To further mitigate these risks, Microsoft recommends that package maintainers transition to NuGet Trusted Publishing, introduced in September 2025. Trusted Publishing leverages OpenID Connect (OIDC) to authenticate CI/CD workflows without the need for storing long-lived NuGet publishing keys. In this model, a supported CI/CD platform generates a signed, short-lived identity token during the package publishing process. NuGet.org then validates this token against a policy defined by the package owner, which may include repository, workflow, and environment details. Upon successful validation, a temporary API key is issued specifically for that publishing operation.
This approach eliminates the necessity of embedding reusable NuGet API keys in repositories or CI/CD secret stores, thereby reducing the workload associated with secret rotation and limiting the potential damage from credential exposure. Developers using platforms like GitHub Actions and GitLab are encouraged to adopt Trusted Publishing ahead of the August deadline.
For maintainers unable to implement OIDC-based publishing immediately, Microsoft advises auditing all NuGet publishing workflows, identifying API keys created before August 17, and updating automation processes to accommodate the new 30-day credential rotation policy. Additional recommendations include restricting API keys to the minimum required package scope and permissions, avoiding the inclusion of keys in code or logs, and promptly revoking any exposed credentials.
Microsoft has indicated that API key lifetimes may be further reduced in the future as NuGet continues to expand Trusted Publishing support across additional CI/CD environments.
This proactive measure by Microsoft reflects a growing industry trend towards enhancing software supply chain security. By reducing the validity period of API keys and promoting the adoption of more secure authentication methods like Trusted Publishing, Microsoft aims to minimize the risk of credential compromise and the subsequent distribution of malicious packages. Developers and organizations should prioritize updating their workflows to align with these new security protocols to safeguard their software supply chains effectively.
