NuGet.org plans to reduce the expiration period for new API keys to 30 days starting August 17, 2026, in a step that Microsoft says is intended to reduce the risks of credential theft and strengthen software package supply chain security. The platform will also remove the option to create new keys with a duration of 365 days, while all keys created before August 17 will expire on November 1, 2026.
Microsoft is asking everyone who publishes packages on NuGet.org to review their current publishing mechanisms before the change takes effect, particularly because an API key effectively functions as a password that permits package publication. If a long-lived key is stored as a secret in a repository, copied among multiple systems, or included in build settings, its exposure could give an attacker an extended period in which to publish unauthorized versions.
Key Duration Reduction Plan
The plan consists of two clear phases:
- August 17, 2026: Set the maximum duration for new keys to 30 days and discontinue the 365-day duration option.
- November 1, 2026: All keys created before August 17, 2026, will expire.
Microsoft explains that shortening the duration does not make API keys secure by themselves, but it reduces the period during which a lost or leaked key can be used. The company cited the compromise of the NX console package using stolen credentials; a malicious NX Console package was published and, according to the NX team, was activated 6,000 times within 36 minutes before it was removed.
Recommendation to Move to Trusted Publishing
Microsoft recommends using Trusted Publishing, a publishing mechanism launched in September 2025 that allows CI/CD workflows to authenticate to NuGet.org through OpenID Connect (OIDC). The workflow presents a short-lived, signed identity token, and NuGet.org verifies the token according to a policy defined by the package owner, then issues a temporary API key solely for the publishing operation.
Unlike retrieving a long-lived key from a secrets store, this mechanism does not require storing a long-lived publishing secret in the repository or CI/CD system. It also creates short-lived credentials and automatically invalidates them. The policy includes verifying the identity of the workload associated with the repository and workflow, with the option to add an environment. It also does not require user-managed secrets or manual rotation, and limits the impact of credential exposure.
Actions Required from Package Publishers
Publishers should inventory all publishing operations to NuGet.org, identify keys created before August 17, 2026, and update their automation to handle and rotate shorter-lived keys securely. The guidance also includes using the narrowest package scope and permissions necessary, not placing an API key in the code repository or logs, immediately deleting any lost or exposed key, and ensuring that expiration notifications reach a monitored account.
Microsoft is urging GitHub Actions and GitLab users to begin moving to Trusted Publishing, while users of other deployment environments should ensure that their workflows can use keys that expire within 30 days and prepare for the expiration of old keys on November 1. Publishing through the NuGet.org interface will remain available for manual scenarios. The company also said it will share updates with the community when support for additional CI/CD environments is added, noting that API key expiration periods may be reduced further in the future.