Microsoft Cuts NuGet API Key Lifetimes to 30 Days

Microsoft is shortening NuGet API key lifetimes to strengthen software supply-chain security and reduce the damage caused by stolen publishing credentials.

NuGet is Microsoft’s package manager for the .NET ecosystem. Developers use it to install, manage, and distribute reusable libraries across .NET projects.

New NuGet API keys will expire after 30 days

Starting August 17, 2026, all newly created NuGet.org API keys will expire after 30 days.

Microsoft will also retire existing credentials. API keys created before August 17 will remain valid only until November 1, 2026.

The company said the shorter NuGet API key lifetimes will reduce the time attackers can use exposed or stolen credentials to publish compromised packages.

Publishers that continue using API keys will need to rotate them more frequently. Development teams should update automated workflows and confirm that expired credentials can be replaced without disrupting package releases.

Microsoft also recommends limiting every key to the packages and permissions required for its publishing task.

Microsoft recommends Trusted Publishing

Microsoft wants developers to replace traditional API keys with NuGet Trusted Publishing whenever possible.

Trusted Publishing uses OpenID Connect authentication and short-lived identity tokens. NuGet validates each token against predefined policies before issuing temporary publishing credentials.

GitHub Actions and GitLab publishing workflows already support the system. This approach removes the need to store reusable API keys inside repositories, workflow settings, or other development systems.

Developers who publish packages manually can use the NuGet.org web interface instead of maintaining a long-lived credential for occasional releases.

Stolen credentials remain a supply-chain risk

Microsoft cited the compromise of the NX Console npm package as an example of how quickly attackers can abuse publishing access.

Attackers used compromised credentials to release a malicious package update. The altered package reportedly activated around 6,000 times within 36 minutes before its removal.

Short-lived credentials cannot prevent every attack, but they can reduce the period during which stolen access remains useful.

In other security news, Microsoft is struggling to fix bugs found by Anthropic’s Claude Mythos. The company has also released the MAI-Cyber-1-Flash security model to improve vulnerability discovery while lowering operational costs.