Microsoft is strengthening NuGet supply chain security by reducing the lifetime of API keys used to publish packages. Starting August 17, 2026, new NuGet API keys are limited to a maximum of 30 days, while Microsoft is encouraging developers to adopt Trusted Publishing for a more secure publishing workflow.

Here's what you need to know:

Why Is This Changing?
Long-lived API keys can give attackers extended access if they are exposed through repositories, build configurations, or CI/CD systems. Shortening credential lifetimes can help reduce the potential impact of a compromised key.
API Key Duration Is Changing
Starting 17 August 2026, new NuGet.org API keys will have a maximum duration of 30 days, with the 365-day option removed. Existing keys created before this date will expire on 1 November 2026, so package maintainers should review their publishing workflows now.
Consider .NET Trusted Publishing
Trusted Publishing uses OpenID Connect (OIDC) to authenticate CI/CD workflows without relying on long-lived publishing secrets. It provides short-lived credentials, workload identity validation, and automatic credential expiration—reducing the risks associated with reusable API keys.
What If You Still Use API Keys?
If your workflow isn’t ready to migrate, inventory your NuGet publishing workflows and update them to support shorter-lived keys. Use the narrowest permissions possible, never commit keys to source control or logs, and immediately revoke any exposed credentials.
Take Action Now
If you maintain NuGet packages, review your publishing setup and start planning your move to Trusted Publishing. For .NET teams using GitHub Actions or GitLab, now is a good time to begin the transition to a more secure publishing workflow.

Want secure, trusted custom business applications that complement your CRM and help your team work more efficiently? Contact us today and let’s talk!