Microsoft is tightening NuGet.org credential policies with a hard deadline: starting August 17, 2026, new API keys will carry a 30-day maximum duration, and the 365-day option disappears entirely. All keys created before that cutoff expire on November 1, 2026. The change targets a specific class of supply-chain risk—long-lived credentials stored in repository secrets, CI/CD pipelines, or build configurations that become exploitable the moment they leak. The .NET team made the announcement explicit: “A NuGet.org API key is effectively a password for publishing packages,” and extended exposure turns a single disclosure into a prolonged compromise window.
The timing reflects concrete damage. In May 2026, attackers used stolen credentials to publish a malicious Nx Console extension within minutes of gaining access, and the .NET team cited the Nx Dev Team’s finding that the malicious package was activated 6,000 times in 36 minutes before removal. That postmortem shows how quickly a leaked publish credential translates into active user harm when long-lived secrets are involved.
Microsoft is pairing the key reduction with a push toward NuGet Trusted Publishing, a workflow launched in September 2025 that replaces static API keys with short-lived OpenID Connect tokens. In that model, a CI/CD system requests an encrypted OIDC token, nuget.org validates it against a policy configured by the package owner, and a temporary key is issued for that single publishing operation. The temporary keys expire after one hour and can be used only once. No long-lived secret is stored in source control or a secret manager, and there is no rotation burden on the publisher.
The practical impact splits into two groups. Package maintainers still using API keys need to inventory every workflow that publishes to nuget.org, flag keys created before August 17, 2026, and confirm that automation can rotate to 30-day credentials without breaking releases. They also need to verify that expiration notifications reach monitored accounts. Maintainers on GitHub Actions and GitLab can move to Trusted Publishing now; other CI/CD systems should confirm compatibility with shorter-lived keys and plan migration paths before the November deadline.
Package publishing through the nuget.org web interface remains available for manual scenarios. That preserves a fallback for environments where automation cannot yet adopt OIDC. The .NET team also warned that further API key duration reductions may follow, so treating the August 17 cap as a floor rather than a final state is prudent. Microsoft Learn documents the current Trusted Publishing flow and notes that the nuget.org rollout is gradual—not all accounts see the option immediately.
For readers managing .NET or other NuGet-based supply chains, the action items are concrete: audit existing keys, test short-lived credentials in staging, enable Trusted Publishing where supported, and delete any key that has been exposed. The reduction does not eliminate credential risk, but it compresses the attack window from months or years to days, which materially changes the cost-benefit calculus for an attacker.
- .NET Blog: Strengthening NuGet Supply Chain Security: Reducing API Key Lifetime
- Nx Blog: Postmortem: Nx Console v18.95.0 supply-chain compromise
- Microsoft Learn: Trusted Publishing
Related: Kraken API Partner Program Launches: Lifetime Commissions | 140+ Mastra npm Packages Hit in Supply Chain Attack
