● Covered by 1 source · 1 reportMedium impact1 neutral
NuGet.org to Limit API Key Lifetimes to 30 Days Starting August 2026
Key points
- New NuGet API keys will be limited to 30 days starting August 17, 2026.
- Existing API keys created before August 17, 2026, will expire on November 1, 2026.
- The 365-day API key duration option will be removed.
- NuGet recommends migrating to Trusted Publishing, launched September 2025.
API Key Lifetime Reduction
NuGet.org is implementing changes to API key lifetimes to enhance supply chain security. Beginning August 17, 2026, all newly generated API keys will have a maximum duration of 30 days. The option for a 365-day duration will no longer be available for new keys. Furthermore, all API keys created before August 17, 2026, will be set to expire on November 1, 2026.
Rationale for the Change
This policy update addresses the security risks associated with long-lived API keys, which function as publishing passwords. If a long-lived key is exposed, it provides attackers with an extended period to publish unauthorized package versions. The change aims to mitigate the impact of accidental credential disclosure, as demonstrated by recent compromises in other package ecosystems, such as the NX console NPM package incident where stolen credentials were used to publish a malicious version.
Recommended Publishing Workflow
Developers who publish packages to NuGet.org are advised to review their current publishing workflows. NuGet strongly recommends transitioning to NuGet Trusted Publishing, a modern workflow introduced in September 2025. Trusted Publishing utilizes OpenID Connect (OIDC) to authenticate CI/CD pipelines, providing a signed, short-lived identity token for publishing, which enhances security compared to traditional API keys.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
NuGet.org will restrict new API keys to a 30-day maximum duration starting August 17, 2026, and all existing keys will expire by November 1, 2026. This change aims to reduce the risk of supply chain attacks by limiting the window of opportunity for attackers if credentials are compromised.