NuGet API Keys Get a Security Revamp as Microsoft Dials Back Lifetime

Microsoft is revamping its NuGet API key policy to enhance supply chain security. Starting August 17, 2026, new API keys will have a shorter lifetime of just 30 days, down from the current 365 days. This change aims to mitigate potential risks associated with API keys.

NuGet API keys function as passwords that allow developers to publish software packages on the NuGet.org repository for .NET developers. If an API key is compromised or exposed, malicious actors can use it to publish unauthorized package updates.

Microsoft cites the recent NX Console NPM package compromise as a prime example of the dangers of long-lived credentials. In that incident, a stolen API key was used to publish a malicious package 6,000 times in just 36 minutes before being taken down.