Back Feeds2.Feedburner

Microsoft shortens NuGet API key lifetime to improve supply chain security

Feeds2.Feedburner •Anamarija Pogorelec • August 4, 2026

Microsoft is reducing the lifetime of new NuGet.org API keys from 365 days to 30 days starting August 17, 2026, to improve the security of NuGet, its package repository for .NET developers. API keys created before August 17 will remain valid until November 1, after which developers will need to generate new keys or switch to NuGet Trusted Publishing. The change does not eliminate the risks associated with API keys, though it reduces the amount … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Reduces NuGet API Key Lifetime to Enhance Security Microsoft is implementing a significant change to the NuGet.org API key policy, reducing the validity of new API keys from 365 days to 30 days, effective August 17, 2026. This decision aims to enhance supply chain security and mitigate the risk of credential theft that could lead to the publication of malicious .NET packages. Existing API keys created before this date will remain valid until November 1, 2026, after which developers must generate new keys or utilize NuGet Trusted Publishing. While this change addresses some security concerns, it does not completely eliminate the risks associated with API keys. Developers are encouraged to adapt to the new policy to maintain the integrity of their packages and protect against potential threats. 2 sources 40

Extracted Entities

Domains (1)

nuget.org