Microsoft's .NET team announced on 3 August 2026 that NuGet.org will cut API key lifetimes in two steps. From 17 August 2026, new keys are limited to 30 days and the 365-day option disappears. On 1 November 2026, every key created before 17 August expires. If a pipeline publishes packages with a stored key, it will break on that date unless you act.
The goal, in Microsoft's words, is to shrink how long a stolen or leaked key can publish malicious packages. The post is candid that this does not make API keys safe.
What's affected
- Anyone who publishes to NuGet.org with an API key: CI jobs, release scripts, developer machines.
- Keys created before 17 August 2026: valid until 1 November 2026, then dead.
- Manual publishing through the NuGet.org website is unchanged.
What to do now
- List every workflow that runs
dotnet nuget pushand note where its key is stored and when it was created.
grep -rn "nuget push\|NUGET_API_KEY" .github .gitlab-ci.yml azure-pipelines.yml 2>/dev/null
- On GitHub Actions or GitLab, migrate to NuGet Trusted Publishing, which launched in September 2025. A workflow presents a signed, short-lived OIDC token, NuGet.org checks it against a policy you set for repository, workflow and optional environment, and issues a temporary key for that single publish.
- Elsewhere, make sure your pipeline copes with a key that expires every 30 days, and that expiry emails reach a mailbox someone watches.
- Use the narrowest package scope for any key you keep, never write it to logs, and delete any that was exposed.
How this could have been avoided
Key theft is the problem this change reduces, not removes.
- Do not store a publishing secret at all. With trusted publishing there is no long-lived key in repository secrets to steal.
- Bind the policy to a workflow and environment, so a stolen identity token from another job cannot publish.
- Scope keys to the specific packages they need, so one leak cannot touch every package you own.
Quick check
What happens to a NuGet key created in June 2026?
It keeps working until 1 November 2026, when all keys created before 17 August expire.
