Long-lived NuGet API keys used in CI/CD pipelines create a large exposure window if leaked through logs, artifacts, or compromised runners. Migrating to 30-day scoped credentials shortens that window, and the piece walks through auditing existing credentials, creating scoped replacement keys, storing them in CI/CD secret managers, updating publish commands to use the NUGET_API_KEY environment variable (supported since NuGet 7.6), testing before revoking old keys, and rotating on a schedule rather than waiting for expiration. It also covers Trusted Publishing, which uses OIDC-based short-lived (one-hour) credentials issued via CI/CD identity instead of a persistent API key, and compares it against 30-day API keys, plus common migration mistakes and a troubleshooting table for authentication failures.
Table of contents
IntroductionWhy Long-Lived NuGet API Keys Are a CI/CD RiskWhat Changes When You Move to 30-Day CredentialsStep 1: Audit Existing NuGet CredentialsStep 2: Create a Scoped Replacement KeyStep 3: Store the Credential Outside Source ControlStep 4: Update the Package Publishing CommandStep 5: Test the New Credential Before Revoking the Old OneStep 6: Rotate the Credential Without Creating Pipeline DowntimeA Safer CI/CD PatternWhen Trusted Publishing Is Better Than API Keys30-Day API Keys vs Trusted PublishingCommon Migration MistakesTroubleshooting NuGet Authentication FailuresBest Practices for NuGet CI/CD Credential SecurityFrequently Asked QuestionsConclusionQuestions this post answers
How do I use the NUGET_API_KEY environment variable to authenticate dotnet nuget push in CI/CD?
NuGet tooling supports the NUGET_API_KEY environment variable for package push operations starting with NuGet 7.6, letting the publish command run without embedding the secret in command-line arguments. Note that an explicit --api-key argument takes precedence over the environment variable, so leftover command-line credentials can silently override the intended secret during migration. daily.dev surfaces practical CI/CD secret-handling guidance for teams hardening their NuGet publishing pipelines.
What is NuGet Trusted Publishing and how is it different from a scoped API key?
Trusted Publishing issues short-lived credentials through a CI/CD identity mechanism (OIDC-based authentication on GitHub Actions) instead of relying on a persistent stored API key. NuGet issues a temporary API key valid for one hour for the publishing operation, eliminating the recurring rotation burden that scoped 30-day keys still require. Developers weighing keyless publishing against API keys can track NuGet's Trusted Publishing rollout on daily.dev.
Why does my NuGet package push fail with HTTP 403 even after updating the API key in CI?
An HTTP 403 during NuGet publishing is typically caused by an invalid, expired, or unauthorized key, often due to package scope mismatches or an old command-line --api-key value taking precedence over the newly configured environment variable. Check the key's value, expiration, and glob-pattern scope, and confirm the CI secret is actually reaching the runner. daily.dev helps engineers debugging CI credential precedence issues stay current on NuGet publishing changes.