{
  "id": 6582836,
  "title": "Publishing .NET Packages to NuGet.org with an API Key",
  "url": "https://urgent.news/2026/09/10/publishing-net-packages-to-nuget-org-with-an-api-key",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-10T12:00:55.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/loach2009/publishing-net-packages-to-nugetorg-with-an-api-key-37n5"
  },
  "original_language": "en",
  "account": "Publishing .NET packages to NuGet.org using an API key streamlines the process and reduces the need for manual steps. However, maintaining the security of this key is crucial. Once the package is built and the .nupkg file is generated, a NuGet API key must be created on NuGet.org. This key should be limited in scope, with an expiration date and restricted to the Push scope. The key should never be stored in source code or committed to a Git repository. Instead, it should be treated like a password and securely managed. When automating the publishing process through CI/CD, the key can be safely stored as a repository secret in GitHub Actions. This allows the CI job to access the key while keeping it external to the repository. Additionally, the --skip-duplicate option can be used in the `dotnet nuget push` command to avoid conflicts if the same package version is already published. For GitHub Actions, the API key should be stored as a secret and referenced in the workflow. It's also recommended to narrow the permissions of the publishing key, if possible, to a specific package family. This limits the potential damage if the key is compromised. By following these best practices, the process of publishing .NET packages to NuGet.org becomes more efficient and secure.",
  "summary": "Publishing a .NET library manually is fine once or twice, but it becomes tedious when releases are frequent or automated through CI/CD. The standard solution is to push packages to NuGet.org with dotnet nuget push and an API key. This article covers the basic flow and the most important security consideration: never commit the API key into the repository . Prerequisites You need: a .NET project a…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}