Does NuGet Recover From Expired Feed Credentials During Non-Interactive CI Restores?

Question

Private feeds such as Azure Artifacts authenticate through static credentials in NuGet.config or through credential provider plugins such as the Azure Artifacts Credential Provider, which acquires short-lived Microsoft Entra ID tokens. Least-privilege guidance favors narrow scopes: read-only access for restore, package-scoped API keys for push.

The unresolved point is expiry. NuGet does not refresh static NuGet.config credentials, so an expired entry surfaces as 401 Unauthorized during restore and keeps failing until the file is edited. Credential providers can re-acquire tokens, but how reliably that happens in a non-interactive CI run is unclear, and NuGet's per-session credential cache may keep serving stale failures after the credential is renewed. Behavior also differs across dotnet CLI, NuGet.exe, and Visual Studio.

For an unattended restore-only pipeline, the trade-off is a long-lived narrowly scoped credential that will eventually expire versus a provider-based short-lived token whose silent renewal in headless environments still needs verification against current NuGet clients.

Does the Azure Artifacts Credential Provider silently re-acquire an expired token during a non-interactive dotnet restore, or does the build fail until fresh credentials are supplied?
After a credential is renewed, can NuGet's cached session state keep returning 401 until the build process restarts?
Can restore and push be bound to separate credentials for the same feed URL, or does per-source credential mapping force one identity?

Tasadduq Burney · Answer

Direct Answer
The Azure Artifacts Credential Provider cannot silently recover from an expired identity (such as an expired Service Principal secret or PAT) during a non-interactive restore; it will fail with a 401 Unauthorized error. However, it can silently refresh a short-lived access token if the underlying identity remains valid and the provider is correctly configured for headless environments.

Credential Recovery vs. Identity Expiry
It is critical to distinguish between the access token and the identity credential:

Access Tokens (Short-lived): The Credential Provider manages these. If a token expires during a session, the provider attempts to acquire a new one using the provided identity. In non-interactive CI, this succeeds only if the VSS_NUGET_EXTERNAL_FEED_ENDPOINTS environment variable or a valid Service Principal is present.
Identity Credentials (Long-lived): If the PAT or Client Secret itself expires, the provider has no mechanism to "renew" it. The restore will fail until a new secret is updated in the CI secrets store or NuGet.config.

Session Caching and 401s
NuGet generally relies on the provider to handle the handshake. If a provider successfully refreshes a token, NuGet uses the updated credential for subsequent requests. However, if the provider fails and returns a 401, some versions of the dotnet CLI may cache the failure state for the duration of the process. In these cases, the build process must be restarted after the credential is fixed to clear the session state.

Mapping Restore and Push Identities
NuGet maps credentials to the source URL. You cannot bind two different identities to the same feed URL simultaneously within a single session. To use a read-only identity for restore and a write-identity for push on the same feed, you must either:

Update the credential context between the restore and push steps.
Use a single identity that possesses both Project Contributor (push) and Reader (restore) permissions.

Verification Steps for CI
To ensure your headless environment is configured for silent renewal, verify the following:

Plugin Path: Ensure NUGET_PLUGIN_PATHS is set to the directory containing the Azure Artifacts Credential Provider.
Non-Interactive Mode: Ensure the provider is not attempting to trigger a browser-based OAuth flow, which will cause the build to hang or fail in CI.
Log Analysis: Check for 401 Unauthorized (expired/invalid credentials) versus 403 Forbidden (valid credentials, insufficient permissions).

Diagnostic Request: To provide a more specific recovery path, please specify if you are using a Personal Access Token (PAT) or a Service Principal (App Registration) for your CI identity.

Does NuGet Recover From Expired Feed Credentials During Non-Interactive CI Restores?

1 answer

Direct Answer

Credential Recovery vs. Identity Expiry

Session Caching and 401s

Mapping Restore and Push Identities

Verification Steps for CI

Your perspective belongs here.

0 question comments