NuGet package source authentication: forcing credential refresh after API key expiration
0 reputation · 01 Jun 2020, 11:03 UTC
Goal
I want NuGet restore operations (via nuget.exe and the .NET SDK) to stop using a cached API key once that key expires or its permissions are revoked, and instead re-request credentials at that point. The broader aim is least-privilege authentication: short-lived keys scoped per source, without stale credentials silently lingering in the cache.
Constraints and uncertainty
My understanding is that NuGet caches credentials per configured package source and reuses them until the process restarts, surfacing expired or revoked keys only as 401/403 responses after a failed download. The SDK exposes an ICredentialsProvider extensibility point, but it is unclear to me whether NuGet actually re-invokes a custom provider after a cached credential fails, or whether the cache must be cleared manually. I am also unsure how NuGet 6.x changes to credential persistence affect existing custom provider implementations.
Questions
- Does NuGet automatically retry through
ICredentialsProviderwhen a cached credential returns 401/403, or is manual cache clearing the only built-in recovery path? - Is there a supported way to scope credential lifetime per source so short-lived, least-privilege keys are refreshed predictably?
- Which diagnostic verbosity or log entries confirm whether a request used a cached versus freshly provided credential?
