# Restoring NuGet Packages in Your CI Workflow

This article describes how to use token-based authentication for the Telerik NuGet feed. You will learn how to create and use NuGet API keys to restore Telerik NuGet packages in your Continuous Integration (CI) workflow.

The Telerik NuGet server supports secure authentication through token-based mechanisms using NuGet API keys. When integrating Telerik packages into your CI pipeline, using API keys provides enhanced security compared to traditional username and password authentication. Unlike your Telerik credentials, a NuGet Key has a limited scope and can be used only with the Telerik NuGet server. If any of your NuGet keys is compromised, you can quickly delete it and create a new one.

## Generating NuGet Keys

As the Telerik NuGet server requires authentication, the first step is to obtain an API key that you will use instead of a password. Using an API key instead of a password is a more secure approach, especially when working with [.NET CLI](https://docs.telerik.com/devtools/winforms/visual-studio-integration/install-nuget-keys#using-only-cli-commands) or the [NuGet.Config file](https://docs.telerik.com/devtools/winforms/visual-studio-integration/install-nuget-keys#using-a-nugetconfig-file-with-your-projects).

1. Go to the [API Keys](https://www.telerik.com/account/downloads/api-keys) page in your Telerik account.
2. Click **Generate New Key +**.

![Telerik account API Keys page with the Generate New Key command](https://www.telerik.com/products/winforms/documentation/assets/14757e5faedad989622f3dfe14797297/account-generate-api-key.png)

1. In the **Key Note** field, add a note that describes the API key.

2. Click **Generate Key**.

3. Select **Copy and Close**. Once you close the window, you can no longer copy the generated key. For security reasons, the **API Keys** page displays only a portion of the key.

4. Store the generated NuGet API key as you will need it in the next steps. Whenever you need to authenticate your system with the Telerik NuGet server, use `api-key` as the username and your generated API key as the password.

> API keys expire after two years. Telerik will send you an email when a key is about to expire, but we recommend that you set your own calendar reminder with information about where you used that key: file paths, project links, AzDO and GitHub Action variable names, and so on.

## Storing API Keys

> note Never check in an API Key with your source code or leave it publicly visible in plain text, for example, as a raw key value in a nuget.config file. An API Key is valuable as bad actors can use it to access the NuGet packages that are licensed under your account. A potential key abuse could lead to a review of the affected account.

To protect the NuGet Key, store it as a secret environment variable. The exact steps depend on your workflow:

* In GitHub Actions, save the key as a GitHub Actions Secret. Go to **Settings > Security > Secrets > Actions > Add new secret**.

* In Azure DevOps Classic, save the key as a secret pipeline variable. Go to the **Variables** tab and then select **Pipeline variables**.

* In Azure DevOps YAML pipelines, save the key as a secret variable as well. Click the YAML editor's Variables button and complete the New variable form.

If you use Azure DevOps Service connection instead of secret environment variables, enter `api-key` in the username filed and the NuGet Key as the password in the **New NuGet service connection** form editor.

For more details on storing and protecting your NuGet Key, check the [Announcing NuGet Keys](https://www.telerik.com/blogs/announcing-nuget-keys) blog post by Lance McCarthy.

## Using an API Key

There are two popular ways to use the Telerik NuGet server in a build:

* [Using a nuget.config file with your projects](https://www.telerik.com/products/winforms/documentation/visual-studio-integration/install-nuget-keys#using-a-nugetconfig-file-with-your-projects)

* [Using only CLI commands](https://www.telerik.com/products/winforms/documentation/visual-studio-integration/install-nuget-keys#using-only-cli-commands)

For more information on how to use NuGet keys in a build, check the [Announcing NuGet Keys](https://www.telerik.com/blogs/announcing-nuget-keys) blog post by Lance McCarthy.

### Using a nuget.config File with Your Projects

1\. In your `nuget.config` file, set the `Username` value to `api-key` and the `ClearTextPassword` value to an environment variable name:

```XML
       <configuration>
           <packageSources>
               <clear/>
               <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
               <add key="MyTelerikFeed" value="https://nuget.telerik.com/v3/index.json" protocolVersion="3"/>
           </packageSources>
           <packageSourceCredentials>
               <MyTelerikFeed>
               <add key="Username" value="api-key" />
               <add key="ClearTextPassword" value="%MY_API_KEY%" />
               </MyTelerikFeed>
           </packageSourceCredentials>
           ...
       </configuration>
```

2\. Set the `MY_API_KEY` environment variable by using the value of your pipeline/workflow secret.

The exact steps to set the `MY_API_KEY` environment variable depend on your workflow. For more details, refer to the [Announcing NuGet Keys](https://www.telerik.com/blogs/announcing-nuget-keys) blog post by Lance McCarthy.

### Using Only CLI Commands

You can use the CLI `add source` (or `update source`) command to set the credentials of a package source. This CLI approach is applicable if your CI system doesn't support default environment variable secrets or if you do not use a custom `nuget.config`.

* To set the credentials in Azure DevOps:

```powershell
    dotnet nuget add source 'MyTelerikFeed' --source 'https://nuget.telerik.com/v3/index.json' --username 'api-key' --password '$(TELERIK_NUGET_KEY)' --configfile './nuget.config' --store-password-in-clear-text   
```

* To set the credentials in GitHub Actions:

```powershell
    dotnet nuget add source 'MyTelerikFeed' --source 'https://nuget.telerik.com/v3/index.json' --username 'api-key' --password '${{ secrets.TELERIK_NUGET_KEY }}' --configfile './nuget.config' --store-password-in-clear-text
```

## Additional Resources

If you just start using the Telerik NuGet server in your CI or inter-department workflows, check the two blog posts below. You will learn about the various use cases and find practical implementation details.

* [Azure DevOps and Telerik NuGet Packages](https://www.telerik.com/blogs/azure-devops-and-telerik-nuget-packages)

* [Announcing NuGet Keys](https://www.telerik.com/blogs/announcing-nuget-keys)

## See Also

* [Install using NuGet Packages](https://www.telerik.com/products/winforms/documentation/installation-and-upgrades/install-using-nuget)