Managing access

1. Credential types

pkgstore uses a few distinct credential types, each for a different job:

• Push key: lets a publisher upload packages to a feed. Used with dotnet nuget push.
• Subscriber credential: a generated username and password issued to a paying customer to restore packages.
• Free access credential: the same kind of restore credential, issued through a free access grant rather than a purchase.

2. Regenerating and revoking

If a credential is leaked or no longer needed, regenerate it. The old credential stops working immediately and a new username and password are issued. Consumers update their nuget.config or CLI source with the new values. Publishers can revoke a credential entirely from the feed management page.

3. Free access grants

You can grant free access to specific people, useful for open-source contributors, beta testers, or customers you want to comp. From feed management, enter the person's email and an optional note. They receive an invitation, and once accepted they generate a credential just like a paying subscriber. You can see active and revoked grants, and revoke any of them at any time.

4. Team seats and invites

When a pricing plan has more than one seat, the buyer becomes the owner of a team subscription and can invite members by email. Invitees accept the invite by signing in with the same email address. pkgstore uses passwordless magic-link login, so a new invitee receives a sign-in link rather than setting a password. Each member gets their own credential, so you can rotate or remove one person without affecting the others. The owner manages the member list, and the total number of team members is capped by the plan's seat count.

Access always follows payment status: when a subscription is cancelled or suspended, the related credentials are revoked automatically. Already-restored packages stay in local NuGet caches, but new restores fail after access ends. See Subscriptions and billing for the status table.

5. Credential limits

Seat count and credential count are related but separate. Seat count controls how many people can be attached to a paid team subscription. The per-subscriber credential limit controls how many active restore credentials one subscriber can generate, for example one for a laptop and one for CI. Publishers can adjust the per-subscriber credential limit from 1 to 100 on the feed management page.

Private Feed publishers can also automate credential creation and revocation with the Credentials API.