Merge pull request #1238 from telerik/api-key-as-primary-auth-method

API key as primary auth method

Author: didiyordanova

_contentTemplates/common/nuget.md

@@ -17,19 +17,28 @@ Visit <a href="https://status.telerik.com" target="_blank">status.telerik.com</a
 #end
 
 #generate-nuget-key
-1. Go to the [**Manage NuGet Keys**](https://www.telerik.com/account/downloads/nuget-keys) page in your Telerik account.
+As the Telerik NuGet server requires authentication, the first step is to obtain an API key that you will use instead of a password. Using an API key instead of a password is a more secure approach, especially when working with [.NET CLI]({% slug nuget-dotnet-cli %}) or the [`NuGet.Config` file]({% slug nuget-config %}).
 
-1. Select the **DOWNLOADS** tab and then **Manage NuGet Keys**.
+1. Go to the [API Keys](https://www.telerik.com/account/downloads/api-keys) page in your Telerik account.
+1. Click **Generate New Key +**.
 
-    ![Manage NuGet Keys](../../installation/images/manage-nuget-keys.png)
+   ![Manage API Keys](/installation/images/account-generate-api-key.png)
 
-1. To create a new key, select the **Generate New Key** button.
+1. In the **Key Note** field, add a note that describes the API key.
+1. Click **Generate Key**.
+1. Select **Copy and Close**. Once you close the window, you can no longer copy the generated key. For security reasons, the **API Keys** page displays only a portion of the key.
+1. Store the generated NuGet API key as you will need it in the next steps. Whenever you need to authenticate your system with the Telerik NuGet server, use `api-key` as the username and your generated API key as the password.
 
-1. Enter a name for the NuGet Key, and then select **Generate Key**.
-
-1. To copy the key, select **Copy and Close**. Once you close the window, you can no longer copy the generated key. For security reasons, the **NuGet Keys** page displays only a portion of the key.
-
-    ![Copy Generated NuGet Key](../../installation/images/copy-nuget-key.png)
+#end
 
-1. Store the generated NuGet API key as you will need it in the next step.
+#reset-store-credentials
+1. Remove the saved credentials in the [Windows Credential Manager](https://support.microsoft.com/en-us/windows/accessing-credential-manager-1b5c916a-6a16-889f-8581-fc16e8165ac0). These credentials will appear as `nuget.telerik.com` or `VSCredentials_nuget.telerik.com` entries.
+2. Remove the Telerik NuGet package source from Visual Studio.
+3. If you have added the Telerik package source by using the .NET CLI, try to remove it by running the following commands:
+    * [`dotnet nuget list source`](https://docs.microsoft.com/en-us/dotnet/core/tools/dotnet-nuget-list-source)
+    * [`dotnet nuget remove source`](https://docs.microsoft.com/en-us/dotnet/core/tools/dotnet-nuget-remove-source)
+4. Check if you have any credentials stored in `%AppData%\NuGet\Nuget.Config`. If so, remove them.
+5. Try to reset the Visual Studio user data by [forcing NuGet to ask for authentication](https://stackoverflow.com/questions/43550797/how-to-force-nuget-to-ask-for-authentication-when-connecting-to-a-private-feed).
+6. Restart Visual Studio.
+7. Add the Telerik NuGet package source again through Visual Studio or .NET CLI. If you are using the Telerik NuGet feed in a .NET Core application, use a [NuGet API key in the NuGet.Config file]({%slug nuget-config %}).
 #end

get-started/first-steps-vs-code.md

@@ -58,13 +58,15 @@ If you encounter any issues creating the basic project, see the complete guide i
 
 Telerik maintains a NuGet feed with official UI for .NET MAUI releases and service packs. These packages are available for registered users with an active trial or commercial license. Adding the Telerik NuGet server as a source lets you download and install Telerik packages containing controls and utilities. As Visual Studio Code does not offer a built-in NuGet packet manager, use .NET CLI to add a new package source.
 
-To add the Telerik NuGet source using .NET CLI, use the command below. Replace the placeholders with your Telerik account user name and password.
+@[template](/_contentTemplates/common/nuget.md#generate-nuget-key)
+
+Next, use the command below to add the Telerik NuGet source using .NET CLI. Replace the NuGet API key placeholder with the API key that you generated.
 
 ```bash
-dotnet nuget add source https://nuget.telerik.com/v3/index.json --name TelerikNuGetFeed --username <TELERIK EMAIL> --password <TELERIK PASSWORD> --store-password-in-clear-text
+dotnet nuget add source https://nuget.telerik.com/v3/index.json --name TelerikNuGetFeed --username api-key --password <YOUR-NUGET-API-KEY> --store-password-in-clear-text
 ```
 
->caution Storing passwords in plain text is strongly discouraged. This guide uses the `--store-password-in-clear-text` only for simplicity. For real-world scenarios, use secure methods, such as encrypted passwords or API keys. See <a href="https://learn.microsoft.com/en-us/nuget/consume-packages/consuming-packages-authenticated-feeds#security-best-practices-for-managing-credentials" target="_blank">Microsoft's security best practices</a> for more information on how to securely store your NuGet source credentials. 
+>See <a href="https://learn.microsoft.com/en-us/nuget/consume-packages/consuming-packages-authenticated-feeds#security-best-practices-for-managing-credentials" target="_blank">Microsoft's security best practices</a> for more information on how to securely store your NuGet source credentials.
 
 ## Step 4: Install the Telerik UI for .NET MAUI Controls
 

get-started/first-steps-vs.md

@@ -51,7 +51,9 @@ If you encounter any issues creating the basic project, see the complete guide i
 
 Telerik maintains a NuGet feed with official UI for .NET MAUI releases and service packs. These packages are available for registered users with an active trial or commercial license. Adding the Telerik NuGet server as a source in Visual Studio lets you download and install Telerik packages containing controls and utilities.
 
-To add the Telerik NuGet source to Visual Studio:
+@[template](/_contentTemplates/common/nuget.md#generate-nuget-key)
+
+Next, add the Telerik NuGet source to Visual Studio:
 
 1. In Visual Studio go to **Tools** > **NuGet Package Manager** > **Package Manager Settings**.
 
@@ -61,7 +63,7 @@ To add the Telerik NuGet source to Visual Studio:
 
 1. Add the `https://nuget.telerik.com/v3/index.json` URL as a **Source**. Click **OK**.
 
-1. Whenever Visual Studio displays a dialog to enter credentials for `nuget.telerik.com`, use your Telerik account email and password.
+1. Whenever Visual Studio displays a dialog to enter credentials for `nuget.telerik.com`, use `api-key` as the username and your NuGet API key as the password.
 
 	![Add the Telerik NuGet Feed in Visual Studio](./images/telerik-nuget-feed.png)
 
@@ -71,7 +73,7 @@ To add the Telerik NuGet source to Visual Studio:
 
 2. Install the Telerik UI for .NET MAUI package:
 
-   1. Select the `telerik.com` **Package source** that you [added earlier](#step-2-add-the-telerik-nuget-server). As this is a private NuGet feed, you must authenticate with your [Telerik account](https://www.telerik.com/account/) user name and password.
+  1. Select the `telerik.com` **Package source** that you [added earlier](#step-2-add-the-telerik-nuget-server). As this is a private NuGet feed, you must authenticate using `api-key` as the username and [your NuGet API key](#step-3-add-the-telerik-nuget-server) as the password.
 
    1. Select the **Browse** tab, enter `MAUI` in the search box, and then select the `Telerik.UI.for.Maui` package.
 

installation/images/account-generate-api-key.png

@@ -13,13 +13,10 @@ An alternative way to configure your system to use the Telerik NuGet server is t
 
 To configure the Telerik NuGet server as a package source directly in the `nuget.config` file, perform the following steps:
 
-1. [Generate a NuGet API key](#generate-a-nuget-key).
+1. [Generate a NuGet API key](#generate-an-api-key).
 1. [Edit the NuGet.Config file](#edit-the-nugetconfig-file).
 
-## Generate a NuGet Key
-
-Generate a NuGet API key that you will use for the authentication by the Telerik NuGet server. This approach is more secure than using your Telerik credentials in <a href="https://learn.microsoft.com/en-us/nuget/consume-packages/consuming-packages-authenticated-feeds#credentials-in-nugetconfig-files
-" target="_blank">plain text</a>.
+## Generate an API Key
 
 @[template](/_contentTemplates/common/nuget.md#generate-nuget-key)
 
@@ -34,7 +31,7 @@ Generate a NuGet API key that you will use for the authentication by the Telerik
 
 1. In the `nuget.config` file, add the Telerik feed by inserting the line `<add key="MyTelerikFeed" value="https://nuget.telerik.com/v3/index.json" protocolVersion="3"/>`in the `packageSources` section.
 
-1. In the `packageSourceCredentials` section, add the [generated NuGet API key](#generate-a-nuget-key). Use `api-key` as a value for the user name.
+1. In the `packageSourceCredentials` section, add the [generated NuGet API key](#generate-an-api-key). Use `api-key` as a value for the user name.
 
     ```xml
     <configuration>
@@ -52,15 +49,9 @@ Generate a NuGet API key that you will use for the authentication by the Telerik
     </configuration>
     ```
 
-## Securing Your Credentials
-
-This article does not cover the scenario of using your Telerik account credentials as <a href="https://learn.microsoft.com/en-us/nuget/reference/nuget-config-file#packagesourcecredentials
-" target="_blank">plain text</a> in the `NuGet.Config` file due to security concerns. However, you can still use the <a href="https://learn.microsoft.com/en-us/nuget/reference/nuget-config-file#packagesourcecredentials
-" target="_blank">plain text</a> approach if you must.
+## Securing Your API Key
 
->warning
->* Never hard-code Telerik account credentials or NuGet API keys in a `NuGet.Config` file in a GitHub repository, Docker image, or any location that may be accessed by unauthorized parties. A NuGet key is valuable and bad actors can use it to access the NuGet packages that are licensed under your account. A credentials abuse can lead to a review of the affected Telerik account.
->* If you use single sign-on (SSO) to login into your Telerik account, always use a [NuGet API key]({%slug nuget-keys%}) instead of plain text credentials in the `NuGet.Config` file.
+Never hard-code NuGet API keys in a `NuGet.Config` file in a GitHub repository, Docker image, or any location that may be accessed by unauthorized parties. A NuGet API key is valuable and bad actors can use it to access the NuGet packages that are licensed under your account. A credentials abuse can lead to a review of the affected Telerik account.
 
 For more details about the `NuGet.Config` file, see the following Microsoft resources:
 * <a href="https://learn.microsoft.com/en-us/nuget/reference/nuget-config-file#packagesources" target="_blank">Configuring the NuGet package sources</a>

installation/images/manage-nuget-keys.png

@@ -1,7 +1,7 @@
 ---
 title: Using NuGet in CI Workflows
 page_title: Using NuGet Packages in CI Workflows
-description: Learn how to use NuGet Keys to authenticate with the Telerik NuGet server and restore Telerik UI for .NET MAUI packages in your CI or desktop environment.
+description: Learn how to use API Keys to authenticate with the Telerik NuGet server and restore Telerik UI for .NET MAUI packages in your CI or desktop environment.
 slug: nuget-keys
 position: 8
 ---
@@ -10,48 +10,41 @@ position: 8
 
 This article describes how to use token-based authentication for the Telerik NuGet feed. You will learn how to create and use NuGet API keys to restore Telerik NuGet packages in your Continuous Integration (CI) workflow.
 
-The Telerik NuGet server allows you to authenticate by using two methods:
+When you need to restore Telerik NuGet packages as part of your CI, using API Keys provides a secure way to authenticate. This method does not require you to provide your Telerik username and password anywhere in the CI workflow. Unlike your Telerik credentials, an API Key has a limited scope and can be used only with the Telerik NuGet server. If any of your API Keys is compromised, you can quickly delete it and create a new one.
 
-* Basic authentication by providing your Telerik user name and password.
-* Token-based authentication by providing a NuGet key (recommended).
-
-When you need to restore Telerik NuGet packages as part of your CI, using NuGet keys is the more secure way to authenticate. This method does not require you to provide your Telerik username and password anywhere in the CI workflow.
-
-Unlike your Telerik credentials, a NuGet Key has a limited scope and can be used only with the Telerik NuGet server. If any of your NuGet keys is compromised, you can quickly delete it and create a new one.
-
-## Generating NuGet Keys
+## Generating API Keys
 
 @[template](/_contentTemplates/common/nuget.md#generate-nuget-key)
 
-## Storing a NuGet Key
+## Storing API Keys
 
-> Never check in a NuGet Key with your source code or leave it publicly visible in plain text, for example, as a raw key value in a `nuget.config` file. A NuGet Key is valuable as bad actors can use it to access the NuGet packages that are licensed under your account. A potential key abuse can lead to a review of the affected account.
+> Never check in an API Key with your source code or leave it publicly visible in plain text, for example, as a raw key value in a `NuGet.Config` file. An API Key is valuable, as bad actors can use it to access the NuGet packages that are licensed under your account. A potential key abuse can lead to a review of the affected account.
 
-To protect the NuGet Key, store it as a secret environment variable. The exact steps depend on your workflow:
+To protect the API Key, store it as a secret environment variable. The exact steps depend on your workflow:
 
 * In GitHub Actions, save the key as a GitHub Actions Secret. Go to **Settings** > **Security** > **Secrets** > **Actions** > **Add new secret**.
 
 * In Azure DevOps Classic, save the key as a secret pipeline variable. Go to the **Variables** tab and then select **Pipeline variables**.
 
 * In Azure DevOps YAML pipelines, save the key as a secret variable as well. Click the YAML editor's **Variables** button and complete the **New variable** form.
 
-If you use Azure DevOps Service connection instead of secret environment variables, enter `api-key` in the username filed and the NuGet Key as the password in the **New NuGet service connection** form editor.
+If you use Azure DevOps Service connection instead of secret environment variables, enter `api-key` in the username filed and the API Key as the password in the **New NuGet service connection** form editor.
 
-For more details on storing and protecting your NuGet Key, check the [Announcing NuGet Keys](https://www.telerik.com/blogs/announcing-nuget-keys) blog post by Lance McCarthy.
+For more details on storing and protecting your API Key, check the [Announcing NuGet Keys](https://www.telerik.com/blogs/announcing-nuget-keys) blog post by Lance McCarthy.
 
-## Using a NuGet Key
+## Using an API Key
 
 There are two popular ways to use the Telerik NuGet server in a build:
 
-* [Using a nuget.config file with your projects](#using-a-nugetconfig-file-with-your-projects)
+* [Using a NuGet.Config file with your projects](#using-a-nugetconfig-file-with-your-projects)
 
 * [Using only CLI commands](#using-only-cli-commands)
 
-For more information on how to use NuGet keys in a build, check the [Announcing NuGet Keys](https://www.telerik.com/blogs/announcing-nuget-keys) blog post by Lance McCarthy.
+For more information on how to use API Keys in a build, check the [Announcing NuGet Keys](https://www.telerik.com/blogs/announcing-nuget-keys) blog post by Lance McCarthy.
 
 ### Using a NuGet.Config File with Your Projects
 
-**1.** In your `nuget.config` file, set the `Username` value to `api-key` and the `ClearTextPassword` value to an environment variable name:
+**1.** In your `NuGet.Config` file, set the `Username` value to `api-key` and the `ClearTextPassword` value to an environment variable name:
 
 ```xml
 <configuration>
@@ -75,7 +68,7 @@ The exact steps to set the `MY_API_KEY` environment variable depend on your work
 
 ### Using .NET CLI Commands
 
-You can use the CLI `add source` (or `update source`) command to set the credentials of a package source. This CLI approach is applicable if your CI system doesn't support default environment variable secrets or if you do not use a custom `nuget.config`.
+You can use the CLI `add source` (or `update source`) command to set the credentials of a package source. This CLI approach is applicable if your CI system doesn't support default environment variable secrets or if you do not use a custom `NuGet.Config`.
 
 * To set the credentials in Azure DevOps:
 

installation/images/vs-nuget-auth-window.png

@@ -32,13 +32,13 @@ You can quickly test your credentials or a specific package search results, the
     1. Enter [https://nuget.telerik.com/v3/index.json](https://nuget.telerik.com/v3/index.json) in the address bar and hit `Enter`.
     1. The web browser will prompt you to login, enter the credentials you want to test. You can test either:
         * Telerik Account credentials (email address and password)
-        * Telerik NuGet Key (username "api-key", password is the full key value)
+        * Telerik API Key (username "api-key", password is the full key value)
     1. You should now see a json result containing the general index listing. This confirms a successful login!
 1. Confirm Package Listing
     1. Enter [https://nuget.telerik.com/v3/search?q=telerik.ui.for.maui](https://nuget.telerik.com/v3/search?q=telerik.ui.for.maui) in the address bar and hit Enter.
     1. You should now see a json result containing a list of available packages that match the query.
-1. If you want to try again with different credentials (i.e. a different nuget key), close the incognito browser session and open a new one.
+1. If you want to try again with different credentials (i.e. a different NuGet API key), close the incognito browser session and open a new one.
 
->Tip If you get an error at any point in this process, review the list above for the specific error message and follow those dedicated instructions. For example, you may need to visit the [401 Unauthorized]({%slug error-unauthorized%}) or [401 Logon failed error]({%slug error-login-failed%}) articles. Alternatively, if you authenticate and get a json response, but the package version you're expecting isn't listed, the [Package Version Not Found]({%slug package-version-not-found%}) article is more relevant. 
+>Tip If you get an error at any point in this process, review the list above for the specific error message and follow those dedicated instructions. For example, you may need to visit the [401 Unauthorized]({%slug error-unauthorized%}) or [401 Logon failed error]({%slug error-login-failed%}) articles. Alternatively, if you authenticate and get a json response, but the package version you're expecting isn't listed, the [Package Version Not Found]({%slug package-version-not-found%}) article is more relevant.
 
 @[template](/_contentTemplates/common/nuget.md#status-telerik-com)