Changes in the Publish API!

[RanadhirMSFT]

As part of our commitment to improve our security methods and practices as part of the  Microsoft Secure Future Initiative, we are making few changes to the Publish API for extension submission in Partner Center.

As part of this change, secrets are getting deprecated and replaced with API keys, Access Token URL is getting deprecated, and the API key expiration will reduce from 2 years to 72 days.

This feature is currently active on partner center and you can test it to ensure it works as desired. The old v1 APIs will be getting deprecated on 31st Dec 2024.

Reference:

• Blog with details of the change
• Version 1 of APIs
• Version 1.1 of APIs.

[maximtop]

Hi Ranadhir,

Thanks for the update on the Publish API changes as part of the Microsoft Secure Future Initiative. These improvements are a great step toward enhancing security.

I wanted to share some feedback about the new API keys. It would be really helpful if the API keys could avoid using special characters like $ and #. These can cause issues in configuration files, especially .env files, since they often require extra escaping or quoting.

Why Avoid Special Characters:

1. Easier Integration:

   • No need to escape characters, reducing the risk of errors.
   • Smoother deployments across different environments.

2. Better Compatibility:

   • Works well with tools and frameworks that have strict rules for environment variables.
   • Fewer issues in CI/CD pipelines related to environment variable parsing.

3. Simpler to Use:

   • Makes managing and updating API keys easier for developers.
   • Keeps configuration files clean and easy to read.

Recommendation:

• Use Alphanumeric Characters:

  • Generate API keys with only letters and numbers (A-Z, a-z, 0-9) for maximum compatibility.

• Optional Safe Symbols:

  • If additional complexity is needed, consider using symbols like - or _ that are less likely to cause issues.

Implementing these changes would make the integration process smoother and reduce potential challenges.

Thanks for considering this feedback. I appreciate the ongoing efforts to improve the platform’s security and usability.

[Cavitedev]

Thank you for the information Ranadhir,

I'll update my own project as soon as my middle dependency updates featuring the new API for the edge store

[doniyor2109]

@RanadhirMSFT Does it mean v1 APIs will still work after 31st Dec 2024? Or they will not function anymore after 31st Dec 2024?

The old v1 APIs will be getting deprecated on 31st Dec 2024.

[RanadhirMSFT]

Post 31st Dec 2024, v1 APIs will cease to function. They will not work further.

[doniyor2109]

Thanks for information

[tanaywfx]

Hello @RanadhirMSFT, is there a programmatic way to refresh the API key when it expires?

Another query, I am following this blog to plan my changes. In the screenshot below from the same blog, it is mentioned that the expiry time is 72 hours but the text in other places as well as this announcement says 72 days. Can you please clarify what is correct?