# NetSuite Token-Based Authentication (TBA) Setup Checklist > Source: https://netray.co/tools/netsuite-token-based-auth-setup-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Every step to configure token-based authentication for NetSuite REST, SOAP or RESTlet calls, from features and roles to tokens and test calls. ## Category netsuite ## Erp NetSuite ## Audience - NetSuite developer - NetSuite administrator - Integration developer ## Tool **Kind:** checklist **Groups:** #### 1. Features **Items:** **Text:** Enable Token-Based Authentication under Setup > Company > Enable Features > SuiteCloud **Critical:** true **Text:** Enable REST Web Services if you will call REST **Critical:** true Enable SOAP Web Services only if a legacy integration needs it Enable the feature in sandbox and production separately #### 2. Integration record **Items:** **Text:** Create the record at Setup > Integration > Manage Integrations > New **Critical:** true Name it after the system and environment, for example ERPSync Sandbox **Text:** Tick Token-Based Authentication on the record **Critical:** true Clear unneeded authentication options such as TBA authorization flow if not used **Text:** Save and copy the Consumer Key and Consumer Secret immediately **Critical:** true Store the secrets in a vault, since the secret is shown only once #### 3. Role and user **Items:** **Text:** Create a dedicated integration role rather than reusing an administrator role **Critical:** true **Text:** Add the Log in using Access Tokens permission **Critical:** true **Text:** Add REST Web Services or SOAP Web Services permission as needed **Critical:** true Add only the record and list permissions the integration needs Assign the role to a dedicated integration user Make sure the user is active, with no two-factor requirement that blocks token use #### 4. Access token **Items:** **Text:** Create the token at Setup > Users/Roles > Access Tokens > New **Critical:** true Select the integration application, the user and the role **Text:** Save and copy the Token ID and Token Secret immediately **Critical:** true Record who owns the token and when it should be rotated Revoke tokens that belong to people who left the project #### 5. Request and testing **Items:** **Text:** Build the OAuth 1.0 header with realm set to the account ID, using uppercase and underscore for sandbox such as 1234567_SB1 **Critical:** true **Text:** Use HMAC-SHA256 as the signature method **Critical:** true Generate a fresh nonce and current timestamp for each request Send consumer key, token, signature method, timestamp, nonce, version 1.0 and signature Test with a simple GET against a REST record URL Check the system clock on the calling server for drift Diagnose failures using the Login Audit Trail and the error code Repeat the full setup in production, with its own integration record and tokens **Scoring Note:** Items marked critical are the usual causes of invalid signature, invalid login and insufficient permission errors. Confirm menu paths against your NetSuite release, and review Oracle documentation on OAuth 2.0 as an alternative for new integrations. ## Content **Intro:** Token-based authentication lets an integration call NetSuite without storing a user password. The setup spans features, an integration record, a role, a user and a token, and any gap produces an unhelpful error. Use this checklist to do it once and correctly. **Sections:** #### How to use the checklist **Body:** Work through the groups in order for each environment. Tick items as you complete them and export the result for your change record. Treat the critical items as gates, particularly the permission, the one-time secrets and the realm format, because they cause most of the failed first calls. Do sandbox first, then repeat in production with separate integration records and tokens. #### The four credentials **Body:** A TBA call uses four secrets and an account ID. The consumer key and consumer secret come from the integration record and identify the application. The token ID and token secret come from the access token and identify the user and role. The signature is computed from these values, a nonce and a timestamp, and the realm in the header carries the account ID. **Bullets:** - Consumer key and secret: integration record - Token ID and secret: access token - Realm: account ID, with sandbox written like 1234567_SB1 - Signature method: HMAC-SHA256 #### Reading the errors **Body:** Invalid signature usually means the wrong secret, wrong realm, a wrong signature method or clock drift. Invalid login attempt points to a role missing the Log in using Access Tokens permission or an inactive user. Insufficient permission means the role lacks a web services permission or the permission for the record. Check the Login Audit Trail, which usually states the reason more clearly than the HTTP response. #### Common mistakes **Body:** Teams lose the one-time secrets and must create a new token, use the URL form of the account ID in the realm instead of the uppercase underscore form, grant an administrator role for convenience, and forget that a sandbox refresh can drop tokens and integration records. Rotate tokens on a schedule and keep an owner for each. **Cta:** If you want NetSuite data available to AI without handing out broad credentials, Netray sets up read-only access with a least-privilege role and shows every query. **Faq:** #### What is token-based authentication in NetSuite? **Answer:** It is an OAuth 1.0 based method where an integration signs each request with a consumer key and secret plus a token and secret, so no user password is stored or sent. #### Why do I get an invalid signature error? **Answer:** Common causes are a wrong secret, the realm not matching the account ID format, the wrong signature method, or a server clock that is out of sync. Recompute the signature and check each value carefully. #### Which permission is required for tokens? **Answer:** The role needs Log in using Access Tokens, plus REST Web Services or SOAP Web Services permission, and the record permissions the integration uses. The user also needs the role assigned. #### Should I use OAuth 2.0 instead? **Answer:** OAuth 2.0 is supported for REST and is worth evaluating for new integrations. TBA remains common and works well for server to server calls. Check Oracle documentation for current guidance on your account. ## Search terms netsuite token based authentication setup, netsuite tba setup steps, netsuite create access token, netsuite integration record consumer key, netsuite oauth 1.0 tba, netsuite log in using access tokens permission, netsuite tba invalid signature --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json