NetSuite OAuth 2.0 Client Credentials (M2M) JWT Code Generator

# RSA key for PS256 / PS384 / PS512
openssl req -x509 -newkey rsa:4096 -sha256 -nodes -days 365 \
  -keyout ./netsuite_private.pem -out netsuite_public_cert.pem -subj "/CN=netsuite-m2m"

# or an EC P-256 key for ES256
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -sha256 -nodes -days 365 \
  -keyout ./netsuite_private.pem -out netsuite_public_cert.pem -subj "/CN=netsuite-m2m"

# Upload netsuite_public_cert.pem at Setup > Integration > Manage Authentication >
# OAuth 2.0 Client Credentials (M2M) Setup, then copy the Certificate ID shown for the mapping.

# pip install pyjwt cryptography requests
import time
import uuid

import jwt
import requests

ACCOUNT_HOST = "1234567".lower().replace("_", "-")
TOKEN_URL = "https://" + ACCOUNT_HOST + ".suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token"
CLIENT_ID = "<client_id>"
CERTIFICATE_ID = "<certificate_id>"
ALGORITHM = "PS256"
SCOPE = "rest_webservices"

_cache = {"token": None, "expires_at": 0}


def get_access_token():
    if _cache["token"] and time.time() < _cache["expires_at"] - 300:
        return _cache["token"]
    with open("./netsuite_private.pem", "rb") as f:
        private_key = f.read()
    now = int(time.time())
    claims = {
        "iss": CLIENT_ID,
        "scope": SCOPE,
        "aud": TOKEN_URL,
        "iat": now,
        "exp": now + 3000,  # must be less than 60 minutes after iat
        "jti": str(uuid.uuid4()),
    }
    assertion = jwt.encode(claims, private_key, algorithm=ALGORITHM,
                           headers={"kid": CERTIFICATE_ID, "typ": "JWT"})
    resp = requests.post(TOKEN_URL, data={
        "grant_type": "client_credentials",
        "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
        "client_assertion": assertion,
    }, timeout=60)
    if resp.status_code != 200:
        raise RuntimeError(str(resp.status_code) + " " + resp.text)
    body = resp.json()
    _cache["token"] = body["access_token"]
    _cache["expires_at"] = time.time() + int(body["expires_in"])
    return _cache["token"]


if __name__ == "__main__":
    token = get_access_token()
    # Example call with rest_webservices scope
    r = requests.get("https://" + ACCOUNT_HOST + ".suitetalk.api.netsuite.com/services/rest/record/v1/customer?limit=1",
                     headers={"Authorization": "Bearer " + token}, timeout=60)
    print(r.status_code, r.text[:500])

// npm install jsonwebtoken   (Node.js 18 or later for built-in fetch)
const fs = require('fs');
const crypto = require('crypto');
const jwt = require('jsonwebtoken');

const accountHost = '1234567'.toLowerCase().replace(/_/g, '-');
const tokenUrl = 'https://' + accountHost + '.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token';

async function getAccessToken() {
  const now = Math.floor(Date.now() / 1000);
  const assertion = jwt.sign(
    { iss: '<client_id>', scope: 'rest_webservices', aud: tokenUrl, iat: now, exp: now + 3000, jti: crypto.randomUUID() },
    fs.readFileSync('./netsuite_private.pem'),
    { algorithm: 'PS256', header: { kid: '<certificate_id>', typ: 'JWT' } }
  );
  const res = await fetch(tokenUrl, {
    method: 'POST',
    body: new URLSearchParams({
      grant_type: 'client_credentials',
      client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
      client_assertion: assertion,
    }),
  });
  if (!res.ok) throw new Error(res.status + ' ' + (await res.text()));
  const body = await res.json();
  return { token: body.access_token, expiresIn: body.expires_in };
}

getAccessToken().then((t) => console.log('expires_in', t.expiresIn, 'token', t.token.slice(0, 20) + '...'));