NetSuite Token-Based Authentication (OAuth 1.0) Signature Code Generator

import base64
import hashlib
import hmac
import json
import secrets
import time
import urllib.parse
import urllib.request

ACCOUNT_ID = "1234567"
HTTP_METHOD = "POST"
URL = "https://1234567.restlets.api.netsuite.com/app/site/hosting/restlet.nl?script=123&deploy=1"
CONSUMER_KEY = "<consumer_key>"
CONSUMER_SECRET = "<consumer_secret>"
TOKEN_ID = "<token_id>"
TOKEN_SECRET = "<token_secret>"


def enc(value):
    # RFC 3986 percent encoding (same as PHP rawurlencode)
    return urllib.parse.quote(str(value), safe="~")


def tba_header(method, url):
    realm = ACCOUNT_ID.upper().replace("-", "_")  # 1234567_SB1 style
    parts = urllib.parse.urlsplit(url)
    base_url = parts.scheme.lower() + "://" + parts.netloc.lower() + parts.path
    oauth = {
        "oauth_consumer_key": CONSUMER_KEY,
        "oauth_token": TOKEN_ID,
        "oauth_signature_method": "HMAC-SHA256",
        "oauth_timestamp": str(int(time.time())),
        "oauth_nonce": secrets.token_hex(16),
        "oauth_version": "1.0",
    }
    params = list(oauth.items()) + urllib.parse.parse_qsl(parts.query, keep_blank_values=True)
    normalized = "&".join(k + "=" + v for k, v in sorted((enc(k), enc(v)) for k, v in params))
    base_string = method.upper() + "&" + enc(base_url) + "&" + enc(normalized)
    key = enc(CONSUMER_SECRET) + "&" + enc(TOKEN_SECRET)
    digest = hmac.new(key.encode(), base_string.encode(), hashlib.sha256).digest()
    oauth["oauth_signature"] = base64.b64encode(digest).decode()
    fields = ["realm=\"" + realm + "\""] + [k + "=\"" + enc(v) + "\"" for k, v in oauth.items()]
    return "OAuth " + ", ".join(fields)


if __name__ == "__main__":
    header = tba_header(HTTP_METHOD, URL)
    print("Authorization:", header)
    data = json.dumps({"ping": True}).encode() if HTTP_METHOD in ("POST", "PUT") else None
    req = urllib.request.Request(URL, data=data, method=HTTP_METHOD,
                                 headers={"Authorization": header, "Content-Type": "application/json"})
    with urllib.request.urlopen(req, timeout=60) as resp:
        print(resp.status, resp.read().decode())

// Node.js 18 or later, no packages needed
const crypto = require('crypto');

const ACCOUNT_ID = '1234567';
const HTTP_METHOD = 'POST';
const URL_STRING = 'https://1234567.restlets.api.netsuite.com/app/site/hosting/restlet.nl?script=123&deploy=1';
const CONSUMER_KEY = '<consumer_key>';
const CONSUMER_SECRET = '<consumer_secret>';
const TOKEN_ID = '<token_id>';
const TOKEN_SECRET = '<token_secret>';

const enc = (value) => encodeURIComponent(String(value))
  .replace(/[!'()*]/g, (c) => '%' + c.charCodeAt(0).toString(16).toUpperCase());

function tbaHeader(method, urlString) {
  const realm = ACCOUNT_ID.toUpperCase().replace(/-/g, '_');
  const url = new URL(urlString);
  const baseUrl = url.protocol + '//' + url.host + url.pathname;
  const oauth = {
    oauth_consumer_key: CONSUMER_KEY,
    oauth_token: TOKEN_ID,
    oauth_signature_method: 'HMAC-SHA256',
    oauth_timestamp: Math.floor(Date.now() / 1000).toString(),
    oauth_nonce: crypto.randomBytes(16).toString('hex'),
    oauth_version: '1.0',
  };
  const pairs = Object.entries(oauth).concat(Array.from(url.searchParams.entries()))
    .map(([k, v]) => [enc(k), enc(v)])
    .sort((a, b) => (a[0] === b[0] ? (a[1] < b[1] ? -1 : 1) : (a[0] < b[0] ? -1 : 1)));
  const normalized = pairs.map(([k, v]) => k + '=' + v).join('&');
  const baseString = method.toUpperCase() + '&' + enc(baseUrl) + '&' + enc(normalized);
  const key = enc(CONSUMER_SECRET) + '&' + enc(TOKEN_SECRET);
  oauth.oauth_signature = crypto.createHmac('sha256', key).update(baseString).digest('base64');
  const fields = ['realm="' + realm + '"'].concat(
    Object.entries(oauth).map(([k, v]) => k + '="' + enc(v) + '"'));
  return 'OAuth ' + fields.join(', ');
}

(async () => {
  const header = tbaHeader(HTTP_METHOD, URL_STRING);
  const options = { method: HTTP_METHOD, headers: { Authorization: header, 'Content-Type': 'application/json' } };
  if (HTTP_METHOD === 'POST' || HTTP_METHOD === 'PUT') options.body = JSON.stringify({ ping: true });
  const res = await fetch(URL_STRING, options);
  console.log(res.status, await res.text());
})();