NetSuite Token-Based Authentication Setup Checklist

0%

0 of 29 items complete

12 critical items still open - these are the highest-risk gaps.

Download checklist:

1. Features

Enable Token-Based Authentication under Setup > Company > Enable Features > SuiteCloudCRITICALEnable REST Web Services if you will call RESTCRITICALEnable SOAP Web Services only if a legacy integration needs itEnable the feature in sandbox and production separately

2. Integration record

Create the record at Setup > Integration > Manage Integrations > NewCRITICALName it after the system and environment, for example ERPSync SandboxTick Token-Based Authentication on the recordCRITICALClear unneeded authentication options such as TBA authorization flow if not usedSave and copy the Consumer Key and Consumer Secret immediatelyCRITICALStore the secrets in a vault, since the secret is shown only once

3. Role and user

Create a dedicated integration role rather than reusing an administrator roleCRITICALAdd the Log in using Access Tokens permissionCRITICALAdd REST Web Services or SOAP Web Services permission as neededCRITICALAdd only the record and list permissions the integration needsAssign the role to a dedicated integration userMake sure the user is active, with no two-factor requirement that blocks token use

4. Access token

Create the token at Setup > Users/Roles > Access Tokens > NewCRITICALSelect the integration application, the user and the roleSave and copy the Token ID and Token Secret immediatelyCRITICALRecord who owns the token and when it should be rotatedRevoke tokens that belong to people who left the project

5. Request and testing

Build the OAuth 1.0 header with realm set to the account ID, using uppercase and underscore for sandbox such as 1234567_SB1CRITICALUse HMAC-SHA256 as the signature methodCRITICALGenerate a fresh nonce and current timestamp for each requestSend consumer key, token, signature method, timestamp, nonce, version 1.0 and signatureTest with a simple GET against a REST record URLCheck the system clock on the calling server for driftDiagnose failures using the Login Audit Trail and the error codeRepeat the full setup in production, with its own integration record and tokens

Items marked critical are the usual causes of invalid signature, invalid login and insufficient permission errors. Confirm menu paths against your NetSuite release, and review Oracle documentation on OAuth 2.0 as an alternative for new integrations.

NetSuite access review

Optional review of integration roles, tokens and permissions for least-privilege access.

Optional. The tool and every export work without this. No spam.

How to use the checklist

Work through the groups in order for each environment. Tick items as you complete them and export the result for your change record. Treat the critical items as gates, particularly the permission, the one-time secrets and the realm format, because they cause most of the failed first calls. Do sandbox first, then repeat in production with separate integration records and tokens.

The four credentials

A TBA call uses four secrets and an account ID. The consumer key and consumer secret come from the integration record and identify the application. The token ID and token secret come from the access token and identify the user and role. The signature is computed from these values, a nonce and a timestamp, and the realm in the header carries the account ID.

Consumer key and secret: integration record
Token ID and secret: access token
Realm: account ID, with sandbox written like 1234567_SB1
Signature method: HMAC-SHA256

Reading the errors

Invalid signature usually means the wrong secret, wrong realm, a wrong signature method or clock drift. Invalid login attempt points to a role missing the Log in using Access Tokens permission or an inactive user. Insufficient permission means the role lacks a web services permission or the permission for the record. Check the Login Audit Trail, which usually states the reason more clearly than the HTTP response.

Common mistakes

Teams lose the one-time secrets and must create a new token, use the URL form of the account ID in the realm instead of the uppercase underscore form, grant an administrator role for convenience, and forget that a sandbox refresh can drop tokens and integration records. Rotate tokens on a schedule and keep an owner for each.

Frequently Asked Questions

What is token-based authentication in NetSuite?

It is an OAuth 1.0 based method where an integration signs each request with a consumer key and secret plus a token and secret, so no user password is stored or sent.

Why do I get an invalid signature error?

Common causes are a wrong secret, the realm not matching the account ID format, the wrong signature method, or a server clock that is out of sync. Recompute the signature and check each value carefully.

Which permission is required for tokens?

The role needs Log in using Access Tokens, plus REST Web Services or SOAP Web Services permission, and the record permissions the integration uses. The user also needs the role assigned.

Should I use OAuth 2.0 instead?

OAuth 2.0 is supported for REST and is worth evaluating for new integrations. TBA remains common and works well for server to server calls. Check Oracle documentation for current guidance on your account.

If you want NetSuite data available to AI without handing out broad credentials, Netray sets up read-only access with a least-privilege role and shows every query.

Talk to an Expert Explore More Free Tools

Related Tools

NetSuite

More NetSuite tools

See all

NetSuite Token-Based Authentication (TBA) Setup Checklist