--- title: "NetSuite OAuth 2.0: Complete Setup Guide for Integration Applications" description: Complete guide to setting up OAuth 2.0 in NetSuite — grant types, redirect URIs, scopes, public clients, consent policies, and credential management. image: https://blog.maayins.com/hubfs/Featured%20Oauth%202.0.png --- [![Maayins](https://blog.maayins.com/hubfs/Maayins_logo_white-1.png)](https://maayins.com/) - [Home](https://maayins.com/) - Our Services ### Our Services End-to-end NetSuite & Salesforce solutions for every stage of your journey. [Free Consultation](https://maayins.com/support) [Implementation Services](https://maayins.com/implementation-services) [Support Services](https://maayins.com/support-services) [Integration & Automation](https://maayins.com/integration-services) [Custom Development](https://maayins.com/custom-development) [Managed Services](https://maayins.com/managed-services) [Business Intelligence](https://maayins.com/business-intelligence) - Our Products ### Our Products Purpose-built tools to extend your NetSuite and Salesforce capabilities. [Explore Products](https://maayins.com/netxcel) [NetXcel](https://maayins.com/netxcel) - Company ### Company Learn who we are, what drives us, and find opportunities to join the team. [About Maayins](https://maayins.com/about-us) [About Us](https://maayins.com/about-us) [Why Us](https://maayins.com/why-us) [Careers](https://maayins.com/careers) - Resources ### Resources Resources, guides, and insights to help you get the most from your ERP and CRM. [Visit Blog](https://blog.maayins.com/) [Blogs](https://blog.maayins.com/) [Success Stories](https://maayins.com/success-stories) [Help Center](https://maayins.com/help) - [Contact Us](https://maayins.com/support/) - [Home](https://maayins.com/) - Our Services [Implementation Services](https://maayins.com/implementation-services) [Support Services](https://maayins.com/support-services) [Integration & Automation](https://maayins.com/integration-services) [Custom Development](https://maayins.com/custom-development) [Managed Services](https://maayins.com/managed-services) [Business Intelligence](https://maayins.com/business-intelligence) - Our Products [NetXcel](https://maayins.com/netxcel) - Company [About Us](https://maayins.com/about-us) [Why Us](https://maayins.com/why-us) [Careers](https://maayins.com/careers) - Resources [Blogs](https://blog.maayins.com/) [Success Stories](https://maayins.com/success-stories) [Help Center](https://maayins.com/help) - [Contact Us](https://maayins.com/support/) [Skip to content](https://blog.maayins.com/netsuite-oauth-2.0-complete-setup-guide-for-integration-applications#main-content) Mar 16, 2026, 3:36:45 PM # NetSuite OAuth 2.0: Complete Setup Guide for Integration Applications [Ankita Singh](https://blog.maayins.com/author/ankita-singh) Share: [facebook-f icon](http://www.facebook.com/share.php?u=https://blog.maayins.com/netsuite-oauth-2.0-complete-setup-guide-for-integration-applications) [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://blog.maayins.com/netsuite-oauth-2.0-complete-setup-guide-for-integration-applications) [Twitter icon](https://twitter.com/intent/tweet?url=https://blog.maayins.com/netsuite-oauth-2.0-complete-setup-guide-for-integration-applications) [pinterest-p icon](http://pinterest.com/pin/create/link/?url=https://blog.maayins.com/netsuite-oauth-2.0-complete-setup-guide-for-integration-applications) [envelope icon](mailto:?body=https://blog.maayins.com/netsuite-oauth-2.0-complete-setup-guide-for-integration-applications) OAuth 2.0 is NetSuite's recommended authentication method for new integrations. This guide shows you how to configure it on your integration record: enabling the feature, choosing grant types, setting redirect URIs, selecting scopes, configuring public clients and consent policies, and capturing your credentials safely.   If you have not created an integration record yet, start with our [Integration Record Guide](https://blog.maayins.com/how-to-create-a-netsuite-integration-record-the-first-step-for-tba-oauth-2.0). If you would rather have experts set up and secure the connection, our [NetSuite integration services](https://maayins.com/integration-services) team can help. ![netsuite-oauth-2-setup](https://blog.maayins.com/hs-fs/hubfs/netsuite-oauth-2-setup.jpeg?width=671&height=366&name=netsuite-oauth-2-setup.jpeg) **In this guide:** - [Key takeaways](https://blog.maayins.com/netsuite-oauth-2.0-complete-setup-guide-for-integration-applications#key-takeaways) - [Prerequisites](https://blog.maayins.com/netsuite-oauth-2.0-complete-setup-guide-for-integration-applications#prerequisites) - [Why OAuth 2.0?](https://blog.maayins.com/netsuite-oauth-2.0-complete-setup-guide-for-integration-applications#why-oauth) - [Configuring OAuth 2.0 on the integration record](https://blog.maayins.com/netsuite-oauth-2.0-complete-setup-guide-for-integration-applications#configure) - [Saving and capturing your credentials](https://blog.maayins.com/netsuite-oauth-2.0-complete-setup-guide-for-integration-applications#credentials) - [Extra setup for client credentials (M2M)](https://blog.maayins.com/netsuite-oauth-2.0-complete-setup-guide-for-integration-applications#m2m) - [Complete OAuth 2.0 field reference](https://blog.maayins.com/netsuite-oauth-2.0-complete-setup-guide-for-integration-applications#field-reference) - [Common mistakes to avoid](https://blog.maayins.com/netsuite-oauth-2.0-complete-setup-guide-for-integration-applications#mistakes) - [Related guides](https://blog.maayins.com/netsuite-oauth-2.0-complete-setup-guide-for-integration-applications#related) - [FAQ](https://blog.maayins.com/netsuite-oauth-2.0-complete-setup-guide-for-integration-applications#faq) ## Key Takeaways: NetSuite OAuth 2.0 Setup - OAuth 2.0 supports two grant types in NetSuite: Authorization Code Grant for user sign-in, and Client Credentials (Machine to Machine) for server-to-server automation. - Redirect URIs must use https:// or a custom URL scheme. Plain http:// is not supported. - Select only the scopes your application needs: RESTlets, REST Web Services, SuiteAnalytics Connect or NetSuite AI Connector Service. - The Client ID and Client Secret are shown only once, when you save the record. Copy and store them securely. - Client credentials (M2M) also needs a certificate mapping before it works. Connecting NetXcel? Upload NetXcel's certificate rather than generating your own. ## Prerequisites - **Integration record:** You must already have an integration record. See the [Integration Record Guide](https://blog.maayins.com/how-to-create-a-netsuite-integration-record-the-first-step-for-tba-oauth-2.0). - **OAuth 2.0 feature:** Enabled at Setup \> Company \> Enable Features \> SuiteCloud, under Manage Authentication. - **Permissions:** The Administrator role or the **Integration Application** permission to configure the record. Users who connect need a role with the **Log in using OAuth 2.0 Access Tokens** permission. ## Why OAuth 2.0? OAuth 2.0 is the industry-standard authorization framework and NetSuite's recommended method for new integrations. It offers two grant types: | Grant type | Best for | User interaction | | --- | --- | --- | | **Authorization Code Grant** | Applications where users sign in, such as spreadsheet add-ins and web apps | Yes, through a browser consent screen | | **Client Credentials (Machine to Machine) Grant** | Background processes, scheduled jobs and system-to-system integrations | No | **Tip:** You can enable both grant types on the same integration record, so your application can use whichever flow fits each use case. ## Configuring OAuth 2.0 on the Integration Record Once you have created your integration record, configure the OAuth 2.0 options on the Authentication subtab. **Navigation:** `Setup > Integration > Manage Integrations > [Your Record] > Authentication subtab` ![NetSuite integration record Authentication subtab with OAuth 2.0 configuration options](https://blog.maayins.com/hs-fs/hubfs/Oauth2.0%20Sub.png?width=622&height=297&name=Oauth2.0%20Sub.png) ### Step 1: Choose Your Grant Types 1. Check **Authorization Code Grant** for user-interactive flows. 2. Check **Client Credentials (Machine to Machine) Grant** for server-to-server automation. 3. Check both if your application needs both flows. ![NetSuite OAuth 2.0 grant type checkboxes for authorization code and client credentials](https://blog.maayins.com/hs-fs/hubfs/Grant%20Type.png?width=425&height=312&name=Grant%20Type.png) ### Step 2: Configure the Redirect URI (Authorization Code Grant) 1. Enter one or more valid **Redirect URIs** for your application. 2. Use **https://** or a custom URL scheme (for example, `myapp://callback`). 3. The **http://** scheme is not supported, because transport layer security is required. 4. URIs are validated when you save the record. 5. For example, if you are connecting [NetXcel](https://maayins.com/netxcel), enter: `https://netxcel.maayins.com/taskpane.html#/oauth-callback` ![NetSuite OAuth 2.0 redirect URI field on the integration record](https://blog.maayins.com/hs-fs/hubfs/Redirect%20Url.png?width=405&height=316&name=Redirect%20Url.png) ### Step 3: Select API Scopes 1. Check **RESTlets** if your application calls RESTlets. 2. Check **REST Web Services** if your application uses SuiteTalk REST APIs. 3. Check **SuiteAnalytics Connect** if your application needs SuiteAnalytics Connect access. 4. Check **NetSuite AI Connector Service** if your application needs MCP Tools access. **Warning:** When you use the **NetSuite AI Connector Service** scope, you must clear all other scope boxes (RESTlets, REST Web Services, SuiteAnalytics Connect), all Token-Based Authentication boxes, all Client Credentials boxes and the Client Credentials (Machine to Machine) Grant box. ![NetSuite OAuth 2.0 scope checkboxes: RESTlets, REST Web Services, SuiteAnalytics Connect and AI Connector Service](https://blog.maayins.com/hs-fs/hubfs/Api%20Scopes.png?width=839&height=313&name=Api%20Scopes.png) ### Step 4: Configure a Public Client (Optional) 1. Check **Public Client** if you distribute the integration outside your account and cannot keep a client secret confidential. 2. Public clients do not use the client secret. 3. Set **Refresh Token Validity** (default 48 hours, range 1 to 720 hours). 4. Set **Maximum Time For Token Rotation** (default 168 hours, range 1 to 720 hours). 5. Optionally check **Dynamic Client Registration** if clients need to register without knowing their client ID. **Note:** The Client Credentials (Machine to Machine) Grant does not support public clients. Public client settings apply only to the Authorization Code Grant flow. ### Step 5: Configure the Consent Policy and Branding (Optional) Select an **OAuth 2.0 Consent Policy**: | Policy | Behavior | | --- | --- | | **Always Ask** | Default. The consent screen appears every time the authorization code flow starts. | | **Never Ask** | The consent screen is skipped and the integration is approved by the administrator. Not available with the NetSuite AI Connector Service scope. | | **Ask First Time** | The consent screen appears only on the first authorization. It appears again if scopes change or NetSuite cannot determine the user's role or account. | Optional branding fields shown on the consent screen: - **Application Logo:** JPEG, PNG or GIF from your File Cabinet. - **Application Terms of Use:** PDF from your File Cabinet. - **Application Privacy Policy:** PDF from your File Cabinet. ![NetSuite OAuth 2.0 consent policy and optional branding fields](https://blog.maayins.com/hs-fs/hubfs/Policy.png?width=764&height=148&name=Policy.png) **Connecting a new app to NetSuite?** We set up OAuth 2.0, roles and scopes so your integration is secure from day one. [Talk to an integration expert](https://maayins.com/support) ## Saving and Capturing Your Credentials After you configure the OAuth 2.0 settings, click **Save**. The confirmation page shows your **Client ID** and **Client Secret**. ![NetSuite integration record confirmation page showing the OAuth 2.0 client ID and client secret](https://blog.maayins.com/hs-fs/hubfs/Oauth2.0%20Confirmation.png?width=720&height=407&name=Oauth2.0%20Confirmation.png) **Warning:** The Client ID and Client Secret are displayed **only once**. If you leave the page without copying them, you must reset the credentials on the integration record, which invalidates the previous values. Treat them like passwords and store them in a secure vault. ### OAuth 2.0 Credentials Summary | Credential | Source | When it is generated | | --- | --- | --- | | **Client ID** | Integration record | When you save the integration record | | **Client Secret** | Integration record | When you save the integration record | | **Access Token** | OAuth 2.0 flow | Programmatically, through the authorization code or client credentials flow | | **Refresh Token** | OAuth 2.0 flow | Returned with the access token (authorization code grant only) | ## Extra Setup for Client Credentials (M2M) Checking the Client Credentials grant on the integration record is not enough on its own. NetSuite also needs to know which entity and role the machine-to-machine connection runs as, and which certificate it signs with. **Connecting NetXcel?** Don't generate your own certificate. NetXcel signs its requests with its own private key, so you upload NetXcel's public certificate instead: - Download it from [netxcel.maayins.com/assets/NetXcel\_NetSuite\_M2M.pem](https://netxcel.maayins.com/assets/NetXcel_NetSuite_M2M.pem) (issued to Maayins Technologies, valid until 16 October 2028). - Check the SHA-256 fingerprint if you want to confirm the file: `67:CE:73:D9:66:BD:3D:05:7F:19:CA:96:FD:24:47:59:BC:09:60:F3:3B:AA:C0:42:5E:7E:38:B3:6F:91:A7:B9` - Then follow steps 2 and 3 below, and enter the Certificate ID NetSuite shows in NetXcel's connection form. For your own application: 1. Generate a certificate and private key for your application. Keep the private key on your server. (Connecting NetXcel? Skip this step and use NetXcel's certificate above.) 2. Go to `Setup > Integration > Manage Authentication > OAuth 2.0 Client Credentials (M2M) Setup` and click **Create New**. 3. Create a mapping that links the **entity**, **role** and **application** (your integration record), upload the public certificate, and save. Copy the **Certificate ID** shown in the list. 4. Your application then signs a JWT with the private key to request an access token. (With NetXcel, this happens automatically once the connection is saved.) Each integration record can have up to five active certificates, and the certificate setup is cleared when a sandbox account is refreshed, so plan to redo it after each refresh. Certificates also expire, so a new one has to be uploaded before the old one lapses. See Oracle's [OAuth 2.0 Client Credentials Setup](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_162686838198.html) for details. ## Complete OAuth 2.0 Field Reference Here is every OAuth 2.0 field on the Authentication subtab: | Field | Description | | --- | --- | | **Authorization Code Grant** | Enables the OAuth 2.0 authorization code flow for user-interactive integrations. | | **Redirect URI** | Where your application receives the user after authorization. Must use https:// or a custom scheme. Example: `https://netxcel.maayins.com/taskpane.html#/oauth-callback` | | **Public Client** | For distributed integrations where client secret confidentiality cannot be guaranteed. Enables refresh token rotation settings. | | **Refresh Token Validity** | How long refresh tokens remain valid (1 to 720 hours, default 48). Public clients only. | | **Maximum Time For Token Rotation** | How long before users must reauthenticate (1 to 720 hours, default 168). Public clients only. | | **Dynamic Client Registration** | Lets clients register without knowing their client ID. Requires Public Client. Returns the client ID through a matching redirect URI. | | **Client Credentials (Machine to Machine) Grant** | Enables machine-to-machine authentication without user interaction. Cannot be used with Public Client. | | **RESTlets** | Scope for calling RESTlets. | | **REST Web Services** | Scope for SuiteTalk REST APIs. | | **SuiteAnalytics Connect** | Scope for SuiteAnalytics Connect. | | **NetSuite AI Connector Service** | Scope for MCP Tools through the AI Connector Service. Requires all other scopes, TBA boxes, Client Credentials boxes and the Client Credentials Grant to be cleared. | | **Consent Policy** | Controls consent screen behavior: Always Ask (default), Never Ask or Ask First Time. | ## Common Mistakes to Avoid - Leaving the confirmation page before copying the Client ID and Client Secret. - Using an http:// redirect URI, or one that does not exactly match what the application sends. - Checking every scope "just in case" instead of only the ones the application needs. - Forgetting the **Log in using OAuth 2.0 Access Tokens** permission on the user's role. - Enabling the Client Credentials grant without creating the M2M certificate mapping. - Forgetting to redo the M2M certificate setup after a sandbox refresh. - Uploading a self-generated certificate for a NetXcel connection instead of NetXcel's own certificate. - Combining the AI Connector Service scope with other scopes or TBA settings. ## Related Guides - [How to Create a NetSuite Integration Record](https://blog.maayins.com/how-to-create-a-netsuite-integration-record-the-first-step-for-tba-oauth-2.0): the essential first step before configuring any authentication method. - [NetSuite TBA: Complete Setup and Token Management Guide](https://blog.maayins.com/step-by-step-guide-to-configuring-netsuite-tba-creating-access-tokens-assigning-tokens-to-users-and-managing-the-token-lifecycle-including-revocation): TBA configuration and the token lifecycle, step by step. ## Frequently Asked Questions ### Should I use OAuth 2.0 or TBA for a new NetSuite integration? NetSuite recommends OAuth 2.0 for new integrations. Token-Based Authentication still works for existing integrations, but OAuth 2.0 is the better choice when you start fresh. ### Can I enable both grant types on one integration record? Yes. You can check both Authorization Code Grant and Client Credentials (Machine to Machine) Grant on the same record. ### Why is my redirect URI rejected? NetSuite requires https:// or a custom URL scheme. Plain http:// is not supported, and the URI must match what your application sends. ### What if I lose the client secret? It is shown only once. Reset the credentials on the integration record to get a new client ID and secret, then update every application that uses the old values. ### Does the client credentials grant return a refresh token? No. Refresh tokens come only with the authorization code grant. Client credentials applications request a new access token when the old one expires. ### Can a public client use the client credentials grant? No. The Client Credentials (Machine to Machine) Grant does not support public clients. ### Which certificate do I upload when connecting NetXcel with Machine to Machine? NetXcel's own public certificate, from [netxcel.maayins.com/assets/NetXcel\_NetSuite\_M2M.pem](https://netxcel.maayins.com/assets/NetXcel_NetSuite_M2M.pem). NetXcel signs its token requests with the matching private key, so a certificate you generate yourself won't work with NetXcel. ## Connect NetSuite to Your Spreadsheets NetXcel supports both OAuth 2.0 and TBA to pull live NetSuite data into Excel and Google Sheets. For custom connections between NetSuite and other systems, our team offers [NetSuite integration services](https://maayins.com/integration-services). [Try NetXcel](https://maayins.com/netxcel) [NetSuite](https://blog.maayins.com/tag/netsuite), [OAuth 2.0](https://blog.maayins.com/tag/oauth-2-0), [NetSuite Setup](https://blog.maayins.com/tag/netsuite-setup) ## Related posts [![](https://blog.maayins.com/hs-fs/hubfs/Featured%20Integration%20Record.png?height=200&name=Featured%20Integration%20Record.png)](https://blog.maayins.com/how-to-create-a-netsuite-integration-record-the-first-step-for-tba-oauth-2.0) [NetSuite](https://blog.maayins.com/tag/netsuite), [Integration](https://blog.maayins.com/tag/integration), [OAuth 2.0](https://blog.maayins.com/tag/oauth-2-0), [NetSuite Setup](https://blog.maayins.com/tag/netsuite-setup) ## [How to Create a NetSuite Integration Record: The First Step for TBA & OAuth 2.0](https://blog.maayins.com/how-to-create-a-netsuite-integration-record-the-first-step-for-tba-oauth-2.0) [Ankita Singh](https://blog.maayins.com/author/ankita-singh) Mar 16, 2026, 1:30:55 PM Before any external application can talk to your NetSuite account, it needs an integration record.... [Read more](https://blog.maayins.com/how-to-create-a-netsuite-integration-record-the-first-step-for-tba-oauth-2.0) [![](https://blog.maayins.com/hs-fs/hubfs/Featured%20TBA.png?height=200&name=Featured%20TBA.png)](https://blog.maayins.com/step-by-step-guide-to-configuring-netsuite-tba-creating-access-tokens-assigning-tokens-to-users-and-managing-the-token-lifecycle-including-revocation) [NetSuite](https://blog.maayins.com/tag/netsuite), [Integration](https://blog.maayins.com/tag/integration), [NetSuite Setup](https://blog.maayins.com/tag/netsuite-setup), [Token Based Authentication](https://blog.maayins.com/tag/token-based-authentication) ## [NetSuite Token-Based Authentication (TBA): Complete Setup & Token Management Guide](https://blog.maayins.com/step-by-step-guide-to-configuring-netsuite-tba-creating-access-tokens-assigning-tokens-to-users-and-managing-the-token-lifecycle-including-revocation) [Ankita Singh](https://blog.maayins.com/author/ankita-singh) Mar 16, 2026, 1:48:35 PM Effective collections management is critical for healthy cash flow. Many businesses on NetSuite... [Read more](https://blog.maayins.com/step-by-step-guide-to-configuring-netsuite-tba-creating-access-tokens-assigning-tokens-to-users-and-managing-the-token-lifecycle-including-revocation) [![](https://blog.maayins.com/hs-fs/hubfs/SuiteScript%202.1%20migration%20overview.jpeg?height=200&name=SuiteScript%202.1%20migration%20overview.jpeg)](https://blog.maayins.com/suitescript-2.1-migration-guide-timeline-testing-and-checklist) [NetSuite](https://blog.maayins.com/tag/netsuite), [SuiteScript](https://blog.maayins.com/tag/suitescript), [NetSuite Best Practices](https://blog.maayins.com/tag/netsuite-best-practices), [NetSuite Upgrades](https://blog.maayins.com/tag/netsuite-upgrades) ## [SuiteScript 2.1 Migration Guide: Timeline, Testing, and Checklist](https://blog.maayins.com/suitescript-2.1-migration-guide-timeline-testing-and-checklist) [Tushar Rai](https://blog.maayins.com/author/tushar-rai) Sep 29, 2026, 9:07:30 PM That “Update Needed” banner in NetSuite is a prompt to examine the scripts your business depends... [Read more](https://blog.maayins.com/suitescript-2.1-migration-guide-timeline-testing-and-checklist) --- ![Maayins Logo](https://blog.maayins.com/hubfs/Maayins_logo_white-1.png) CONTACT [support@maayins.com](mailto:support@maayins.com) ### Quick Links - [Home](https://maayins.com/) - [Product](https://maayins.com/netxcel) - [Careers](https://maayins.com/careers) - [Pricing](https://maayins.com/pricing) ### Support - [Company](https://maayins.com/about-us) - [Press media](https://maayins.com) - [Our Blog](https://blog.maayins.com) - [Contact Us](https://maayins.com/support) ### Newsletter Subscribe to receive future updates [English](https://maayins.com) [Privacy Policy](https://maayins.com/policy) [Support](https://maayins.com/support) © Maayins Technologies. All rights reserved ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Ankita Singh", "url" : "https://blog.maayins.com/author/ankita-singh" }, "dateModified" : "2026-10-17T20:16:57.154Z", "datePublished" : "2026-03-16T20:36:45.000Z", "headline" : "NetSuite OAuth 2.0: Complete Setup Guide for Integration Applications", "image" : [ "https://blog.maayins.com/hubfs/Featured%20Oauth%202.0.png" ], "mainEntityOfPage" : { "@id" : "https://blog.maayins.com/netsuite-oauth-2.0-complete-setup-guide-for-integration-applications", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject" }, "name" : "Maayins Technologies" } } ```