Articles in this section

Set up an automatic token-based auth connection to NetSuite

Stephen Brandt
Updated

NetSuite documentation: Authentication

One additional NetSuite authentication type is available: token-based (manual). However, if you are installing an integration app or adding a connection to one, you must establish your connection to NetSuite according to the integration app’s instructions. For example, see Install Salesforce - NetSuite (IO).

A. Set up a NetSuite connection

Start establishing a connection to NetSuite in either of the following ways:

  • From the Resources menu, select Connections. Then, click + Create connection at the top right.

    – or –

  • In Flow builder, while creating a new flow step or adding a step in an existing flow, you can click the plus sign (+) next to the Connection settings.

The Create connection pane opens with required and advanced settings.

In the Application list, select NetSuite.

360088493331-ns-connect-1.png

B. Describe your NetSuite connection

First, name your connection in the General settings:

360088494271-ns-connect-2.png

Name (required): Provide a clear and distinguishable name. Throughout integrator.io imports and exports, you will have the option to choose this new connection, and a unique identifier will prove helpful later when selecting among a list of connections that you’ve created.

Application (required, non-editable): A reminder of the app you’re editing.

C. Supply required NetSuite account information

At this point, you’re presented with options for providing NetSuite authentication.

TokenBasedAuthAutomatic.png

Authentication type (required): Select Token Based Auth (Automatic).

Note

Before you choose the authentication type as Token Based Auth (Automatic) in integrator.io, in NetSuite:

  • Enable the Token-based authentication feature
  • Create a copy of the Administrator or Celigo integrator.io Full Access Role w/o 2FA [Locked] roles. Go to Setup > Users/Roles > Manage roles ; then click Customize corresponding to the role Celigo integrator.io Full Access Role w/o 2FA [Locked ]; and save the role (clone) with a different name.

Note

If MCP end users will authorize this connection (for example, for NetSuite Business Insights with end-user authentication) and its tools use NetSuite's REST API and SuiteQL, don't point end users at the Administrator role or at a copy of the Celigo integrator.io Full Access Role w/o 2FA [Locked] role. The Celigo role connects and shows Online, but every REST and SuiteQL request fails with a 401 Invalid login attempt error because the role doesn't include REST Web Services. Copying the Administrator role gives each end user far more access than the tools need. Instead, each end user's own NetSuite role must include the following permissions:

  • Log in using Access Tokens or User Access Tokens. A user with the User Access Tokens permission doesn't also need the Log in using Access Tokens permission. See Set Up Token-based Authentication Roles.
  • REST Web Services
  • SuiteAnalytics Workbook, required for SuiteQL
  • View access to the records that the tools read

Each end user selects this role on NetSuite's consent page by clicking Change Role. A role that is assigned while the user is signed in to NetSuite appears on the consent page only after the user signs in to NetSuite again.

Account ID (required): Enter your account ID. Contact NetSuite support to obtain the ID if it’s not exposed in the following steps:

NS.png

Note

Make sure you use underscore (_) instead of dash (-) while you enter your account ID. For example, 12345_SB1.

How to retrieve account ID

  1. Sign into your NetSuite account.
  2. Click Setup.
  3. Navigate to Company > Integration > SOAP web services preferences > Primary information.
  4. Copy Account ID.

D. Edit advanced NetSuite settings

Before continuing, you have the opportunity to provide additional configuration information, if needed, for the NetSuite connection.

360088456812-ns-connect-3.png

Link SuiteScript integrator (optional): This setting appears only when you edit a NetSuite connection. Prior to integrator.io, NetSuite integrations built by Celigo ran directly inside your NetSuite account via a managed bundle. If you are still running any of these older integrations, check this box to link integrator.io to your NetSuite account.

Optional concurrency and rate limit settings

  • Borrow concurrency from (optional): Select another connection from the list. By default, all data flowing through a connection record is submitted to the respective endpoint application at the concurrency level configured for that connection record. There are cases, however, where multiple integrator.io connections need to share the same concurrency level, and this field allows you to specify which connection you would like to borrow from. With borrowed concurrency, the data flowing through both connections will be submitted to the endpoint application together, via a shared concurrency model.

  • Auto-recover rate limit errors: This setting is enabled by default with a predefined value for Target concurrency level. You can disable the setting if required. To set or make changes in any of these settings, you must have admin or manage permissions.

    • Target concurrency level: This field is shown only if Auto-recover rate limit errors is enabled. Change the predefined value as required to limit the number of concurrent API requests allowed by the connection resource. See also, Setting currency level on a connection.
    • Concurrency level: When Auto-recover rate limit errors is checked, you can't modify the concurrency level because it matches the value set by the connected platform's runtime. When Auto-recover rate limit errors is not checked, you can enter a value to limit the number of concurrent API requests allowed by the connection resource. See also, Setting currency level on a connection.

WSDL version: New Web Services Description Language (WSDL) versions are available when creating or editing a NetSuite connection. A WSDL is simply an XML document describing the latest versions of a web service. By choosing a WSDL you are choosing to upgrade to a new or older version of NetSuite’s web services.

New_WSDL.png

You can choose between versions 2025.1 and 2023.1. Versions 2023.1 and later support both manual and automatic token-based auth connections. Switching versions for an existing connection might have an impact on running flows, and we recommend reviewing NetSuite’s release notes prior to making a change. We recommend using the latest WSDL version.

E. Save and test the connection

Once you have configured the NetSuite connection, click Save & authorize. You will then be asked to sign into your NetSuite account to complete the connection.

If NetSuite authorizes your login, the new connection is now successfully added to your account in Online status. It will be applied to the current source or destination app, if you created it within a flow. Otherwise, you may proceed to register the connection with an integration.

Read more about this connector: