Secrets Management
You can store, manage, and reference API secrets securely in NetSuite at Setup > Company > Preferences > API Secrets. You can then reference these secrets in third party integrations, preventing the need for plaintext secrets in scripts. API secrets include hashes, passwords, keys, and other secrets for managing digital authentication credentials. Secrets up to 1,000,000 characters are accepted.
Secret owners can set criteria to limit access for other users or allow access for a specific SuiteApp. Secrets are only referenced by script ID, and the password value cannot be displayed. A secret cannot be used by more than one SuiteApp. If you need to share a password across multiple SuiteApps, you must create multiple secrets with the same password.
Only SuiteScript 2.x APIs can use the secret. For a list of supported SuiteScript 2.x modules, see Supported SuiteScript 2.x modules.
A secret can only be updated in the same account where it was created. Ensure that you do not enter a secret in an account that will be deleted in the future; when a shared secret is deleted, you will be unable to create another shared secret with same id.
In SDF, you can add the customization object custsecret_example_id.xml, which contains the line <secret scriptid="custsecret_example_id"/> For more information, see SDF Custom Object and File Development in SuiteCloud Projects.
Only administrators and users with the Secrets Management permission can manage secrets. For more information, see Access to Secrets.
To maintain higher security in comparison to using the username and password combination, you can use an authentication API based on OAuth.