Authentication
NetSuite 2026.2 includes the following enhancements to authentication features:
-
End of Support for NLAuth Authentication for RESTlets and Unique Use Cases in 2027.1
-
PKCE Required for OAuth 2.0 Authorization Code Grant Flow in NetSuite 2027.1
Passwordless Authentication with Passkeys
As of July 13, 2026, all NetSuite users can set up passwordless authentication with a passkey. When you set up a passkey, you can use it the next time you log in your NetSuite account, instead of using a password.
Passkeys are available only for logging in to the account. You still need a password for other actions inside NetSuite.
For more information, see Passkeys.
Passkey as a 2FA Authenticator
As of NetSuite 2026.2, users who set up a passkey that complies with FIDO2 specification can use it as a second authentication factor during login.
Administrators can disable this feature, which will require the users with FIDO2 compliant passkeys to use an authenticator app for 2FA.
NetSuite prompts users to enter a code from an authenticator app every three months to ensure that users have a working 2FA setup. This is needed for 2FA authentication in cases where users can't use a passkey.
End of Support for NLAuth Authentication for RESTlets and Unique Use Cases in 2027.1
Previously, NLAuth served as a RESTlet authentication method before the introduction of the Token-based Authentication and OAuth 2.0 features.
As of 2027.1, all integrations that use NLAuth as an authentication method will stop working. You should switch to OAuth 2.0 as soon as possible. For more information, see OAuth 2.0.
This end of support doesn't include the existing integrations that use the IssueToken endpoint.
End of Support for New Integrations Using the Token-based Authentication (TBA) feature in NetSuite 2027.1
As of NetSuite 2027.1, you won't be able to create new integrations that use TBA for authentication. This includes both the IssueToken endpoint, and the three-step TBA authorization flow.
This limitation is in preparation for the end of support for the TBA feature, tentatively planned for the 2028.1 release. For more information, Preparing for Token-based Authentication (TBA) End of Support.
Existing integrations will continue to work until the final end of support of the TBA feature. You should switch to OAuth 2.0 as soon as possible. For more information, see OAuth 2.0.
PKCE Required for OAuth 2.0 Authorization Code Grant Flow in NetSuite 2027.1
Previously, PKCE was an optional security extension for the OAuth 2.0 authorization code grant flow that used a private client. PKCE was required only for flows that used a public client.
As of NetSuite 2027.1, PKCE parameters will be required for all new integrations that use the OAuth 2.0 authorization code grant flow. Existing integrations without PKCE will remain functional.