Authentication for RESTlets
RESTlets must use REST URLs to connect to NetSuite. If the RESTlet call comes from an external client, the URL must include a domain specific to your NetSuite account. To handle this task, you can also use the roles service, as described in The REST Roles Service.
-
For a RESTlet called from an external client, you can use OAuth or the NetSuite-specific method NLAuth in the HTTP Authorization header. OAuth uses token-based authentication (TBA) or OAuth 2.0 to access resources on behalf of a user, without sharing login credentials. You should use OAuth 2.0 for RESTlet authentication. For more information, see the following topics:
-
OAuth 2.0 for Integration Application Developers for OAuth 2.0.
-
The Three-Step TBA Authorization Flow for TBA.
Warning:Support for TBA for RESTlets ends in NetSuite 2028.2. Update your integrations to use OAuth 2.0.
NLAuth passes in NetSuite login credentials such as company ID, user name, password, role, and application ID. See Using User Credentials for RESTlet Authentication. NetSuite doesn't support user credentials authentication for new RESTlets.
Warning:Support for user credentials for RESTlets ends in NetSuite 2027.1. Update your integrations to use OAuth 2.0.
-
-
For a RESTlet called from a client hosted by the same NetSuite account that hosts the RESTlet, you don't need to pass authentication information in the HTTP request. This doesn't apply to Suitelets. A check for all valid NetSuite session cookies occurs, and this existing session is reused.
RESTlet authentication can use either the HTTP Authorization header or all session cookies, but not both. Ensure that your script uses only one form of authentication.