- Token-based authentication covers Pulling Data via Saved Search and Sending Data. These two share the same integration record and credentials, you only need to set this up once.
- OAuth 2.0 covers Pulling Data via SuiteQL only. This uses a separate integration record from the token-based one above.
- Client Credentials with Private Key JWT is for connecting to NetSuite’s REST API through Prowork’s API steps (Pull from an API, Send to an API, Enrich with API). It doesn’t require re-authorizing every 7 days. See Authorizing with Client Credentials (Private Key JWT).
Creating a NetSuite role
The permissions on the role applied to your integration determine which saved searches, transactions, lists, and results you’ll be able to access in Prowork. Confirm the role has access to every object you plan to use before moving on. Missing permissions are one of the most common causes of support tickets later.You’ll also need your own NetSuite user to have permissions to create new integrations, manage access tokens, and edit roles. These are needed to generate the credentials below, separately from whatever role/permissions you’re setting up for Prowork itself.
Transactions
- Any specific transaction types you need (sales orders, purchase orders, transfer orders, etc.)
Find transaction
Reports
- Any specific report types you need
Lists
- Any specific lists you need (items, locations, companies, customers, etc.)
Perform search,persist search, andpublish search
Setup
- Log in using Access Tokens
- SOAP Web Services (required for Pulling Data via Saved Search)
- REST Web Services (required for Pulling Data via SuiteQL and Sending Data)
Custom Records
- Any specific custom record objects you need
Authorizing token-based access (Pulling Data via Saved Search and Sending Data)
Pulling Data via Saved Search and Sending Data both use token-based authentication and share the exact same NetSuite integration record and credentials. You only need to do this setup once. You’ll create an integration record and an access token in NetSuite, then enter the resulting credentials in Prowork.Creating a NetSuite integration
Follow this path in the NetSuite UI: Setup > Integration > Manage Integrations > New1
Name the integration
Specify an integration name and ensure the status is set to Active.
2
Enable token-based authentication
Under Authentication, check Token-Based Authentication.
3
Leave other options unchecked
Leave TBA: Issuetoken Endpoint and TBA: Authorization Flow unchecked.
4
Save the record
Save the record.
Creating a new access token
Once the role, user, and integration exist, generate the access token Prowork will authenticate with. Follow this path in the NetSuite UI: Setup > Users/Roles > Access Tokens > New Access Token1
Select the integration, user, and role
Select the integration you created above, along with the desired user and role.
2
Save
Click Save.
Entering credentials in Prowork
1
Log in to Prowork
Log in to Prowork.
2
Add a Pull from NetSuite step
Add a Pull from NetSuite step onto your canvas. You can do this by describing what you want to Prowork’s chat, or by navigating to Integrations in the top left of your canvas and selecting Pull from NetSuite.
3
Open the step
Double-click into the step once it’s on the canvas to open it.
4
Authorize NetSuite
Click Authorize NetSuite on the left side of the step window.
5
Add a new account
Click Edit Accounts, then Add a new account.
6
Gather your credentials
Gather the Account ID, Consumer Key/Secret, and Token ID/Secret from the steps above.
7
Connect
Enter each credential and click Connect.
Authorizing Pulling Data via SuiteQL
Pulling Data via SuiteQL uses OAuth 2.0 with Authorization Code Grant. This can live on the same NetSuite integration record as the token-based setup above, or on its own, depending on what you’re setting up:- Already have the token-based integration set up above, and want to add SuiteQL? Go back to that same integration record (Setup > Integration > Manage Integrations) and additionally enable the OAuth 2.0 settings below on it.
- Setting up SuiteQL only, from scratch? Create a new integration record (Setup > Integration > Manage Integrations > New) and just check the OAuth 2.0 boxes below. You don’t need Token-Based Authentication checked unless you’re also using Pulling Data via Saved Search or Sending Data.
1
Enable Authorization Code Grant
Under OAuth 2.0, check Authorization Code Grant.
2
Set the scope
Under Scope, check REST Web Services.
3
Set the Redirect URI
Set the Redirect URI to
https://parabola.io/api/auth/netsuite_oauth/callback.4
Save
Save to generate your Client ID and Client Secret, shown only once.
Connecting in Prowork
1
Add a Pull from SuiteQL step
Add a Pull from SuiteQL step to your flow.
2
Authorize
Click Authorize and enter your Account ID, Client ID, and Client Secret.
Authorizing with Client Credentials (Private Key JWT)
NetSuite’s OAuth 2.0 Authorization Code tokens expire after 7 days and can’t be refreshed, so connections that use them need re-authorizing every week. NetSuite’s Client Credentials (Machine to Machine) flow avoids this. Prowork signs each token request with a private key you control and gets a fresh access token on every run, with nothing for anyone to re-authorize. Use this with Prowork’s API steps pointed at NetSuite’s REST API.Step 1: Generate a certificate and private key
Create an X.509 certificate and matching private key. NetSuite accepts certificates valid for up to 2 years. For example, with OpenSSL:private-key.pem somewhere secure. You’ll paste it into Prowork in Step 4. You’ll upload certificate.pem to NetSuite in Step 3.
Step 2: Enable Client Credentials on your integration record
Go to Setup > Integration > Manage Integrations and open your integration record, or create a new one.1
Under OAuth 2.0, check Client Credentials (Machine to Machine) Grant.
2
Under Scope, check REST Web Services.
3
Save, and record the Client ID shown once after saving.
Step 3: Map the certificate in NetSuite
Go to Setup > Integration > OAuth 2.0 Client Credentials (M2M) Setup and click Create New.1
Select the Entity (the user Prowork should run as), the Role from Creating a NetSuite role, and the Application (your integration record).
2
Upload
certificate.pem.3
Save, and record the Certificate ID.
Step 4: Connect in Prowork
1
Add a Pull from an API, Send to an API, or Enrich with API step and open its settings.
2
Under Authentication, choose Expiring Access Token, then set Authentication Method to Private Key JWT.
3
Set the Authentication Token Request URL to
https://<ACCOUNT_ID>.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token, replacing <ACCOUNT_ID> with your account ID (for sandboxes, use the dash format, for example 1234567-sb1).4
Enter your Private Key (the contents of
private-key.pem), Key ID (the Certificate ID from Step 3), and Client ID (from Step 2). Set Signing Algorithm to PS256 and Scope to rest_webservices.5
Click Authorize.
The connection doesn’t need re-authorizing, but the certificate itself expires on the date you set in Step 1, at most 2 years out. Before then, generate a new certificate, add it in the M2M setup, and update the private key in Prowork.
Sharing your NetSuite connection with teammates
You don’t need every teammate to generate their own NetSuite tokens. Once one person has authorized a NetSuite connection in Prowork, that authentication can be shared with specific teammates or the whole team:1
Open Edit Accounts
On the Pull from NetSuite (or Send to NetSuite) step, click Edit Accounts.
2
Open sharing settings
Find the authorization, click the three dots (…), then Sharing settings.
3
Choose who can use it
Share it with a specific teammate or the whole team, and choose whether they can use it or also edit it.
web services only role from Creating a NetSuite role above.
Helpful tips
- Token-based and OAuth 2.0 connections expire. When one lapses, steps on that connection tell you to reconnect the account. Open the step, click Edit accounts, and re-enter the credentials. This is expected NetSuite behavior, not a failure in your flow. If you’re connecting through Prowork’s API steps and want to avoid re-authorizing, use Client Credentials with Private Key JWT instead.
Troubleshooting authorization
Authentication fails / connection won’t authorize (token-based: Pulling Data via Saved Search, Sending Data)- Confirm the role has Log in using Access Tokens and SOAP Web Services set to Full.
- If connecting to a Sandbox account, use the Sandbox account ID and confirm it exactly matches the URL you see when logging in to NetSuite (e.g.
12345-sb1).
For OAuth-based authorization failures (Pulling Data via SuiteQL), Log in using Access Tokens doesn’t apply. Check the REST Web Services scope instead, per Authorizing Pulling Data via SuiteQL above.
getaddrinfo ENOTFOUND message
1234567 instead of 1234567-sb1). Double-check the Account ID against your NetSuite URL and re-authorize.