NetSuite TBA Deprecation: What n8n Users Need to Know

Does this affect your n8n–NetSuite integration?

n8n integrations with NetSuite can authenticate via Token-Based Authentication (TBA) — NetSuite's OAuth 1.0 implementation — or via OAuth 2.0. To check which your integration uses, open NetSuite → Setup → Integration → Manage Integrations, find your integration record, and click the Authentication tab. If Token-Based Authentication is checked and OAuth 2.0 is not, you are on TBA and need to migrate. If OAuth 2.0 is already checked, you are not affected by the TBA deprecation.

Oracle NetSuite has officially announced the deprecation of TBA across SOAP web services, REST web services, and RESTlets. The replacement is OAuth 2.0 machine-to-machine (M2M), using the client credentials grant type — and it is actually simpler to implement than TBA.

The deprecation timeline

Not affected: SuiteAnalytics Connect (ODBC/JDBC) is explicitly excluded from this deprecation.

TBA vs OAuth 2.0 M2M: what actually changes

OAuth 2.0 client credentials is simpler than TBA — not more complex. Here is the comparison:

How OAuth 2.0 client credentials works in n8n

The client credentials grant is a two-step process your credential configuration handles automatically:

1. Token request: n8n sends your Client ID and Client Secret to NetSuite's token endpoint and receives a Bearer token.
2. API call: Every HTTP request to NetSuite includes Authorization: Bearer <token> instead of the OAuth 1.0 signature.

The NetSuite token endpoint for OAuth 2.0:

POST https://<accountId>.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_id=<your_client_id>
&client_secret=<your_client_secret>

The response contains an access_token valid for approximately 60 minutes. n8n's OAuth2 API credential type handles the token request and automatic refresh — you configure it once and n8n manages the token lifecycle from there.

Setting up OAuth 2.0 in NetSuite for n8n

You can set this up in your NetSuite sandbox today to test before your production workflows need to migrate:

1. Go to Setup → Integration → Manage Integrations → New
2. Name it (e.g. "n8n OAuth 2.0"), enable OAuth 2.0, select Machine-to-Machine as the grant type, check Client Credentials
3. Save — NetSuite generates a Client ID and Client Secret. Copy both immediately; the secret is shown once.
4. Assign the correct role permissions — the role controls what n8n can read and write in NetSuite (same as with TBA: create a dedicated integration role, never use Administrator)

In n8n, create a new OAuth2 API credential:

• Grant Type: Client Credentials
• Access Token URL: https://<accountId>.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token
• Client ID: from NetSuite
• Client Secret: from NetSuite
• Scope: rest_webservices (or as required by your integration)

Then in your HTTP Request nodes, swap the credential from OAuth1 API to this new OAuth2 API credential. Your endpoint URLs and request bodies stay the same.

What about the n8n community node?

The n8n-nodes-netsuite-rest community node (built by Entech Solutions) supports TBA authentication. If your node credential uses Consumer Key, Consumer Secret, Token ID, and Token Secret, it is running on TBA and will need to migrate. The node will be updated to support OAuth 2.0 client credentials before the 2027.1 cutoff — when the update ships, migrating will be a credential swap in the node settings and your workflow logic stays intact.

Watch the npm package page and this blog for the update announcement. If you need the OAuth 2.0 version ahead of the public release, contact Entech.

Steps to take now

1. List your n8n workflows that connect to NetSuite. Check every credential used across those workflows — identify which use TBA (OAuth1 API credential type).
2. Test OAuth 2.0 in sandbox. Create an OAuth 2.0 Integration record in your NetSuite sandbox now. Confirm you can obtain a Bearer token and make a test API call. Removes one unknown from your future migration.
3. Set a reminder for Q4 2026. Check whether n8n's community node and your HTTP Request credential approach have updated OAuth 2.0 configurations available. Migration from TBA to OAuth 2.0 should take a few hours per workflow in a test environment.
4. Plan migration before 2027.1. Even though existing TBA integrations work until 2028.1, migrating before 2027.1 gives you a clean sandbox period to catch any edge cases without time pressure.

FAQs

Does the NetSuite TBA deprecation affect n8n workflows?

Only if your integration uses TBA. To check: open your NetSuite integration record (Setup → Integration → Manage Integrations), click the Authentication tab — if Token-Based Authentication is checked, you need to migrate. If OAuth 2.0 is already enabled instead, you are not affected.

What changes in my workflows when I migrate?

Only the credential configuration. Endpoint URLs, request bodies, and workflow logic stay the same. You replace the OAuth1 API credential with an OAuth2 API credential using Client ID and Client Secret.

Is OAuth 2.0 harder to set up?

No — it is simpler. TBA requires per-request cryptographic signing with four credentials. OAuth 2.0 client credentials uses two credentials to get a Bearer token, which is then reused until it expires. n8n handles token refresh automatically.

Will the Entech community node be updated?

Yes. The n8n-nodes-netsuite-rest community node will be updated to support OAuth 2.0 before the 2027.1 cutoff. Watch the npm page and this blog for the release.

When exactly does NetSuite end TBA support?

2027.1 (~Feb–Mar 2027): no new TBA integrations. 2028.1 (tentative): all existing TBA integrations stop working. SuiteAnalytics Connect ODBC/JDBC is not affected.