---
title: NetSuite Integration Guide
description: Step-by-step guide to connecting NetSuite to Setyl with OAuth 2.0 client credentials, importing software spend and allocating it to licenses.
---

[Skip to content](https://help.setyl.com/netsuite-integration-guide#main-content)

English

Show submenu for translations

[![Large Logo 2000px wide](https://help.setyl.com/hs-fs/hubfs/Large%20Logo%202000px%20wide.png?width=99&height=30&name=Large%20Logo%202000px%20wide.png)](https://setyl.com/)

Open main navigation

Close main navigation

- English
  
  Show submenu for translations
- [Back to Setyl Website](https://setyl.com/)

[Back to Setyl Website](https://setyl.com/)

 How can we help?

- There are no suggestions because the search field is empty.

1. [Support Center & FAQs | Setyl](https://help.setyl.com/?hsLang=en)
2. [Integrations](https://help.setyl.com/integrations?hsLang=en)

# NetSuite Integration Guide

## Connect NetSuite directly to Setyl with OAuth 2.0 to import software spend from your chosen accounting book and allocate it to licenses.

### Overview

This guide explains how to connect NetSuite directly to Setyl and import transactions for your selected accounting book and accounts. You can then review the imported spend and allocate it to licenses in Setyl. Setyl reads NetSuite data; it does not create, edit or delete your NetSuite financial records.

The connection uses **OAuth 2.0 Client Credentials (machine-to-machine)**. You register a public certificate in NetSuite and upload its matching private key to Setyl. There is no browser sign-in redirect, and Setyl does not need your NetSuite password or a client secret.

**Moving from the previous Apideck connection?** Its token ID and token secret cannot be entered in this form. Follow the steps below to configure the direct connection and generate the new PEM files. You may reuse an existing service user if you assign it the required role.

### Before you start

- Ask your NetSuite administrator to complete the NetSuite setup.
- Use a Setyl account with the **Owner** role in an organization where accounting integrations are enabled.
- Have OpenSSL available on a trusted computer, or ask your IT team to generate the certificate and key in step 5.
- Confirm the NetSuite account, subsidiaries and accounting book whose spend you want to import. Your finance team should choose the book.

You will enter four items in Setyl: **Account ID, Client ID, Certificate ID and the private key PEM file.**

### 1. Enable the NetSuite features

Go to **Setup → Company → Enable Features** (this may appear under Setup Tasks). Enable:

- **SuiteCloud:** REST Web Services and OAuth 2.0.
- **Analytics:** SuiteAnalytics Workbook.

Save the changes. Setyl uses SuiteQL through REST Web Services; SuiteAnalytics Connect, SOAP Web Services and Token-Based Authentication are not required for this connection.

Oracle references: [REST prerequisites](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_5085602973.html) and [OAuth 2.0 roles and permissions](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_157771510070.html).

### 2. Create a role for Setyl

Go to **Setup → Users/Roles → Manage Roles → New**. Name the role **Setyl Read Only**. Use a dedicated role rather than giving the integration the Administrator role.

On the **Permissions** subtab, add the permissions below. The Full/Edit levels are for API authentication and analytics access; keep the financial record permissions at View.

| **Subtab** | **Permission** | **Level** |
| --- | --- | --- |
| Setup | REST Web Services | Full |
| Setup | Log in using OAuth 2.0 Access Tokens | Full |
| Reports | SuiteAnalytics Workbook | Edit |
| Transactions | Find Transaction; Bills; Enter Vendor Credits; Make Journal Entry; Check; Credit Card Charge; Credit Card Refund; Credit Memo | View |
| Lists | Accounts; Currency; Vendors | View |
| Lists | Customers, if customer credit memos are included | View |
| Lists | Subsidiaries, if using OneWorld | View |
| Setup | Accounting Book, if Multi-Book Accounting is enabled and this permission is available | View |

These transaction permissions cover Setyl's supported document types. This integration does not import purchase orders or expense reports, or assign spend using NetSuite employee, department, class or location records.

For OneWorld, give the role access to the subsidiaries you want to include. Check accounting-book and other role restrictions too: they must allow access to the intended transactions. Choose All subsidiaries only if Setyl should have access to all of them.

Available permissions depend on your NetSuite features. Missing access can cause a query error or an incomplete result. If data is unavailable, your administrator should check the role's Records Catalog and restrictions. See Oracle's [permission reference](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_N3236764.html). Save the role.

### 3. Assign the role to a service user

Go to **Lists → Employees → Employees**. Create a dedicated integration user, or edit the service user you already use for integrations.

1. Enter the required employee details and a managed email address.
2. On the **Access** subtab, enable **Give Access** and complete any password requirements according to your organization's policy.
3. Add the **Setyl Read Only** role and save.

Keep this user active. You do not enter its password in Setyl.

### 4. Create the integration record

Go to **Setup → Integration → Manage Integrations → New**.

1. Name the integration **Setyl** and set its state to **Enabled**.
2. Under OAuth 2.0, enable **Client Credentials (Machine to Machine) Grant** and the **REST Web Services** scope.
3. Leave **Authorization Code Grant** and **Public Client** unchecked. Token-Based Authentication and its authorization-flow options are not needed for this new integration record.
4. Save, then copy the **Client ID** to your organization's password manager. NetSuite shows it only once. Copy the Client ID, not the integration's internal ID.

NetSuite may also display a client secret; Setyl does not use it for this certificate-based flow. See Oracle's [integration record instructions](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_157771733782.html).

### 5. Generate the private key and public certificate

Run the following command in a private folder on a trusted computer with OpenSSL. It is written for a Unix-style shell, such as macOS/Linux Terminal, Git Bash or WSL. Ask your IT team for help if needed.

```
umask 077openssl req -new -x509 -sha256 \  -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \  -pkeyopt ec_param_enc:named_curve -nodes -days 730 \  -subj "/CN=Setyl NetSuite integration" \  -keyout setyl-private-key.pem \  -out setyl-certificate.pem
```

This creates two different files:

| **File** | **Where it goes** |
| --- | --- |
| setyl-certificate.pem | Public certificate: upload to NetSuite in step 6. |
| setyl-private-key.pem | Private key: upload only to the Setyl connection form in step 8. |

Setyl requires an **EC P-256 (prime256v1) private key with ES256 signatures**. The PEM must contain an unencrypted private key; RSA keys, other curves and password-protected keys are not supported. Both PKCS#8 and SEC1 EC private-key formats are accepted.

The command creates a certificate valid for 730 days; NetSuite allows at most two years. Record its expiry date and arrange rotation before it expires. See Oracle's [certificate requirements](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/subsect_162755332391.html).

**Keep the private key confidential.** Do not upload it to NetSuite or send it by email, chat or support ticket. Store any backup in an approved secure vault. If you lose it and need to reconnect, create a new key and certificate.

### 6. Register the public certificate in NetSuite

Go to **Setup → Integration → Manage Authentication → OAuth 2.0 Client Credentials (M2M) Setup**. Click **Create New**, then select:

- **Entity:** the service user from step 3.
- **Role:** Setyl Read Only.
- **Application:** the Setyl integration record from step 4.
- **Certificate:** upload **setyl-certificate.pem**.

Save and copy the resulting **Certificate ID**. This is different from the Client ID. The role must already be assigned to the selected service user. See Oracle's [M2M setup instructions](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_162686838198.html).

### 7. Find the NetSuite Account ID

Go to **Setup → Company → Company Information** and copy **Account ID**. Enter the ID only, not a full URL.

A production ID might be **1234567**. A sandbox ID might be **1234567\_SB1**; Setyl accepts that form and the hostname form **1234567-sb1**. All credentials and the certificate mapping must belong to the same NetSuite environment.

### 8. Connect in Setyl and start the import

In Setyl, open **Integrations → NetSuite → Connect**.

| **Setyl field** | **Value** |
| --- | --- |
| NetSuite Account ID | Account ID from step 7. |
| Client ID | Client ID from the integration record in step 4. |
| Certificate ID | Certificate ID from the M2M mapping in step 6. |
| Private key (.pem) | Upload setyl-private-key.pem from step 5. |

1. Click **Save & Connect**. Setyl checks authentication and makes a small read-only query. This confirms basic connectivity, not access to every transaction.
2. Wait for the chart of accounts and accounting-book list to load. These load in the background; the book list may take several minutes.
3. Choose **one accounting book** and click **Save accounting book**. Use the book your finance team wants to report from; do not choose solely because it appears first. The book cannot be changed after import setup is complete.
4. Enable the chart-of-accounts entries relevant to the software and license spend you want to track. Review the selection with your finance team.
5. Click **Import Transactions**. This starts the transaction synchronization.
6. Review its progress and any errors in the synchronization history, then review imported and unmatched transactions in **Finance**.

The initial import covers the previous two years through today. It includes supported posted transactions in the selected book and accounts that the NetSuite role can access. Duration depends on the volume of data. Once setup is complete, automatic synchronization runs every two weeks; a manual synchronization can also be started in Setyl.

Existing matching rules can allocate imported spend to licenses. Review unmatched transactions and assign them manually where needed; connecting NetSuite does not automatically identify a license for every transaction.

### Maintaining the connection

#### Certificate renewal

Before expiry, generate a new key and public certificate, create a new M2M certificate mapping in NetSuite, and obtain its new Certificate ID. Update the Certificate ID and matching private key in the existing Setyl connection. Verify that the new credentials work, then revoke the old certificate in NetSuite. If a key is compromised, revoke it immediately.

Updating credentials for the **same NetSuite account** preserves the direct connection's selected book, accounts, imported transactions and license allocations. It does not restore data from the retired Apideck connection. To connect a different NetSuite account, contact Setyl support; changing the account on an existing connection is not supported.

#### Stopping imports and revoking access

Use **Stop synchronization** in Setyl to cancel a current import. Wait for cancellation to finish before editing connection settings or starting another import. Already imported data is retained.

To revoke NetSuite access, revoke the certificate mapping or block the integration record in NetSuite. Stop any active Setyl synchronization too. Revoking access does not remove data already imported into Setyl.

#### Security and sandbox refreshes

Setyl encrypts the stored private key and access token. It renews short-lived access tokens automatically. Your NetSuite password and client secret are not required.

Production and sandbox setups are separate. After a sandbox refresh, check the integration record, service user and role, and recreate the OAuth 2.0 M2M certificate mapping as needed. Update the corresponding credentials in Setyl.

### Troubleshooting

**Authentication fails or Setyl cannot connect.** Check the Account ID, Client ID and Certificate ID; confirm the public certificate and private key are a matching pair. Check that the certificate is unexpired, the integration is Enabled, the service user is active, the role is assigned and the M2M mapping is correct. Setyl may show a generic authentication or HTTP error.

**The key is rejected.** Upload the private key, not the public certificate. It must be an unencrypted EC P-256 PEM key. Generate a new pair using step 5 if its type or origin is uncertain.

**The Role dropdown in M2M setup is empty.** Assign the role to the selected service user first, save, and reload the M2M setup page.

**Accounts or books will not load.** Check the features and role permissions in steps 1–2, including subsidiary and book restrictions. Use the retry button if loading failed. If the list is empty or the expected book is missing, contact Setyl support; do not select a different book just to continue.

**Some transactions or spend are missing.** First check synchronization errors and completion. Then check the selected book and accounts, the two-year date window, supported document types, posted status, and the service role's access. Review unmatched transactions in Finance as well; an imported transaction is not necessarily allocated to a license yet.

**Imports stopped after previously working.** Check certificate expiry, the integration's state, service-user access and any role or sandbox changes. Renew the credentials if necessary.

**Still stuck?** Contact Setyl support with the step that failed, the time and the error shown. Never include private keys, passwords or access tokens.

- [Getting Started](https://help.setyl.com/getting-started?hsLang=en)
- [Setyl for your Organization](https://help.setyl.com/setyl-for-your-organization?hsLang=en)
- [Asset and Device Management](https://help.setyl.com/asset-and-device-management?hsLang=en)
- [App, License, & Contract Management](https://help.setyl.com/app-license-contract-management?hsLang=en)
- [People Management](https://help.setyl.com/people-management?hsLang=en)
- [Integrations](https://help.setyl.com/integrations?hsLang=en)
- [Security and Data Privacy](https://help.setyl.com/security-and-data-privacy?hsLang=en)
- [Roles and Permissions](https://help.setyl.com/roles-and-permissions?hsLang=en)
- [Locations, Legal Entities and Departments](https://help.setyl.com/locations-legal-entities-and-departments?hsLang=en)
- [Asset Labels](https://help.setyl.com/asset-labels?hsLang=en)
- [General](https://help.setyl.com/general?hsLang=en)
- [Asset Depreciation](https://help.setyl.com/asset-depreciation?hsLang=en)

[![Large Logo 2000px wide](https://help.setyl.com/hs-fs/hubfs/Large%20Logo%202000px%20wide.png?width=100&height=29&name=Large%20Logo%202000px%20wide.png "Large Logo 2000px wide")](https://setyl.com)

<https://www.linkedin.com/company/setyl/>

Copyright © 2026, Setyl Ltd