Token-Based Authentication is ending

If you have reporting tools connected, this matters: SuiteAnalytics Connect (ODBC/JDBC) is excluded from the end of support.

Note the shape of the two dates. 2027.1 is a build restriction — nothing you already have breaks. 2028.1 is the one that stops things working. If you have integrations you'd rather not rewrite under time pressure, the gap between those two dates is the window.

When teams hear "authentication deadline" they think about the obvious integrations — the middleware, the 3PL feed, the tax provider. Those matter. But TBA also authenticates RESTlets, and RESTlets tend to be the scripts somebody wrote years ago to solve one problem, which have quietly become load-bearing since.

They're easy to miss because nobody thinks of them as integrations. They don't appear on the list of vendors you're paying. They're just scripts — until the day they stop being called successfully.

If you take one thing from this page: when you inventory your TBA exposure, inventory the RESTlets too.

The replacement is OAuth 2.0. For anything you wrote yourself, that's a code change: a different authorization flow, different token handling, and a new integration record.

For anything you bought, it usually isn't your code at all. Your middleware platform, your connector vendor, your bank feed, your shipping integration — each of those authenticates on their side, and the remediation is a conversation rather than a rewrite: confirm their roadmap, confirm the version you're on supports OAuth 2.0, and schedule their upgrade.

That distinction is worth establishing early, because it changes the shape of the project entirely. An account with eleven exposures where seven belong to vendors has a coordination problem. One where all eleven are homegrown has an engineering problem. Most accounts don't know which they are until somebody looks.

Here's the awkward part: the obvious place to look is the wrong one.

Integration records live in the NetSuite UI and can't be queried programmatically. They also tell you what's configured, which is a different question from what's running — most accounts carry integration records set up years ago for things nobody uses any more.

What you can query is the login audit trail. It records what actually authenticated, by which method, against which URL, and when. Joined against your access tokens and your script deployments, that tells you the thing you actually need: not how many integrations exist, but which ones are alive.

Two practical notes if you go looking yourself. Seeing other users' tokens needs the Access Token Management permission, which is a more sensitive grant than ordinary read access. And the audit trail's retention window isn't documented — measure it before you conclude that something dormant is dead.

25 August 2026, against Oracle's NetSuite Help Center — the Token-Based Authentication end-of-support guidance.

Oracle states 2028.1 as tentative. I have kept that word here rather than dropping it, because a date presented as firmer than its source is exactly the kind of thing that erodes trust in everything else on a page.

I re-check this each release and change the date above whether or not anything moved.