NetSuite Is Retiring NLAuth and TBA: What Developers Need to Do Before 2027.1

NLAuth is a legacy credential-based authentication method in NetSuite that transmits an account ID, email, and password as a Base64-encoded string in an HTTP Authorization header. It is one of the oldest methods on the platform and is used in thousands of RESTlet integrations built over the last decade. It works by passing your account ID, email, and password directly in an HTTP Authorization header. Easy to implement, nothing to configure, and used in thousands of RESTlet integrations built over the last decade.

Quick answer

NetSuite is ending support for NLAuth, the authentication method that passes credentials directly in HTTP Authorization headers. Two retirement dates apply. In 2027.1, new integrations using NLAuth will be blocked, and existing NLAuth integrations that have not migrated will stop working. A second deprecation tentatively planned for 2028.1 completes the removal for any remaining connections. Any RESTlet, custom integration, or third-party connection that currently authenticates with NLAuth must migrate to Token-Based Authentication using Integration Records in NetSuite before 2027.1. Migration generates a Consumer Key, Consumer Secret, Token ID, and Token Secret for each integration. Organizations with large integration inventories should audit all connections for NLAuth usage now and prioritize migration of the highest-risk connections, particularly those that touch financial records or run unattended on a schedule. The migration path requires creating an Integration Record in NetSuite under Setup > Integration > Manage Integrations, then updating each external system with the new OAuth 1.0 Consumer Key, Consumer Secret, Token ID, and Token Secret.

NetSuite is ending it.

The 2026.2 release notes confirm two changes coming in 2027.1 and one tentatively planned for 2028.1. Any integration still using NLAuth at that point stops working. Any new integration built with Token-Based Authentication (TBA) from 2027.1 onward will be blocked. If your account has RESTlets, custom integrations, or third-party connections that authenticate with NLAuth or TBA credentials, you need an audit and a migration plan before that deadline.

Migrating to TBA now buys time but is not the final destination. OAuth 2.0 is the long-term target.

Deadline: NetSuite 2027.1

All NLAuth integrations stop working at 2027.1. If your account has RESTlets or third-party connections still using NLAuth, the clock is running. Most migration projects take 2 to 4 weeks depending on integration count. That leaves narrow runway if you are also managing a 2026.2 release cycle and a year-end close.

Get your integration audit started

What Is Being Retired in NetSuite and When?

As of 2027.1:

All integrations that use NLAuth as an authentication method will stop working. This includes RESTlets that currently authenticate with NLAuth credentials.
You will not be able to create new integrations using Token-Based Authentication (TBA).

Tentatively planned for 2028.1:

TBA will be fully retired. Existing TBA integrations that currently work will stop working when this happens.

Why Is NLAuth Being Retired by Oracle?

NLAuth passes your NetSuite account email and password with every request. If those credentials are compromised, an attacker can log directly into NetSuite, not just call your API. NetSuite has been phasing it out for years. 2027.1 is the hard cutoff.

TBA is more secure but is based on OAuth 1.0. OAuth 2.0 is the current standard, and NetSuite's direction is to move all integrations there.

What Should You Do If You Use NLAuth?

You need to migrate before 2027.1. The options are:

Option 1: Migrate to TBA (faster) TBA uses consumer key, consumer secret, token key, and token secret. It is more secure than NLAuth, still widely supported, and the migration is straightforward. The catch: you cannot create new TBA integrations from 2027.1, and TBA itself is tentatively being retired in 2028.1. Migrating to TBA now buys you time but is not the final destination.

Option 2: Migrate directly to OAuth 2.0 (recommended) OAuth 2.0 is what NetSuite recommends. It takes more setup but is the long-term solution. If you have the capacity to do this migration now, skip TBA and go straight to OAuth 2.0.

For both options, the starting point is the same: create an Integration Record in NetSuite at Setup > Integration > Manage Integrations > New, and generate credentials from there.

If you need outside help with the migration, SuitePacific's NetSuite integration service covers OAuth 2.0 rebuilds for existing NLAuth and TBA integrations.

What Should You Do If You Already Use TBA?

If you have existing TBA integrations, you have more runway. They will continue working until TBA is fully retired, which is tentatively planned for 2028.1. However:

You cannot create new TBA integrations from 2027.1.
The 2028.1 retirement date is tentative and could change.

Plan your migration to OAuth 2.0 now. Do not wait until you are forced to.

What Is the PKCE Requirement for OAuth 2.0 in NetSuite 2027.1?

If you are already using OAuth 2.0 Authorization Code Grant Flow, PKCE (Proof Key for Code Exchange) will be required as of 2027.1. If your current implementation does not include PKCE, add it before the deadline.

What Is the Full Summary of NLAuth Retirement Changes?

Change	When
NLAuth stops working	NetSuite 2027.1
New TBA integrations blocked	NetSuite 2027.1
PKCE required for OAuth 2.0 Authorization Code Grant	NetSuite 2027.1
TBA fully retired (tentative)	NetSuite 2028.1

Start your audit now. Find every integration that uses NLAuth or was built with TBA credentials, and map out which ones need to move to OAuth 2.0 and by when.

If you need help migrating your integrations, see How to Migrate NetSuite Integrations from NLAuth to Token-Based Authentication.

If you want a developer to handle the migration and ongoing integration work, see how to hire a NetSuite developer.

Frequently asked questions

Q: What is NLAuth in NetSuite? A: NLAuth (NetSuite Login Authentication) is an authentication method that passes a NetSuite account ID, email address, and password directly in the HTTP Authorization header of each API request. It was the original authentication method for RESTlets and is still widely used in older integrations. NetSuite is retiring it because it requires sharing a user's login credentials with the integration, which creates a security risk if those credentials are compromised.

Q: When is NLAuth being retired? A: As of NetSuite 2027.1, all NLAuth integrations stop working. This is a hard deadline, not a warning. The 2026.2 release notes confirmed this. Additionally, new TBA integrations cannot be created from 2027.1. Existing TBA integrations continue working until a tentative retirement in 2028.1.

Q: What should replace NLAuth? A: OAuth 2.0 is NetSuite's recommended replacement. Specifically, OAuth 2.0 with PKCE (Proof Key for Code Exchange) is the current standard, and PKCE will be required for the Authorization Code Grant Flow as of 2027.1. OAuth 2.0 does not require sharing user credentials and supports machine-to-machine integrations through the Client Credentials flow.

Q: Can I migrate from NLAuth to TBA instead of going straight to OAuth 2.0? A: Yes, but TBA is only a temporary solution. TBA is more secure than NLAuth and the migration is straightforward. However, new TBA integrations will be blocked from 2027.1, and existing TBA is tentatively being retired in 2028.1. Migrating to TBA now buys time but you will need to migrate again to OAuth 2.0. If you have capacity, migrate directly to OAuth 2.0.

Q: Does the NLAuth retirement affect RESTlet integrations specifically? A: Yes. RESTlets are the most common place NLAuth is used because NLAuth was the easiest authentication method to implement for RESTlet calls. Any RESTlet that currently receives requests authenticated with NLAuth will stop receiving those requests when 2027.1 hits. The RESTlet itself does not need to be rewritten, only the authentication method the calling system uses to reach it.

If you need help auditing your current integrations or planning the migration, SuitePacific's NetSuite integrations services cover RESTlet, REST Web Services, and OAuth 2.0 migration work.