VuonDocs

NetSuite Integration

Connect NetSuite using Token-Based Authentication (TBA) so Vuon can run read-only, aggregated SuiteQL against your account. Your NetSuite administrator can generate everything below in about ten minutes.

What you provide

Five values, all generated inside NetSuite:

  1. Account ID
  2. Consumer Key — newer NetSuite UIs label this Client ID
  3. Consumer Secret — a.k.a. Client Secret
  4. Token ID
  5. Token Secret

NetSuite shows the Consumer Secret and Token Secret only once, at creation time. Copy them immediately. If you lose either, you don't need to start over — just regenerate that one credential.

Generate the credentials

Step 1 — Turn on the features (one-time)

Go to Setup → Company → Enable Features → SuiteCloud and check:

  • Token-Based Authentication (under Manage Authentication)
  • REST Web Services (under SuiteTalk (SOAP and REST) Web Services)

Accept the terms and Save.

Step 2 — Create an Integration record

This produces the Consumer Key and Consumer Secret.

  1. Go to Setup → Integration → Manage Integrations → New.
  2. Name: e.g. Vuon SuiteQL.
  3. State: Enabled.
  4. Check Token-Based Authentication.
  5. Uncheck TBA: Authorization Flow and Authorization Code Grant — Vuon does not use OAuth 2.0.
  6. Save, then copy the Consumer Key / Client ID and Consumer Secret / Client Secret from the confirmation screen.

Step 3 — Create a read-only role

SuiteQL runs with the permissions of the role attached to the token, so create (or reuse) a read-only role. On the role's Permissions subtab, add:

  • Setup → Log in using Access Tokens (Full) — required to authenticate with a token
  • Setup → REST Web Services (Full) — required for the REST API
  • Reports → SuiteAnalytics Workbook (View) — required to run SuiteQL
  • View access to the records you want analyzed — for finance queries this is typically Transactions, Customers, Subsidiaries, Accounting Periods, and Accounts

Then assign the role to a user (a dedicated integration user is ideal): Setup → Users/Roles → Manage Users → edit the user → Access subtab → add the role.

SuiteQL respects this role's permissions. If a query touches a record or field the role can't view, it returns an error or no rows. Read-only View access to the relevant areas is all that's needed.

Step 4 — Create an Access Token

This produces the Token ID and Token Secret.

  1. Go to Setup → Users/Roles → Access Tokens → New.
  2. Application Name: the integration record from Step 2.
  3. User: the user from Step 3.
  4. Role: the role from Step 3.
  5. Save, then copy the Token ID and Token Secret.

Step 5 — Find your Account ID

Go to Setup → Company → Company Information and copy the Account ID (for example 1234567; a sandbox looks like 1234567_SB1). Send the exact value, and note whether it's a production or sandbox account — a token only works on the account it was created in.

Provide the values to Vuon

Share the five values securely — a shared password manager such as 1Password, not plain email or chat. Vuon derives your account's REST endpoint from the Account ID; you don't need to provide a URL.

Troubleshooting

"Invalid login attempt" or signature errors

  • Confirm the Account ID is exact, including any sandbox suffix (e.g. _SB1).
  • The token must belong to the same account, user, and role you set up. A token created in sandbox will not work in production (and vice versa).
  • If you regenerated the Consumer or Token secret, make sure the latest value was shared.

A query errors or returns no rows

This is almost always a permissions gap. Confirm the role from Step 3 has View access to every record type the query touches, plus SuiteAnalytics Workbook and REST Web Services.

FAQ

Why Token-Based Authentication instead of OAuth?

TBA tokens are static and long-lived, which makes them well suited to unattended, scheduled queries. They don't expire on a short cycle the way an OAuth access token does.

Is this read-only?

Yes. Vuon only runs aggregated, read-only SuiteQL SELECT queries. The recommended setup uses a role with View-only permissions.

Can I revoke access later?

Yes. Revoke the Access Token (Setup → Users/Roles → Access Tokens) or disable the Integration record at any time to immediately cut off access.

Does it work with a sandbox account?

Yes. Generate the credentials inside the sandbox account and provide that Account ID (e.g. 1234567_SB1). Tokens are scoped to the account they were created in.

Was this page helpful?