At a Glance — NetSuite TBA Deprecation for Celigo
- What changes in 2027.1: new integrations can no longer use TBA. Existing TBA integrations are not forcibly disabled at that time.
- What we haven't found: an official date when existing TBA integrations stop working. Check Oracle's release notes rather than relying on a date from a blog.
- Am I affected? If your Celigo NetSuite connection shows a Consumer Key, Consumer Secret, Token ID and Token Secret, it uses TBA.
- What replaces TBA: OAuth 2.0, either the authorization code flow or machine-to-machine (client credentials), which uses a certificate and signed JWT instead of a client secret.
- What to do: inventory your NetSuite connections, test OAuth 2.0 in a sandbox, and plan the move before 2027.1 if you can.
Does this affect your Celigo flows?
Only if the NetSuite connection behind them authenticates with TBA, NetSuite's OAuth 1.0-style method, which uses four values (Consumer Key, Consumer Secret, Token ID and Token Secret) and signs every request. Open your Celigo NetSuite connection: if it holds those values, it is on TBA. A connection that already authenticates with OAuth 2.0 is not affected. Because Celigo flows share connections, one TBA connection can sit behind many flows, so list the connections first and the flows that use them second.
What Oracle has announced
- NetSuite 2027.1: per Oracle's 2026.1 release notes, end of support for new integrations using TBA. After that, administrators can't create new TBA integrations.
- Existing TBA integrations: not forcibly disabled at that time, as far as those release notes state. We haven't found an official date on which they stop working.
- SOAP: the same release notes reportedly retire SOAP web services by 2028.2. SOAP integrations depend on TBA and can't use OAuth 2.0, so they have a harder deadline.
- The direction: Oracle's documentation recommends OAuth 2.0 as the replacement for its deprecated authentication methods (NLAuth and TBA).
So nothing breaks on a given day for most existing Celigo flows. New connections need OAuth 2.0, and moving existing ones early is easier than doing it under pressure.
The two OAuth 2.0 flows in NetSuite
- Authorization code grant. A NetSuite user signs in once and approves access, and the integration holds tokens on that user's behalf. NetSuite limits how long refresh tokens stay valid, so an unused connection can need re-authorizing. From NetSuite 2027.1, Oracle's documentation says new integrations using this grant must include PKCE parameters.
- Machine-to-machine (client credentials). No user sign-in. Instead of a client secret it uses a certificate you generate and upload to NetSuite, and you sign a JWT with the private key for each token request. It suits server-to-server integrations such as Celigo flows, but takes more setup than TBA did.
What Celigo supports today
Celigo's own community reports that NetSuite OAuth 2.0 client credentials (machine-to-machine) can be set up with a Celigo HTTP connection that signs a JWT with a key pair, as described in a January 2026 thread on Celigo's community forum. That route involves creating an integration record with machine-to-machine enabled, generating a key pair, and configuring the OAuth 2.0 settings and JWT in the connection. Celigo has also documented the NetSuite platform changes in its release notes; check docs.celigo.com for the current status of the native NetSuite connector before choosing a route.
The migration is mostly about the connection, certificates and sandbox testing, not about rebuilding flows. Entech Solutions is a certified Celigo partner; we audit NetSuite connections, set up OAuth 2.0 in a sandbox, and plan the cut-over so production isn't disrupted.
Steps to take now
- List your NetSuite connections. Note which use TBA and which flows depend on each.
- Test OAuth 2.0 in a sandbox. Create an OAuth 2.0 integration record there and confirm a test connection can obtain a token and make a call.
- Don't create new TBA connections. Start new work on OAuth 2.0.
- Plan the move before 2027.1 if you can. Existing TBA integrations aren't forcibly disabled then, but an early migration leaves time to catch edge cases.
- Check for SOAP. If any integration still uses NetSuite's SOAP API, plan a move to REST; it has a firmer deadline.
If you also run n8n against NetSuite, see our n8n TBA deprecation guide and the n8n NetSuite integration guide.
Frequently Asked Questions
Does the NetSuite TBA deprecation affect Celigo flows? Only flows whose NetSuite connection uses TBA. A connection with a Consumer Key, Consumer Secret, Token ID and Token Secret is using it.
When does NetSuite end TBA? Per Oracle's 2026.1 release notes, 2027.1 ends support for creating new TBA integrations; existing ones aren't forcibly disabled then. We haven't found an official date for existing integrations, so check Oracle's release notes.
What replaces TBA for Celigo and NetSuite? OAuth 2.0, either the authorization code flow or machine-to-machine. Machine-to-machine uses a certificate and a signed JWT, and Celigo's community reports it working today through an HTTP connection.
Do I have to rebuild my Celigo flows? The change is to how the connection authenticates, not to your mappings and logic, but confirm in a sandbox first.
Can Entech help migrate Celigo connections? Yes. We're a certified Celigo partner and handle the audit, sandbox testing and cut-over.
Sources
- NetSuite help: OAuth 2.0 as the replacement for deprecated authentication methods (Oracle)
- NetSuite 2026.1 release notes (Oracle): end of support for new integrations using TBA in 2027.1
- NetSuite OAuth2.0 (Celigo community)