At a Glance — NetSuite TBA Deprecation
- What changes in 2027.1: new integrations can no longer use TBA. Existing TBA integrations are not forcibly disabled at that time.
- What we haven't found: an official date when existing TBA integrations stop working. Check Oracle's release notes rather than relying on a date from a blog.
- Check if you're affected: open the integration record in NetSuite (Setup → Integration → Manage Integrations) and see whether token-based authentication is enabled. If it uses OAuth 2.0, you are not affected.
- What replaces TBA: OAuth 2.0, either the authorization code flow or machine-to-machine (client credentials).
- What changes in n8n: the credential type. The REST endpoints and request bodies stay the same.
- Our node: the NetSuite REST community node already uses OAuth 2.0 and does not use TBA, so it is not affected.
Does this affect your n8n–NetSuite workflows?
Only if they authenticate with TBA, NetSuite's OAuth 1.0-style method, which uses a Consumer Key, Consumer Secret, Token ID and Token Secret and signs every request. In n8n that usually means an OAuth1 API credential or hand-signed headers. To check, open Setup → Integration → Manage Integrations in NetSuite, open the integration record your workflow uses, and look at its authentication settings. If token-based authentication is on, you are on TBA. If the record uses OAuth 2.0, the deprecation doesn't affect you.
What Oracle has announced
- NetSuite 2027.1: per Oracle's 2026.1 release notes, end of support for new integrations using TBA. After that, administrators can't create new TBA integrations.
- Existing TBA integrations: not forcibly disabled at that time, as far as those release notes state. We haven't found an official date on which they stop working.
- SOAP: the same release notes reportedly retire SOAP web services by 2028.2. SOAP integrations depend on TBA for authentication and can't use OAuth 2.0, so any SOAP-based integration has a harder deadline.
- The direction: Oracle's own documentation recommends OAuth 2.0 as the replacement for its deprecated authentication methods (NLAuth and TBA).
That means nothing breaks on a given day for most existing n8n workflows. It does mean new integration records need OAuth 2.0, and that moving existing ones sooner is easier than doing it under pressure.
The two OAuth 2.0 flows in NetSuite
NetSuite offers two flows that matter for integrations, and they work differently:
- Authorization code grant. A NetSuite user signs in once and approves access, and the integration then holds tokens on that user's behalf. NetSuite limits how long refresh tokens stay valid, so a connection that sits unused can need re-authorizing. From NetSuite 2027.1, Oracle's documentation says new integrations using this grant must include PKCE parameters. This is the flow the NetSuite REST node uses, and the one n8n's OAuth2 credential handles natively.
- Machine-to-machine (client credentials). No user sign-in. Instead of a client secret it uses a certificate you generate and upload to NetSuite, and you sign a JWT with the private key for each token request. It suits headless server integrations but takes more setup than the authorization code flow.
What actually changes in n8n
Not the workflow logic. The NetSuite REST endpoints and request bodies stay the same. What changes is how n8n proves who it is:
- With TBA: n8n signs every request using the OAuth1 credential (five values from NetSuite).
- With OAuth 2.0: n8n sends an access token (
Authorization: Bearer ...) obtained through an OAuth2 credential, and gets a new one when it expires.
How to migrate
There are three routes, from least to most work:
- Use the NetSuite REST community node. It is a verified node that works on n8n Cloud and self-hosted n8n, and it signs in with OAuth 2.0. Create the integration record, add your account subdomain, Client ID and Client Secret to the node's credential, and replace your HTTP Request calls with the node.
- Keep the HTTP Request node, switch the credential. Create an OAuth2 API credential using the authorization code grant and NetSuite's authorization and token URLs, then select it in your HTTP Request nodes instead of the OAuth1 credential. Our n8n NetSuite integration guide has the exact URLs and the NetSuite integration-record steps.
- Machine-to-machine. Choose this only if you need an integration with no user sign-in. Plan time for the certificate and JWT signing; n8n's standard OAuth2 credential isn't set up for it.
Whichever route you take, test it in a NetSuite sandbox first and give the new integration user a role with only the permissions the workflow needs.
What about the n8n community node?
The n8n-nodes-netsuite-rest community node (built by Entech Solutions, setup details here) already authenticates with OAuth 2.0 and does not use TBA, so this deprecation does not affect it. If your own HTTP Request nodes use OAuth1/TBA credentials, those are the ones to migrate. If you'd like help moving them, contact Entech.
Using Celigo instead of n8n for NetSuite? The TBA change affects Celigo integrations too; see our Celigo-specific TBA guide.
Steps to take now
- List your NetSuite workflows. Check every credential they use and note which are OAuth1 (TBA).
- Test OAuth 2.0 in a sandbox. Create an OAuth 2.0 integration record there, connect n8n, and make a test call. It removes the main unknown.
- Move new work to OAuth 2.0 now. Don't create new TBA integration records.
- Migrate before 2027.1 if you can. Existing TBA integrations aren't forcibly disabled then, but moving early gives you time to catch edge cases.
- Check for SOAP. If any integration uses NetSuite's SOAP API, it has a firmer deadline and can't use OAuth 2.0; plan a move to REST.
Frequently Asked Questions
Does the NetSuite TBA deprecation affect n8n workflows? Only workflows that use TBA. Open the integration record in NetSuite and check whether token-based authentication is enabled; if it uses OAuth 2.0, you are not affected.
When does NetSuite end TBA? Per Oracle's 2026.1 release notes, 2027.1 ends support for creating new TBA integrations; existing ones aren't forcibly disabled then. We haven't found an official date on which existing TBA integrations stop working, so check Oracle's release notes.
What replaces TBA for n8n and NetSuite? OAuth 2.0. For n8n the practical choice is the authorization code flow, through an OAuth2 credential or the NetSuite REST node. Machine-to-machine is also available but needs a certificate and a signed JWT.
What changes in my workflows when I migrate? The credential and the NetSuite setup. Endpoints and request bodies stay the same.
Is the Entech community node affected? No. It already uses OAuth 2.0 and does not use TBA.
Sources
- NetSuite help: OAuth 2.0 as the replacement for deprecated authentication methods (Oracle)
- NetSuite 2026.1 release notes (Oracle): end of support for new integrations using TBA in 2027.1