Which sign-in method should I use?

Velaro supports two ways to connect NetSuite. Both are available on Integrations → NetSuite → Add Account.

• Machine-to-machine (recommended). Uses a certificate, so Velaro stays connected with no re-login. NetSuite does not expire it weekly.
• Sign in with NetSuite (simple OAuth). Still fully supported. You create an integration record in NetSuite, enter its Client ID (consumer key) and Client Secret in Velaro, and approve the connection in NetSuite. NetSuite expires this login about once a week, so someone has to sign in again.

Either way, you create the NetSuite integration record yourself and bring its Client ID (consumer key). Velaro cannot create it for you, because NetSuite has no shared marketplace app for these flows. A NetSuite Administrator does the setup once per NetSuite account. Sandbox and production are separate connections, so set up each one.

If your existing connection uses Sign in with NetSuite, it keeps working. On Integrations → NetSuite you will see a Switch to machine-to-machine card whenever you are ready.

Do I have to install a certificate for every customer?

No. Velaro generates the certificate for you in the setup screen. Your NetSuite Administrator uploads it once, into your own NetSuite account. Velaro staff cannot upload it for you, and you do not need any technical tooling. Each NetSuite account (including sandbox) gets its own one-time setup.

Who does the setup and what do they need?

A NetSuite Administrator (or a user with the OAuth 2.0 Authorized Applications Management permission), once per account. Before starting, have your NetSuite account ID (Setup → Company → Company Information; sandbox looks like 1234567_SB1) and decide which Velaro features you will use, because that decides the permissions in step 2.

Step 1: Enable the features

In NetSuite go to Setup → Company → Enable Features → SuiteCloud. Check OAuth 2.0 and REST Web Services, then Save.

Step 2: Create New Role

First, enable SuiteAnalytics Workbook at the account level (Administrator role required). This feature must be turned on so the role can access and search your NetSuite records.

1. Go to Setup → Company → Enable Features.

2. Open the Analytics subtab.

3. Check SuiteAnalytics Workbook.

4. Click Save.

Then create the role:

1. Go to Setup → Users/Roles → Manage Roles → New.

2. Name it "Velaro Integration".

3. Check Web Services Only Role.

4. On Permissions, go to each of these subtabs and add:

- Setup subtab: Log in using OAuth 2.0 Access Tokens (Full), REST Web Services (Full)

- Lists subtab: Customers (Full), Contacts (Full), Cases (Full, if you use support cases)

- Transactions subtab: Sales Orders (View or higher), Invoices (View or higher), if you use order lookups, invoices, or RMAs

- Reports subtab: SuiteAnalytics Workbook (Edit)

5. Click Save.

Velaro searches NetSuite with SuiteQL, which follows the same role-based access rules as SuiteAnalytics Workbook: the role can only find records it is allowed to view. If a record type is missing from the role, Velaro cannot read it. If SuiteAnalytics Workbook is not in the Reports list, the feature is not turned on yet.

Step 3: Create the user

1. Go to Lists → Employees → Employees → New.

2. Enter the name "Velaro Integration" and an email address.

3. On the Access subtab, check Give Access.

4. Add the role you created in Step 2.

5. If NetSuite asks for a password, check Manually assign or change password and enter a long random one. Uncheck Require Password Change on Next Login. Nobody signs in with this user.

6. Click Save.

Step 4: Create the machine-to-machine integration record

1. Go to Setup → Integration → Manage Integrations → New.

2. Name it "Velaro M2M Integration".

3. Under OAuth 2.0, uncheck Authorization Code Grant and check Client Credentials (Machine To Machine) Grant.

4. Under Scope, check REST Web Services and RESTlets.

5. Click Save.

6. Copy the Consumer Key / Client ID right away, because NetSuite shows it only once. You do not need the Client Secret.

Step 5: Create Velaro's Certificate and a New Authentication in NetSuite

First, generate the certificate. In Velaro open Integrations → NetSuite, choose Machine-to-machine, and click Generate Velaro certificate. Download the file as a .pem so it can be added in NetSuite.

Then create the authentication in NetSuite:

1. Go to Setup → Integration → Manage Authentication → OAuth 2.0 Client Credentials (M2M) Setup.

2. Click Create New.

3. Fill in the fields:

- Entity: the user from Step 3

- Role: the role from Step 2

- Application: the integration record from Step 4

- Certificate: upload the .pem file you downloaded

4. Click Save.

5. Copy the Certificate ID that NetSuite shows.

Note: Generating a certificate a second time replaces the first one. A certificate already uploaded to NetSuite will no longer match, and you will need to upload the new one.

Step 6: Enter the IDs and verify

Paste the Client ID and Certificate ID into Velaro and click Save and verify. Velaro checks three things: it can get a token, it can reach the NetSuite REST service, and it can read a customer. A failed check tells you what is wrong and how to fix it. When all pass, click Finish. If a later health check says "Your current role does not have permission", go back to Step 2 and check the Lists, Setup and Reports permissions on the role.

After you connect

NetSuite allows up to 5 active certificates per integration record. If the certificate expires, create a new mapping with a new certificate. Setup is not copied between production and sandbox, and refreshing a sandbox clears it.

The status card shows the sign-in method, account, environment (production or sandbox), the last successful sign-in, and when the certificate expires. Use Rotate certificate before it expires, Test connection any time, or Disconnect to remove it.

Why did my NetSuite connection disconnect?

Open Integrations → NetSuite. The red or amber panel names the reason and the fix. See the NetSuite connection problems section in the integration troubleshooting guide for each reason and its fix.

References: Oracle NetSuite Help Center, "OAuth 2.0 Client Credentials Setup" (https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_162686838198.html) and "Set Up OAuth 2.0 Roles" (https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_157771510070.html).

Switching an Existing Connection and Regenerating the Certificate

Switch to machine-to-machine updates your existing NetSuite connection in place. Nothing is disconnected, and the current connection keeps working until Save and verify succeeds. Generating the certificate a second time on a connection that is not yet machine-to-machine replaces the first one, so you must upload the new one to NetSuite. On a connection that already works, the current certificate keeps working until you save the new Certificate ID.

Sign In With NetSuite

Sign in with NetSuite is no longer offered for new connections. It saved one administrator's NetSuite sign-in on the connection and did not sign anyone in to Velaro. A connection that already uses it keeps working and shows as In use, with a Switch to machine-to-machine.

Where To Connect

On Integrations → NetSuite → Configuration, a site with no connection sees Connect NetSuite: every machine-to-machine step on one page, from turning on the NetSuite features to entering the IDs and choosing Save and verify. If verification fails, the reason and how to fix it appear above the button. One link, Connect with legacy token-based instead, opens the legacy form for accounts that cannot use OAuth 2.0. On a connected site, Switch connection option lists machine-to-machine and legacy token-based, and Rotate certificate shows only the certificate and ID steps.

What Is Machine-to-Machine?

Velaro creates a private key and a public certificate. You upload only the public certificate in NetSuite under Setup, Integration, Manage Authentication, OAuth 2.0 Client Credentials (M2M) Setup. That tells NetSuite which key to trust for one integration record, one user and one role. Each connection, Velaro signs a request with the private key and NetSuite returns a short-lived access token. Velaro stores no NetSuite password or long-lived token. Delete the mapping in NetSuite to revoke access.

Old Consumer Key and Token After You Switch

A connection uses one method at a time, set by its sign-in method. Once machine-to-machine is saved, it takes priority and the old consumer secret, token and token secret are not used. The connection card then shows "Old token-based credentials are still stored on this connection" with a Remove old credentials button. Velaro never removes them automatically. Disconnecting keeps the connection, field mappings and workflows, because workflows point at the connection, not at a credential.