You do not have to set up everything. Open Integrations > NetSuite and choose only what you want. Each item is its own short setup, you can do them in any order, and you can leave and come back. Nothing is changed until you confirm.

Which credential is used

The page shows "Using: ..." for the credential in use. If machine-to-machine is set up it takes priority; old consumer key and token stay stored but unused (shown only as "set", never the value) until you remove them. If the connection still uses the old credentials you can switch to machine-to-machine and switch back, because nothing is deleted when you switch.

Who is connected

The connection belongs to your Velaro site, not to individual agents. The screen pop finds the agent by matching their NetSuite user email to their Velaro agent email (not case sensitive). If they differ, that agent sees no calls and cannot save notes; fix it by making the emails match.

Fastest path: download the SuiteApp with your key already inside (no API Secret)

In the Velaro NetSuite setup wizard, Call pop step, click Download SuiteApp (key included). Deploy the zip with the SuiteCloud CLI (the SETUP.txt inside has the commands). There is nothing to paste into NetSuite. CLI: velaro netsuite suiteapp. MCP: netsuite_suiteapp_download. Keep the zip private: the key is stored on the script deployment, visible only to NetSuite admins. If it leaks, revoke the key in Velaro (Settings > API Keys) and download a new zip.

NetSuite does not allow API Secrets to be created by a script or a SuiteApp (UI only), which is why the keyed zip exists.

The API secret, manual alternative (screen pop and Velaro inside NetSuite)

In the NetSuite form, type only velaro_api_key in the ID box. NetSuite adds custsecret_ itself and then shows custsecret_velaro_api_key. Do not type the prefix.

1. NetSuite: Setup > Company > Preferences > API Secrets > Create New.

2. ID velaro_api_key (becomes custsecret_velaro_api_key). Paste your Velaro key into Password.

3. Restrictions tab: leave Available to SuiteApp unchecked.

4. Allow For All Scripts, or Restrict to Scripts and choose customscript_velaro_screenpop.

5. Restrict to Domains: your Velaro API host only (for customers api-messaging-us-east.velaro.com). List several hosts separated by commas only if you test more than one environment.

If the secret is missing or wrong, the Velaro Screen Pop page in NetSuite shows these steps instead of an error.

Bot using a RESTlet

A RESTlet is optional. Standard record types work without one. For RESTlet operations, save the RESTlet URL on the connection; Velaro calls it with the same credentials as the rest of the connection.

Checking the SuiteApp and switching back (Moshky, MCP, CLI)

• Moshky can answer "is the SuiteApp connected?" with the netsuite_embed_status tool (or velaro netsuite embed-status): it reports whether an embed key exists and when the SuiteApp last polled. It never shows the key.
• If a connection was moved to OAuth 2.0 or machine-to-machine and you want the old setup back, use Undo in the connect wizard, netsuite_rollback_auth, or velaro netsuite rollback-auth <configId>. This works only while the old OAuth 1.0a credentials are still saved. Once they have been removed, reconnect with new credentials instead. Administrators only; every switch is written to the activity log.
• Before overwriting an account Velaro already has, the connect wizards (new connection, sign-in, and the NetSuite redirect page) show a list of what will be replaced, kept or added. Secret values are never displayed or stored in the undo snapshot.