OAuth 2.0 Now Supported for NetSuite-to-Account Reconciliation Connection via OCI

What changed

NetSuite now supports OAuth 2.0 as an authentication method for connecting to the Account Reconciliation application in Oracle Cloud EPM. Previously, basic authentication was the documented option (see Using Basic Authentication to Connect to Account Reconciliation). The OAuth 2.0 path uses the OCI device-code grant flow, which means the authenticating user authorizes via an out-of-band browser step rather than storing a username/password pair in NetSuite.

Note: Oracle's documentation does not specify which NetSuite release introduced this capability. The URL and article structure suggest it is part of the Account Reconciliation Sync SuiteApp documentation rather than a versioned platform release note. Verify availability in your account by navigating to NetSuite EPM > Account Reconciliation > Connection Settings and checking whether the OAuth 2.0 type and its Configure button are present.

How it works

OCI side

• An Integrated Application of type Mobile Application must be created in the OCI identity domain where your Cloud EPM service is deployed.
• The OAuth configuration on that application must enable Refresh token and Device code grants; the Implicit grant must be cleared.
• Client IP address must be set to Anywhere.
• A resource scope must be added for the Cloud EPM instance. The resulting scope value follows the format: urn:opc:serviceInstanceID=<SERVICE_INSTANCE_ID>urn:opc:resource:consumer::all
• On the Cloud EPM service instance's own OAuth configuration (under Oracle cloud services in the identity domain), Allow token refresh must be enabled and a secondary audience must be added matching the exact Cloud EPM URL (no trailing slash). This is the same URL entered in NetSuite at Connection Settings > Account Reconciliation URL.

NetSuite side

• Navigate to NetSuite EPM > Account Reconciliation > Connection Settings.
• Select the OAuth 2.0 type and click Configure.
• Three values are required: IDCS URL (the OCI Domain URL), Client ID, and Scope.
• A device-code consent step follows: NetSuite displays a code and a verification URL. The admin pastes the code into the Cloud EPM browser session to grant access.
• The authenticating user must hold at least a Power User role with access to the target Account Reconciliation application.

What to do

1. Determine availability. Check whether the OAuth 2.0 option appears under NetSuite EPM > Account Reconciliation > Connection Settings. If it does not, confirm that the Account Reconciliation Sync SuiteApp is installed and up to date.
2. Provision the OCI integrated application. In OCI Identity & Security > Domains, create a Mobile Application in the correct identity domain. Enable Refresh token and Device code grants; disable Implicit. Set Client IP to Anywhere.
3. Add the EPM resource scope. Use Add scope on the OAuth configuration tab, select the Cloud EPM resource, and copy the resulting scope string.
4. Copy the Client ID from the OCI application record after activation.
5. Configure the EPM service instance. On the Cloud EPM service's OAuth configuration, enable Allow token refresh, add a secondary audience matching the exact Account Reconciliation URL (no trailing /).
6. Complete NetSuite configuration. Enter the Domain URL, Client ID, and Scope into the NetSuite OAuth 2.0 setup wizard. Complete the device-code consent flow in your browser.
7. Test the connection by triggering a reconciliation sync and verifying no authentication errors appear in the SuiteApp logs.

Caveats

• The source documentation does not clarify token-refresh behavior or token lifetime. Verify whether the refresh token is persisted across SuiteApp bundle updates.
• The device-code flow requires interactive browser consent, so this cannot be fully automated via SuiteScript or REST. Initial setup and any re-consent after token expiry will require a manual step.
• The authenticating user's Power User role requirement is on the Cloud EPM side, not a NetSuite role. Ensure the EPM user provisioning is in place before attempting the consent step.