API Secrets Management for Banking Integration in NetSuite

When integrating payments with a bank through an API, the bank provides application credentials. To further safeguard these credentials, you must create API secrets within NetSuite. This includes:

• An API secret to store the client ID credential.
• An API secret to store the client secret credential.

Creating API Secrets

When creating the API secrets, it’s vital to note the IDs assigned to each secret. To create a secret in NetSuite:

1. Navigate to Setup > Company > Preferences > API Secrets.
2. Click Create New at the top of the page.
3. In the Create New Secret window:
   • On the Details tab, enter a descriptive name for this secret in the Name field. Avoid using sensitive or private information, as this will be visible to other users.
   • Input a script ID for this secret in the ID field. This should be descriptive and should not contain spaces or special characters; NetSuite prefixes the script ID with 'custsecret'.
   • Enter the secret in the Password field, or load it from a file for multi-line secrets.
   • Confirm the password in the Confirm Password field.
   • Check the Expiration Warning box if you want an alert when the secret is nearing its expiration date (optional).
   • Provide a description in the Description field, avoiding sensitive information.

Associating API Secrets

Once the API secrets are created, they need to be associated with the bank connection record for each bank. If a bank has multiple connections, the same secrets can be used across all records for that bank.

Important Notes

• You can securely store, manage, and reference API secrets in NetSuite to avoid using plaintext secrets in scripts.
• API secrets can include hashes, passwords, keys, and other sensitive authentication credentials, with a maximum size of 1,000,000 characters.
• It may take up to one hour for new passwords to update. The old credentials must remain functional during this period.

For further details about adding applications or settings specific to particular banks, consider checking the relevant documentation related to those specific integrations.