CAPTCHA Secret Key Management in NetSuite 2026.1

Starting in NetSuite 2026.1, enhancements have been made to how CAPTCHA secret keys are managed within SuiteCommerce, SuiteCommerce MyAccount, and SuiteCommerce Advanced. The major change involves the relocation of the CAPTCHA secret keys from the SuiteCommerce Configuration record to the API Secrets area. This shift not only enhances security but also streamlines access control by removing any plaintext secrets from the configuration records.

Overview of Changes

With the 2026.1 update, the process for configuring CAPTCHA has been fundamentally altered:

• Storage Location: The CAPTCHA secret key must now be stored in the API Secrets section of NetSuite.
• Reference by ID: Only the ID of the secret key needs to be referenced in the SuiteCommerce Configuration record.

This enhancement helps prevent unauthorized access to sensitive keys and ensures better compliance with security best practices.

Creating and Managing CAPTCHA Secret Keys

To create a CAPTCHA secret key, follow these steps:

1. Navigate to Setup > Company > API Secrets.
2. Click on Create New.
3. Fill in the Name and ID fields with descriptive identifiers that do not contain sensitive information. NetSuite will prefix the script ID with custsecret.
4. Enter your secret in the Password field. Ensure this follows security guidelines, especially if it spans multiple lines.
5. Optionally, provide a Description and set any restrictions necessary under the Restrictions tab.
6. Confirm your entries and save the new secret.

After creating your secret key, you must update the SuiteCommerce Configuration record:

• Go to Commerce > Websites > Configuration.
• Select your website, navigate to the Integrations tab, and click on the CAPTCHA subtab.
• Enable CAPTCHA for various actions (e.g., registration, login, guest checkout).
• Set the Secret Key ID to the ID of your CAPTCHA secret key to complete the configuration.

Who This Affects

This update is important for:

• Administrators: Responsible for setting up and managing CAPTCHA configurations.
• Developers: May need to adapt their APIs to interact with the new secret key management system.
• E-commerce Managers: Those overseeing website security will find these changes critical in safeguarding customer interactions.

Key Takeaways

• The management of CAPTCHA secret keys has moved to API Secrets for enhanced security.
• Only the ID of the secret key needs to be referenced in SuiteCommerce Configuration records.
• Configuration for CAPTCHA remains flexible and can be applied to various user actions.
• Administrators and developers need to update their practices to accommodate the new secret management workflow.