PKCE Requirements for OAuth 2.0 Integration in NetSuite 2026.2

TL;DR: Starting in NetSuite 2026.2, PKCE parameters are now required for all new integrations using the OAuth 2.0 authorization code grant flow, offering improved security measures. Existing integrations not utilizing PKCE will remain functional.

What Changed in OAuth 2.0 Integration?

Previously, the Proof Key for Code Exchange (PKCE) was only necessary for public client flows under the OAuth 2.0 system. However, with the release of NetSuite 2026.2, PKCE parameters will now be mandatory for all new integrations. This enhancement ensures a consistent security approach across all authorization processes, reducing potential vulnerabilities in OAuth implementations.

How Does PKCE Work?

PKCE enhances security for OAuth 2.0 by preventing authorization code interception attacks. It does this by requiring the client to generate a code challenge and code verifier, which must be validated during the token exchange process. Developers integrating with NetSuite OAuth 2.0 must now adapt their applications to send these parameters with each request.

Benefits of Mandatory PKCE Inclusion

• Improved Security: Adds a layer of protection against interception attacks.
• Standardization: All new integrations follow the same security protocol.
• Compatibility: Existing integrations that do not use PKCE will remain operational, allowing a smooth transition.

Who This Affects

• Developers involved in creating integrations with NetSuite.
• System Administrators managing OAuth configurations.
• Security Teams responsible for safeguarding applications.

Key Takeaways

• PKCE is now a requirement for all new OAuth 2.0 integrations in NetSuite 2026.2.
• Existing integrations without PKCE are unaffected and will continue to function.
• This change is aimed at enhancing security standards across all NetSuite integrations.