The 2027.1 NLAuth deadline: why your NetSuite RESTlets are at immediate risk

If your NetSuite account still relies on RESTlets built during the SuiteScript 1.0 era, you have a deadline problem — and it is closer than most administrators realize. Oracle has confirmed that NetSuite 2027.1 marks a hard turning point for how integrations authenticate. This is not a “someday” cleanup task. Depending on where your account sits in NetSuite’s upgrade schedule, the window to act may be measured in months, not years.

Here is what technical leads and administrators need to understand, why it is urgent, and exactly how to check your own exposure today.

What NLAuth is — and why SuiteScript 1.0 RESTlets leaned on it

NLAuth is a NetSuite-specific authentication method. It lets an external system call a RESTlet by passing a user’s ID and password directly in an authorization header — no tokens, no handshake, just credentials on the request. In the SuiteScript 1.0 era, this was the path of least resistance. It was quick to stand up, easy to test, and required none of the token infrastructure that modern methods need.

That convenience is exactly why so many older integrations still depend on it. A RESTlet written years ago to sync orders, push inventory, or feed a reporting tool was very often wired up with NLAuth because that was the norm at the time. Those scripts have been quietly running ever since — which is precisely what makes them a blind spot.

Oracle has been steering customers away from this approach for years. As far back as 2021.1, NetSuite stopped supporting user-credential (NLAuth) authentication for newly created RESTlets. Existing ones kept working — but “kept working” is not the same as “safe.”

The 2027.1 deadline: what Oracle has actually said

Here is the statement that should be on every administrator’s radar. According to Oracle’s documentation, “As of 2027.1, no new integrations using TBA can be created” for SOAP web services, REST web services, and RESTlets. Oracle further states that support for existing Token-Based Authentication (TBA) integrations will end later, tentatively in 2028.1 (excluding SuiteAnalytics Connect).

Why does this matter for your NLAuth RESTlets specifically? Because the legacy authentication methods — NLAuth and TBA — are both on the same retirement track, and Oracle points to a single replacement: OAuth 2.0. If your RESTlets authenticate with anything other than OAuth 2.0, they sit squarely in the path of these deadlines. The 2027.1 milestone closes the door on standing up new legacy-auth integrations, and the tentative 2028.1 milestone is when existing ones stop authenticating altogether.

How to identify whether your RESTlets use NLAuth

You cannot manage risk you cannot see. Fortunately, taking inventory inside NetSuite is straightforward. Here is the step-by-step:

1. Log in to NetSuite as an administrator.
2. Go to Customization > Scripting > Scripts.
3. Use the Type filter at the top of the list and select RESTlet. This narrows the list to only your RESTlet scripts.
4. For each RESTlet, open it and note its script ID, its deployment, and — critically — how the calling systems authenticate to it.

The Scripts page tells you which RESTlets exist, but it will not always tell you how each caller authenticates. To confirm that, cross-reference with your integration records under Setup > Integration > Manage Integrations, and review the actual code or configuration of the external systems calling each RESTlet. Look for authorization headers that pass a user ID and password (NLAuth) or that use consumer key/secret plus token ID/secret (TBA). Anything that is not OAuth 2.0 needs to go on your migration list.

Pay special attention to integrations set up by consultants or vendors who are no longer engaged. These are the ones most likely to be using legacy authentication and least likely to have a clear owner.

What happens the day your account upgrades to 2027.1

NetSuite pushes major releases to accounts automatically. When your account rolls to 2027.1, you will not be asked to opt in, and there is no grace period you can negotiate. From that point, you can no longer create new integrations that rely on the legacy authentication methods. And when the tentative 2028.1 cutoff for existing integrations arrives, any RESTlet still authenticating with NLAuth or TBA will simply fail to authenticate.

“Fail to authenticate” is quiet and brutal. There is no crash, no obvious alarm — just a call that returns an authentication error. In practice that looks like orders that stop syncing, inventory counts that silently drift, payment or shipping integrations that go dark, and reports built on stale data. By the time someone notices, the damage — and the reconciliation work — has already accumulated.

The OAuth 2.0 replacement path, in brief

The fix Oracle points to is OAuth 2.0. At a high level, migrating a RESTlet integration means creating an integration record in NetSuite configured for OAuth 2.0, granting the appropriate scope for RESTlets, and updating the external application to obtain and send an OAuth 2.0 access token instead of a username/password or TBA token set. The RESTlet code itself usually needs little or no change — the work is in how the caller authenticates.

It is not a heroic effort per integration, but it does require planning, testing in a sandbox, and coordinating with whoever maintains each external system. Multiplied across a dozen or more integrations, that adds up — which is why starting now, rather than at the deadline, is the difference between a controlled project and a fire drill.

Why “2027.1” may be closer than you think

Here is the urgency most teams miss: NetSuite does not upgrade every account on the same day. Releases roll out on a staggered schedule across the customer base. Some accounts receive a new release weeks or months before others. That means your account could be upgraded to 2027.1 meaningfully earlier than a colleague’s at another company — and earlier than a wall-calendar reading of “2027” would suggest.

You should plan against the earliest plausible date your account could receive 2027.1, not the latest. Combine that with the lead time needed to inventory your RESTlets, coordinate with external vendors, migrate to OAuth 2.0, and test each integration in a sandbox, and the comfortable-sounding runway shrinks fast. The teams that stay calm through this are the ones that start their inventory now.

Get ahead of it: download The NetSuite Pro migration playbook

We have distilled the entire process — inventorying your RESTlets, spotting NLAuth and TBA dependencies, and migrating cleanly to OAuth 2.0 — into a practical, step-by-step guide built for administrators and technical leads. Download The NetSuite Pro migration playbook and turn the 2027.1 deadline from a looming risk into a project you control.