A Claude plugin for the TBA migration
tba-to-oauth2 finds the TBA calls in your code, plans the move to OAuth 2.0, and checks the result
From NetSuite 2027.1, you can't create new integrations that use token-based authentication, and Oracle has "tentatively planned" the end of support for existing ones "for the 2028.2 release." Integrations that use NLAuth stop working in 2027.1, apart from existing IssueToken integrations. If you own an integration that signs its requests with TBA, it has to move.
The hard part isn't OAuth 2.0. It's knowing what you have: the signer hidden behind a helper, the SOAP passport in a service nobody has opened since it was written, the NLAuth header in a CI script. So I built a plugin for Claude Code that does the finding, and then the planning.
What it does
tba-to-oauth2 has four modes. You don't pick one; you ask, and Claude picks.
- Scan and plan. In your integration's repo, ask it to scan for NetSuite authentication. It reports every TBA signature, NLAuth header, SOAP TokenPassport and login call, and where each one's credentials live, by key name and line, never the value. Then it writes a plan: a recommended grant for each integration (client credentials or authorization code with PKCE), an effort estimate, and an order against Oracle's dates. SOAP integrations get their own answer, because OAuth 2.0 isn't supported for SOAP web services: they need rewriting against REST.
- New implementation. A short multiple-choice interview that ends in one design: integration record settings, certificate commands, the JWT assertion, token handling, rotation and error logging.
- Reference. Questions about refresh tokens, PKCE, certificates or a bare
invalid_grant, answered from the findings in Seven days is a setting and the Oracle documentation, with each claim marked as measured or quoted. - Verify. Local Node scripts that check your certificate, your assertion, a token, a refresh, a SuiteQL test query and your certificate list, and write a pass/fail report.
How it was tested
Every statement the plugin makes about NetSuite points to an entry in its evidence file: 43 behaviours measured in a NetSuite 2026.2 test account in November 2026, and 40 short Oracle quotes, each checked against the live documentation page. Where the account accepted more than Oracle documents, the plugin gives you the documented limit.
The scanner was scored against ten synthetic repositories in Node, Python, Java, .NET, PHP and CI configuration, with decoys such as other services' OAuth 1.0a. In every scored run it found every planted NetSuite call, though in one run of the busiest repo it reported one of them six lines below the line the answer key expects, which the scorer counts as a miss. Most repos were scored once, so treat that as a strong first result, not a guarantee.
What it won't do
- Send your data to me. The plugin has no telemetry and no server, so nothing reaches Darren Hill Consulting. The scripts talk only to the NetSuite account you name, read credentials from environment variables, and never print a secret or token. Claude itself reads the files it scans, so your Claude Code provider's usual data handling applies to them.
- Change your account quietly. Adding or revoking a certificate, or a refresh test that uses up a public client's token chain, needs a flag and then your account ID typed at the prompt.
- See past your repo. Connectors and vendor-hosted integrations aren't in your code. The plan tells you how to find them in the Login Audit Trail.
Install
In Claude Code:
/plugin marketplace add Darren-Hill-Consulting-Inc/netsuite-plugins
/plugin install tba-to-oauth2@darren-hill-consulting
The scripts need Node.js 20.12 or later. The source, the evidence file and the full README are on GitHub, under the Apache-2.0 licence. The tool page has the details in one place, and Tools will list the next ones.
This is independent work. It isn't affiliated with or endorsed by Oracle, and NetSuite is Oracle's trademark.
Sources — Oracle NetSuite Help Center