tba-to-oauth2

What it does

• Scans a repo for TBA signing, NLAuth headers, SOAP TokenPassport and login calls, and the credentials they use, then writes a migration plan with a recommended grant for each integration, ordered against Oracle’s 2027.1 and 2028.2 dates.
• Designs a new OAuth 2.0 integration through a short multiple-choice interview: client credentials with a certificate, or authorization code with PKCE.
• Answers questions about refresh tokens, PKCE, certificates, rotation and token-endpoint errors, citing results measured in a NetSuite 2026.2 test account and exact Oracle quotes.
• Checks a setup with local Node scripts: certificate, JWT assertion, token, refresh, a SuiteQL test query and the certificate list, with a pass/fail report.

Install

Type these in Claude Code.

/plugin marketplace add Darren-Hill-Consulting-Inc/netsuite-plugins
/plugin install tba-to-oauth2@darren-hill-consulting

Requirements: Claude Code, and Node.js 20.12 or later for the scripts.

Data handling

• Nothing is sent to Darren Hill Consulting. No telemetry, no servers.
• Claude reads the files it scans, so your Claude Code provider’s usual data handling applies to them.
• The scripts talk only to the NetSuite account you name, and only when you run them.
• Credentials come from environment variables. Scripts never print or write secrets or tokens.
• Reports mask client and certificate IDs. The one exception: adding a certificate prints its new ID once to your terminal, because you need it as the kid.
• Adding or revoking a certificate asks you to type the account ID first.
• Nothing is kept by Darren Hill Consulting. The plan, the inventory and any report are files on your machine, and you can delete them.

Limits

• It finds what is in the repo. Connectors and vendor-hosted integrations show up only in the Login Audit Trail, and the plan says how to search it.
• Role advice follows Oracle’s documentation; least-privilege roles were not tested.
• Results were measured on NetSuite 2026.2. Re-check after 2027.1.