Connect Oracle NetSuite to Cryptoworth to import your chart of accounts and prepare your accounting sync. Choose a connection method first, then follow the steps for that method.
Before you begin:
Choose your connection method
Method | How it connects | When you need to reconnect |
Machine-to-Machine (M2M), recommended | Uses a certificate that Cryptoworth creates and you register in NetSuite | Renew the certificate before it expires. Regular browser sign-ins are not needed. |
Browser sign-in (OAuth) | Opens NetSuite so you can sign in and approve access | Typically about every seven days. |
Choose M2M to avoid weekly sign-ins. Both methods use OAuth 2.0, but their setup steps and credentials differ.
What you need
You need edit access to your Cryptoworth entity and a NetSuite administrator to help with features and role permissions. For M2M certificate registration, use an Administrator role or a role with OAuth 2.0 Authorized Applications Management permission.
Keep NetSuite and Cryptoworth open in separate tabs.
Value | M2M | Browser sign-in |
Account ID | Required | Required |
Client ID / Consumer Key | Required | Required |
Client Secret / Consumer Secret | Not required | Required |
Certificate ID | Required. NetSuite creates it when you save the certificate mapping. | Not required |
Redirect URI | Not required | Required. It must match the Redirect URL shown in Cryptoworth. |
The steps below show where to find each value. You do not need to collect them in advance.
Already connected through browser sign-in?
You can reuse the existing NetSuite integration record and Client ID.
Enable its M2M grant in step 3. Keep the existing browser sign-in settings while you complete the switch. Cryptoworth pre-fills the Client ID, and the current connection continues until M2M setup is complete.
Prepare NetSuite
1. Enable the required features
These features are needed for both connection methods. If they are already enabled, leave them enabled.
In NetSuite, go to Setup > Company > Enable Features.
Open SuiteCloud.
Under SuiteTalk (Web Services), enable REST Web Services.
Under Manage Authentication, enable OAuth 2.0.
Check that both REST Web Services and OAuth 2.0 are enabled.
Click Save.
2. Set the role permissions
Go to Setup > Users/Roles > Manage Roles.
Open the role you will use with Cryptoworth, or create one.
Under Permissions > Setup, add Log in using OAuth 2.0 Access Tokens and REST Web Services.
Set both permissions to Full.
Click Save, then make sure the role is assigned to the NetSuite user for this connection.
The role also needs access to your journal entries, chart of accounts, subsidiaries, and currencies. Add access to classifications, departments, vendors, invoices, and payments where your workflow uses them.
3. Create or update the integration record
Go to Setup > Integration > Manage Integrations. Open the existing Cryptoworth record. For a first-time connection, choose New.
For an existing browser sign-in connection: open Authentication, enable Client Credentials (Machine To Machine) Grant under OAuth 2.0, and click Save. Keep the existing grant, scope, and redirect settings during migration.
Important: Do not reset credentials on an integration record that is already connected. Resetting changes the Client ID and disconnects the existing setup.
For a new integration record: enter a name such as Cryptoworth, set State to Enabled, and open Authentication. Under OAuth 2.0, use the settings for your chosen method:
Setting | M2M only | Browser sign-in only |
Client Credentials (Machine To Machine) Grant | Checked | Unchecked |
Authorization Code Grant | Unchecked | Checked |
REST Web Services under Scope | Checked | Checked |
Public Client | Unchecked | Unchecked |
Redirect URI | Not needed | Use the URL below. |
For browser sign-in, the Redirect URI must match the Redirect URL in Cryptoworth exactly:
<https://ai.cryptoworth.app/ons_callback>
If the same record will support both methods, enable both grants and set the Redirect URI. For a new record, leave Token-Based Authentication and User Credentials unchecked unless another workflow needs them.
Click Save.
4. Copy the credentials for your method
For a new integration record, copy the values from the confirmation screen:
M2M: copy Consumer Key / Client ID only.
Browser sign-in: copy both Consumer Key / Client ID and Consumer Secret / Client Secret.
Store the required values securely before leaving the page. NetSuite displays new credentials only once.
For an existing connection moving to M2M, Cryptoworth already holds the Client ID. Confirm its pre-filled value during setup. Do not reset credentials to reveal it.
If a record has never been connected and you did not retain its Client ID, you can reset its credentials and securely save the new values.
5. Find the Account ID
Go to Setup > Company > Company Information.
Copy the Account ID from the Company Information page.
Use your own Account ID. For example, 1234567 identifies a production account, while 1234567-sb1 identifies a sandbox, or test account.
Connect in Cryptoworth
6. Open the NetSuite connector
Open the entity you want to connect. Go to Integrations > Apps. On the Oracle NetSuite card, click Connect, or Reconnect if shown.
7. Connect using your chosen method
Complete one of the following options. Use Option A for M2M or Option B for browser sign-in.
Option A: Machine-to-Machine, recommended
A1. Enter the account and client details
Under Connection method, select Machine-to-Machine.
Enter your Account ID, then click Next. If a sandbox notice appears, check that you are connecting the intended test account.
Enter your Client ID, or confirm the pre-filled value, then click Next. Cryptoworth creates a certificate for this connection.
A2. Download the certificate
Under Certificate & Connect, click Download certificate (.pem). Keep the file ready to upload to NetSuite.
Note: The file contains only the public certificate. Cryptoworth stores the private key in encrypted form. The private key is not shown or included in the download.
Leave the connection window available while you complete the NetSuite step. If you close it, reopen it to resume the saved setup.
A3. Register the certificate in NetSuite
Go to Setup > Integration > OAuth 2.0 Client Credentials (M2M) Setup. This entry appears under the Manage Authentication heading.
Click Create New.
Select the following values:
Field | What to select |
Entity | The NetSuite user for this connection |
Role | The role you prepared in step 2 |
Application | Your Cryptoworth integration record |
Choose the Entity, Role, and Application for this connection.
If your integration record is missing from Application, check that its M2M grant is enabled and saved.
Under Certificate, click Choose a file and select the .pem file from Cryptoworth. After completing the fields, click Save.
Find the new mapping and copy its Certificate ID. Use the active mapping for the intended application, user, and role.
Note: NetSuite permits one certificate for each unique integration record, role, and entity combination, and up to five active certificates per integration record. A revoked certificate cannot be uploaded again.
A4. Complete the M2M connection
Return to Cryptoworth. Under Certificate & Connect, paste the Certificate ID from NetSuite.
Click Connect.
Cryptoworth requests a token from NetSuite to check the connection. When this succeeds, the status changes to Connected and the chart of accounts import starts.
Continue to step 8, Finish setup.
8. Finish setup
For M2M, wait for the chart of accounts import to finish. Then, for your chosen method:
Select your NetSuite subsidiary if prompted.
Choose your sync settings if prompted.
Review and map your General Ledger (GL) accounts as needed.
Manage the connection later from the NetSuite app in Cryptoworth. Connecting the app does not post journals. Complete your account mapping and review before running GL Sync.
Renew an M2M certificate
Certificates are valid for up to two years. Check the expiry date in Cryptoworth and renew before that date. NetSuite sends administrator reminders two months, one month, and fourteen days before expiry.
Open the NetSuite connection window and expand Certificate revoked, rejected, or expiring?.
Important: Generating a replacement invalidates the current certificate used by the connection. Complete the following steps together:
Choose Generate a new certificate and confirm.
Download the new
.pemfile.Register the new file in NetSuite, following A3 above.
Copy its new Certificate ID into Cryptoworth and click Connect, following A4.
Use this action for renewal or a revoked or rejected certificate. Avoid generating a new certificate as a routine reset.
Disconnect or reconnect M2M
Disconnecting the app in Cryptoworth stops the integration and clears its stored registration. Revoking the certificate mapping in NetSuite cuts off access and causes the connection to require reconnection.
To reconnect, start with the existing integration record in step 3. Have the Client ID ready, then follow Option A with a newly generated certificate.
Option B: Browser sign-in (OAuth)
B1. Choose browser sign-in
Under Connection method, select Browser sign-in (OAuth).
B2. Enter your credentials
Enter your Account ID, Client ID, and Consumer Secret. The Consumer Secret is the Client Secret you copied from the NetSuite integration record.
B3. Check the redirect address
The Redirect URL is filled in automatically. Check that it matches the Redirect URI on your NetSuite integration record exactly: https://ai.cryptoworth.app/ons_callback.
B4. Authorize the connection
Click Connect to NetSuite.
Sign in to NetSuite. If prompted, choose the correct company and role, then authorize the connection. You return to Cryptoworth when authorization is complete.
Browser sign-in typically needs reconnection after about seven days. Use M2M if you want to avoid regular browser sign-ins.
Check your setup
Check | M2M | Browser sign-in |
NetSuite features and role permissions | REST Web Services and OAuth 2.0 are enabled; the role has the required access. | Same checks. |
Integration record | Enabled, with the M2M grant and REST Web Services scope. | Enabled, with Authorization Code Grant and REST Web Services scope. |
Credentials and authorization | Correct Account ID and Client ID; an active certificate mapping; its Certificate ID saved in Cryptoworth. | Correct Account ID, Client ID, and Consumer Secret; matching redirect address; NetSuite authorization completed. |
Finish setup | Connection succeeds; chart of accounts import finishes; required subsidiary and account mapping reviewed. | Connection succeeds; required subsidiary and account mapping reviewed. |
Troubleshooting
Problem | What to check |
NetSuite rejected the M2M credentials during setup | Re-copy the Certificate ID. Check that the certificate maps to the intended integration record, user, and role. Confirm the M2M grant is enabled. If credentials were reset, update the Client ID in Cryptoworth. |
The same error after M2M previously worked | Check whether the certificate expired, was revoked, or its mapping was removed. Generate and register a new certificate, then enter its new Certificate ID. |
Integration record missing from Application | Enable Client Credentials (Machine To Machine) Grant on that record and save it. |
Provided x509 certificate is already used | Generate a new certificate in Cryptoworth and register the new file. A revoked certificate cannot be reused. |
A permissions error during sync | Add the missing permission to the mapped NetSuite role. Check access to the required subsidiaries and records. A permissions correction does not require a new connection. |
Enter a valid NetSuite Account ID | Check the ID and sandbox suffix. Examples are |
Browser sign-in authorization or Redirect URI error | In NetSuite, open Setup > Integration > Manage Integrations and the Cryptoworth record. Check Authorization Code Grant, the REST Web Services scope, and the exact Redirect URI. It must match the Redirect URL in Cryptoworth. |
Browser sign-in needs reconnection after about seven days | Reconnect through browser sign-in, or switch to M2M using the existing integration record. |
If you need help, contact Cryptoworth Support with your Account ID and the error message. Do not send private keys or certificate files. Support will not ask for them.