Hi all, How would someone securely store API secrets/keys that you create manually? I looked into native API secrets management but it only stores secrets that it creates. Any way to achieve this? TIA

The link you provided above references the correct feature - you can store secrets you create, then programmatically access them without exposing the secret data. See this article about creating secrets: https://system.netsuite.com/app/help/helpcenter.nl?fid=section_160216498405.html

Oh I see that I can add the

secret

to password field here, but this is in the UI. I need to achieve this programmatically.

Is the secret only being used for the process you are running within that timeframe or does that secret remain active for a long period of time?

use Form.addCredentialField in a user event script deployed on a custom record to create a credential field

@Israel Gonzalez need to store it for future reuse @battk that kind of makes sense, will try it out. The process mentioned before runs in a restlet, so that’s where I will try and create this field to get guid. thanks

you dont use a default value

I think I got the GUID now. Thanks @battk Now onto storing and making use of it.

the main difference is that api secrets can be edited and have a ui to do so

to retrieve the stored

key

from GUID, I would have to use one of the

API secrets

APIs anyways, right?

secret keys and api secrets are different things

It is from NetSUite’s example 🙂

a lot of the examples in suitescript arent useful beyond syntax

but my question still remains. 🙂 What exactly should I be storing? Just the GUID I got from

form.addCredentialField

field or do I need to convert that to something else? I need it for long term use, meaning this doesn’t change without manual step.

storing the guid is fine

I keep coming back to this thread as I’m still not clear on how to use the GUID that I created for client secret. I will try to put as much context as possible and hope someone can help me 🙂 In the beginning of an integration, NetSuite receives host, clientId and clientSecret from an external system. I used

form.addCredentialField

like below to create GUID of the clientSecret.

const secretCredField = form.addCredentialField({
    id: "custpage_client_secret_guid",
    label: "Client Secret",
    restrictToDomains: ["example.com"],
    restrictToScriptIds: ["customscript_secrets_ue"],
    restrictToCurrentUser: false,
  });

I store this clientSecret GUID along with host and clientId in a custom record. Now when NetSuite needs to make a call to that external system, I need to create a HTTPS

Authorization

header with above info using basic authentication scheme like below.

Basic base64Encode(clientId:clientSecret)

Now my question is, which API should I use to retrieve the original clientSecret from the GUID? My options are

https.createSecretKey

and

https.createSecureString

. I believe I should use the second one but please tell me if I’m wrong. And what encoding do I use (default is UTF_8)? I didn’t use any encoding when creating GUID.

clientSecret = https.createSecureString({
  input: clientSecretGuid,
  inputEncoding: https.Encoding.UTF_8
});

Again, this returns an

https.SecureString

object. How do I extract actual clientSecret string from it? I even tried below and prefix

Basic

after but it doesn’t seem to work too.

const base64Encoded = https.createSecureString({
    input: `${clientId}:${clientSecretGuid}`,
    inputEncoding: https.Encoding.BASE_64,
  });

Not being able to log the encoded strings, even during dev, is pretty frustrating 😄 Any help here would be appreciated. TIA

input encoding is what you would use to tell netsuite how you entered the secret

I pass the clientSecret as is, so I guess I can use

UTF_8

you cant extract it

Interesting idea

secure strings, are treated like templates