your oauth library may have a validation function, but since the token is something you create client side I'm not sure what it gains you. NS may have a token verification endpoint? If it's just an attempt to ensure you have a sane token you could do some checks that the header looks like a proper oauth token, but only netsuite (the receiver) that actually verifies it.