This site was built to compliment the existing NetSuite Professionals Slack Community by adding a means for members to easily find answers to common questions and to create a searchable database of those questions and answers.

NetSuite Professionals

image.png

I'm having issues with how to https POST to an external system to get an OAuth 2.0 token
I can do so via Postman just fine (screenshot)
But doing so with `<http://https.post|https.post>` returns a 400 response from the external system with message "invalid_client"

Am I right that _outbound_ https doesn't require an integration record. Am I doing this right?

Hard to say, but can you debug or log and double check everything about the post your code is creating to everything about the successful postman request you can see in the postman console? Also maybe compare it to docs from the external system that may hopefully have an example??

will go compare Postman console output with my `log.debug()`s

your body is a json string when its supposed to be form encoded instead

a hidden bonus of using N/https built in support for <https://system.netsuite.com/app/help/helpcenter.nl?fid=section_4567628658.html#subsect_12144452089|form encoding> is that your failed attempt at using a secure string will likely work.

nice to see you battk, thanks once again for the help

I was creating individual securestrings for the id and secret, which I think would have also worked

but this now definitely works
_for the archive:_
```const requestBody = https.createSecureString({
	input:
		'grant_type=client_credentials' +
		`&amp;client_id=${options.clientIdKey}` +
		`&amp;client_secret=${options.clientSecretKey}` +
		'&amp;scope=public_api'
});
const response = <http://https.post|https.post>({
	url: options.tokenUrl,
	headers: {
		'Content-Type': 'application/x-www-form-urlencoded',
	},
	body: requestBody
});```

i take back what i said about your attempt at using a secure string, You likely dont know why you would use them or how they work. Secure strings work like a template with guids / api secrets being replaced by N/https, with the benefit being the secret is hidden from everyone. Just putting the actual cient id / secret in them defeats the point of using them.

Appreciate the candidness. The options.clientIdKey and options.clientSecretKey contain strings like “custscript_myclientid_scriptid”

Is that not the way secure strings work? The input contains the custscript id(s) and https.request hotswaps the script ids with the actual secret values server side before sending the https request

template engines work by replacing placeholders / expressions. The placeholders have special identifiers, similar to javascript template strings. N/https uses `{` as the beginning of the placeholder, and `}` at the end of it