In preparation for using the NetSuite REST API once it is out of beta, I have been working on an integration proof-of-concept between Google cloud app and NetSuite. The design consists of NetSuite REST APIs, NetSuite OAuth2 and NetSuite OIDC using the two-legged OAuth flow. I believe it is also referred to as the service account authorization flow. I rather quickly got the authorization code grant flow with a user providing authorization working. However, with the two-legged OAuth flow, I hit a brick wall trying to get it to work. Then, in the NetSuite docs I found "We only support authorization code grant flow". I have three questions. 1) Can anyone confirm this to be true? 2) Are there plans to add support for other flows such as two-legged OAuth? 3) Are there other options in NetSuite to consider that support long-term (no password expiration) program-to-program security?

Use TBA

I will take a look at TBA. Thanks for your advice.

mixing is not an option

Good. Then, I understand. I was overly complicating things by thinking I needed to utilize both.