NetSuite recommends ScribeJava for Java applications, which still does not have HMAC-SHA256 built-in. My pull request has not been incorporated in the past 2 months, even though there have been several releases of scribe java since then: https://github.com/scribejava/scribejava/pull/1003