> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.tabs.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.tabs.com/_mcp/server.

# Connecting NetSuite

The Tabs and NetSuite integration lets Tabs sync invoicing, customer, and accounting data with NetSuite.

Once connected, Tabs can:

* Sync customers between systems
* Push invoices and credit memos to NetSuite
* Import products and chart of accounts from NetSuite
* Push journal entries during month-end close workflows

Credit memos are push-only. Apply a Tabs-created credit memo in Tabs, not in NetSuite. Applying it in NetSuite returns to Tabs as a payment and leaves the credit memo open. See [Applying a credit memo in your ERP instead of in Tabs](/erp-account-mapping#applying-a-credit-memo-in-your-erp-instead-of-in-tabs).

Do not map OAuth 2.0 to the NetSuite **Administrator** role. Install **Tabs Platform Automation**, then map the certificate to a dedicated Tabs user with **Tabs Integration Role**.

## Before you start

You need:

* **NetSuite Administrator** access — only an Administrator can install the SuiteApp, enable REST Web Services and OAuth 2.0, create the machine-to-machine (M2M) integration record, and upload the certificate
* Admin access in Tabs
* The NetSuite **subsidiary** this Tabs instance should connect to

Install **Tabs Platform Automation** (`com.tabsplatform.automation`) in each NetSuite account you will connect (production and sandbox separately). If you connect a sandbox, make sure it has been synced with production within the last few months.

## Step 1: Install Tabs Platform Automation and create a dedicated user

A NetSuite Administrator installs the SuiteApp, then creates a dedicated employee for Tabs.

### Install the SuiteApp

1. In NetSuite, go to **SuiteApps**
2. Search for **Tabs Platform Automation** or `com.tabsplatform.automation`
3. Open the SuiteApp and click **Install**
4. Confirm **Tabs Integration Role** exists under **Setup → Users/Roles → Manage Roles**

If the SuiteApp is not listed, contact your Tabs implementation manager for the install package. Do not substitute **Administrator** or another custom role.

### Create the Tabs integration user

1. From **NetSuite Home**, go to **Lists → Employees → New**
2. Set the email to `ns-integrations+[merchant]@tabs.inc`, replacing `[merchant]` with your company name
3. Check **Give Access**. **Send Notification Email** is optional for a machine user.
4. On **Access**, assign **Tabs Integration Role**. Do not assign **Administrator**.
5. **Save**

**Tabs Integration Role** is web-services-only. It is not for UI login. OAuth 2.0 M2M uses the user and role mapping, not an interactive session.

## Step 2: Enable features and create an integration record

A NetSuite Administrator enables REST Web Services and OAuth 2.0, then creates the M2M integration record.

### Enable the features

1. In NetSuite, go to **Setup → Company → Enable Features → SuiteCloud**
2. Under **SuiteTalk (Web Services)**, enable **REST Web Services**
3. Under **Manage Authentication**, enable **OAuth 2.0**

### Create an integration record

1. In NetSuite, go to **Setup → Integration → Manage Integrations → New**
2. Under **OAuth 2.0**, enable the **Client Credentials (Machine to Machine) Grant** with the **REST Web Services** scope. Leave **Authorization Code Grant** unchecked.
3. Under **Token-based Authentication**, leave **TBA: Authorization Flow** unchecked.
4. Save, then copy the **Consumer Key / Client ID**. You don't need the Consumer Secret / Client Secret.

## Step 3: Generate a certificate in Tabs

1. Go to [Integrations](https://app.tabsplatform.com/merchant/integrations/connect) in Tabs
2. Click **Connect** on the NetSuite tile
3. Click **Generate Certificate**
4. Download the `.pem` file to upload in NetSuite

The certificate is valid for about two years. Regenerating it is both how you renew it and how you recover a lost `.pem` file. Either way the new certificate has to be uploaded to NetSuite, and regenerating drops the connection back to pending until you do, so treat it as a reset rather than a refresh.

## Step 4: Upload the certificate in NetSuite

1. In NetSuite, go to **Setup → Integration → OAuth 2.0 Client Credentials (M2M) Setup → Create New**
2. Upload the certificate you downloaded from Tabs
3. Map it as follows, then save:
   * **Entity / user:** the dedicated Tabs employee from Step 1
   * **Role:** **Tabs Integration Role** — not **Administrator**
   * **Application:** the M2M integration record from Step 2
4. Copy the **Certificate ID** — you'll enter it later in this flow

REST Web Services must be enabled on the mapped role. NetSuite can issue an access token even when the role cannot call the API; the first REST call then fails. **Tabs Integration Role** includes the required REST access — do not map the certificate to a role that lacks it.

## Step 5: Note your NetSuite Account ID

Find it in NetSuite under **Setup → Company → Company Information** (the **Account ID** field), or read it from your NetSuite URL — for example `1234567` (`1234567_SB1` for a sandbox).

## Step 6: Enter your NetSuite IDs in Tabs

1. Return to [NetSuite setup](https://app.tabsplatform.com/merchant/integrations/netsuite) in Tabs
2. Go to Step 2 of the Tabs flow
3. Enter the three IDs:
   * **Account ID** — your NetSuite account ID (the host in your NetSuite URL)
   * **Client ID** — from the integration record with Client Credentials (M2M) enabled
   * **Certificate ID** — from the OAuth 2.0 Client Credentials (M2M) mapping after uploading the certificate
4. Click **Connect to NetSuite**

Once connected, the NetSuite tile changes from **Connect** to **Set up NetSuite**.

## Step 7: Complete Set up NetSuite

No NetSuite data syncs until this step is saved.

1. Click **Set up NetSuite**
2. Choose the **subsidiary** Tabs should map to. Select **Root subsidiary** to apply no filtering and import across every subsidiary, which is the right choice when your account is not on OneWorld.
3. Choose **Create Sales Order** or **Invoice Only (Don't Create Sales Order)**
4. **Save**

Both choices lock when you save. Changing the subsidiary or the sales-order setting afterward requires Tabs Support, so confirm them before you save.

If you choose **Create Sales Order**, Tabs creates a contract's sales order when the first invoice for that contract is sent, not when the contract is approved or processed. Later invoices for the same contract attach to that existing sales order rather than creating another one, and appear under its **Related Records** in NetSuite.

Once setup is complete, a sync is automatically triggered to pull data from NetSuite. See [What syncs](/erp-account-mapping#what-syncs) for what data moves between NetSuite and Tabs.

### If the subsidiary list won't load

The subsidiary list is read with a query, so a role without the right permissions produces an error instead of an empty dropdown, and **Save** stays disabled. **Tabs Integration Role** already grants what's needed, so this usually means the certificate was mapped to a different role. Two permissions matter, both under **Setup → Users/Roles → Manage Roles**:

* **Reports → SuiteAnalytics Workbook**, without which NetSuite refuses the query outright
* **Lists → Subsidiaries** with at least **View**, without which NetSuite reports `Record 'SUBSIDIARY' was not found`

That second message is indistinguishable from an account that genuinely has no subsidiaries because it is not on OneWorld. If the permission is granted and the list still won't load, contact Tabs Support rather than guessing.

## Related resources

* [ERP & Account Mapping](/erp-account-mapping) — sync behavior, integration items, and account mapping
* [Integration Overview](/integration-overview) — integration landscape and setup models