This notice is intended for customers who use Token-based Authentication (TBA) integrations that use HMAC-SHA1 as a signature method in your NetSuite accounts.
What is changing?
As of July 30, 2021, the HMAC-SHA1 signature method will stop working in sandbox accounts and test drive accounts. The account IDs of test drives begin with TSTDRV, for example, NetSuite development accounts. Before July 30, 2021, you should update your integrations to use HMAC-SHA256 as the signature method. This prohibition against the HMAC-SHA1 signature method will apply to all TBA integrations, including integrations from third-party solution providers.
Why is this changing?
In TBA integrations, HMAC-SHA1 is no longer cryptographically strong enough to protect this type of signing operation indefinitely. We are moving to HMAC-SHA256 as the signature method for TBA integrations.
Required Actions
Review the TBA integrations in your NetSuite accounts and update the authorization header to use HMAC-SHA256. Change the value of the oauth_signature_method parameter from HMAC-SHA1 to HMAC-SHA256 and change the value of the oauth_signature parameter accordingly. If you use a library for signing, you may need to update your current library to support HMAC-SHA256 or begin using a library that already supports HMAC-SHA256.
Note: A test window to help you identify TBA integrations using HMAC-SHA1 is planned for NetSuite production accounts in mid-August. You will receive a separate notification with the date and time that the test window will occur in your account.
End of Support Schedule for HMAC-SHA1 in TBA Integrations
For more information about TBA and signature methods, see the following help topics:
If you require assistance or more information, please contact NetSuite Customer Support.
