[$250] WS Settings - Can't connect to Netsuite due to an authentication error

[jponikarchuk]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: v9.3.53-2
Reproducible in staging?: Yes
Reproducible in production?: Yes
If this was caught during regression testing, add the test name, ID and link from BrowserStack: https://test-management.browserstack.com/projects/2219752/test-runs/TR-16387/folder/13176706/41236846/1309881827
Email or phone of affected tester (no customers): applausetester+ccardfeed@applause.expensifail.com
Issue reported by: Applause Internal Team
Bug source: Regression TC Execution
Device used: Windows 11 / Chrome
App Component: Workspace Settings

Action Performed:

Preconditions:

• logged in to an account that already has a control workspace
• enable accounting and navigate to accounting in workspace setting

Steps:

1. Click "connect" on Netsuite
2. Enter credentials found in 1Password

Expected Result:

Netsuite connection succesfull

Actual Result:

Can't connect to Netsuite due to an authentication error

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

Video.mp4

View all open jobs on GitHub

Issue Owner

Current Issue Owner: @truph01

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~022042222680764968611
• Upwork Job ID: 2042222680764968611
• Last Price Increase: 2026-04-09

[MelvinBot]

Issue Analysis

Root Cause: This is a backend issue, not an App (frontend) issue. The App's NetSuite connection flow (App/src/components/ConnectToNetSuiteFlow/index.tsx) simply collects three TBA (Token-Based Authentication) credentials — netSuiteAccountID, netSuiteTokenID, netSuiteTokenSecret — and passes them to the backend via API.write('ConnectPolicyToNetSuite', ...) (App/src/libs/actions/connections/NetSuiteCommands.ts:21-42). The App performs no client-side authentication or validation of these credentials. The isAuthenticationError flag displayed in the UI is set entirely by the backend at policy.connections.netsuite.lastSync.isAuthenticationError.

Recommended Fix: Investigate the backend (Web-Expensify / Integration-Server) NetSuite connection handler. Check backend logs for ConnectPolicyToNetSuite commands to see the specific error NetSuite's API returns. Common causes per the NS0109 troubleshooting doc include expired/revoked tokens, changed passwords, modified role permissions, or disabled roles on the NetSuite side.

Investigation details

App-side flow (confirmed working as designed)

1. User clicks "Connect" on NetSuite → ConnectToNetSuiteFlow mounts (App/src/components/ConnectToNetSuiteFlow/index.tsx:18-63)
2. 5-step wizard guides user through NetSuite setup (App/src/pages/workspace/accounting/netsuite/NetSuiteTokenInput/NetSuiteTokenInputPage.tsx:18-24): Install Bundle → Enable Token Auth → Enable SOAP → Create Access Token → Enter Credentials
3. On submit, the App sends credentials to the backend (App/src/libs/actions/connections/NetSuiteCommands.ts:21-42) with only optimistic sync progress data — no success/failure handling on the client
4. Backend processes the connection, sets lastSync.isAuthenticationError = true on failure
5. App reads this flag via isAuthenticationError() (App/src/libs/actions/connections/index.ts:262-265) and displays the error

Why this is not an App bug

• The App code has had no meaningful recent changes to the NetSuite connection flow
• There is zero client-side credential validation — credentials are passed directly to the backend
• The error message "Can't connect to NetSuite due to an authentication error" is rendered when lastSync.isAuthenticationError === true, a flag set by the backend
• The App correctly displays re-authentication UI (skips setup pages, shows "Enter credentials" button) when this flag is set

What needs backend investigation

• Check backend logs for ConnectPolicyToNetSuite / UpdateNetSuiteTokens commands to see the exact error from NetSuite's API
• Determine if there were recent backend deployments that modified NetSuite TBA authentication handling
• Check if this is a NetSuite-side change (TLS requirements, API deprecation, TBA endpoint changes)
• Verify whether this affects all NetSuite connections or only specific accounts/tokens

---

Next Steps: This issue needs backend investigation (Web-Expensify / Integration-Server). The App frontend is functioning as designed — it correctly collects and forwards credentials, and correctly displays the backend-reported authentication error.

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @truph01 (External)