Skip to main content

​
Overview

Once NetSuite is connected, the Dema Agent can query ERP data and records exposed by the NetSuite AI Connector Service. Use it to answer questions about orders, inventory, financials, and other NetSuite records during a conversation.

​
Prerequisites

  • A NetSuite account with OAuth 2.0 and Server SuiteScript enabled (Setup → Company → Enable Features → SuiteCloud subtab). The AI Connector Service is the service this integration talks to — it is not a separate feature checkbox.
  • An administrator to create the integration record (step 1 below).
  • A non-administrator role for the person who signs in during the approval step. NetSuite’s AI Connector Service does not support the Administrator role, or any role with full permissions. That role needs the MCP Server Connection and Log in using OAuth 2.0 Access Tokens permissions.
  • Your NetSuite Account ID — find your account-specific URL under Setup → Company → Company Information → Company URLs subtab and copy it from there rather than building it by hand. Sandbox account IDs append _SB1; in the URL the underscore becomes a hyphen and letters are lowercased (for example 123456_SB1 → 123456-sb1).
NetSuite requires you to create your own OAuth integration record and paste its credentials into Dema. You only need to do this once per NetSuite account.

​
Connect NetSuite

1

Create an integration record in NetSuite

  • In NetSuite, go to Setup → Integration → Manage Integrations → New.
  • Give the integration a recognizable name, for example Dema Agent.
  • Set State to Enabled.
  • Under OAuth 2.0, check Authorization Code Grant and, under Scope, select NetSuite AI Connector Service.
  • Uncheck Public Client — Dema authenticates with a client secret. Leave Client Credentials (Machine to Machine) Grant, Dynamic Client Registration, and all Token-Based Authentication boxes off.
  • In Redirect URI, enter https://app.dema.ai/agents/oauth/callback exactly.
  • Save the integration.
NetSuite AI Connector Service must be the only scope on the record — it cannot be combined with REST Web Services, RESTlets, or SuiteAnalytics. If the scope is not listed, confirm the AI Connector Service is available for your account.
2

Copy the client ID and client secret

NetSuite shows the Consumer Key / Client ID and Consumer Secret / Client Secret only once, immediately after saving. Copy both values now. If you lose the secret you must reset it from the integration record (which generates a new one) and reconnect in Dema.
3

Paste the credentials into Dema

In Dema, go to Agents → Settings → Integrations, find NetSuite, and click Connect. Enter:
  • Client ID from the previous step
  • Client secret from the previous step
  • MCP URL in the form https://{accountId}.suitetalk.api.netsuite.com/services/mcp/v1/all, replacing {accountId} with your NetSuite Account ID (lowercase, sandboxes use a hyphen, e.g. 123456-sb1)
Click Add. Sign in to NetSuite and approve the authorization. You are returned to Dema with the integration marked as Active.

​
Scopes Dema requests

The session runs with the role you sign in with during the approval step, so the agent only sees data that role can already access. Use a non-administrator role (see Prerequisites) scoped to the records the agent should be able to read or update.

​
Tokens and rotation

Dema refreshes access automatically: NetSuite access tokens last 60 minutes, and refresh tokens are single-use and rotate on each refresh (expiring after 2 days by default, configurable on the integration record). The Consumer Key and Secret themselves do not expire — but if you reset them in NetSuite, click Reconnect in Dema and enter the new values.

​
Troubleshooting

  • Dema says the URL is invalid. The MCP URL must be https://{accountId}.suitetalk.api.netsuite.com/services/mcp/v1/all. Make sure you replaced {accountId} with your real Account ID (lowercase, sandboxes use a hyphen, for example 123456-sb1).
  • Redirect URI mismatch. The Redirect URI on the integration record must be exactly https://app.dema.ai/agents/oauth/callback, including protocol and path.
  • Approval screen fails or the scope is missing. Confirm OAuth 2.0 and Server SuiteScript are enabled in Setup → Company → Enable Features → SuiteCloud, and that the integration record has the NetSuite AI Connector Service scope.
  • Sign-in is rejected or the agent gets no access. The AI Connector Service does not support the Administrator role, or any role with full permissions. Sign in during approval with a non-admin role that has the MCP Server Connection and Log in using OAuth 2.0 Access Tokens permissions.
  • Dema cannot authenticate with the client secret. NetSuite shows the secret only once. If you lost it, reset it on the integration record and reconnect in Dema with the new value.

​
Additional resources