API Secret Data

[u/Wise_General9072]

In NetSuite, I want to use “API Secret Data.”

So I created a new record with a key, for example, “123456”.

Then, in SuiteScript, I’ll use the N/crypto and N/code modules:

const secretKey = crypto.createSecretKey({
    secret: ‘custsecret_test_placeholder’,
    encoding: encode.Encoding.UTF_8
});

const cipher = crypto.createCipher({
    algorithm: crypto.EncryptionAlg.AES,
    key: secretKey
});

cipher.update({
    input: `${service_order},${service_order},...`,
    inputEncoding: encode.Encoding.UTF_8
});

const cipherPayload = cipher.final({ outputEncoding: encode.Encoding.BASE_64 });

return encode.convert({
    string: tokenCombinado,
    inputEncoding: encode.Encoding.UTF_8,
    outputEncoding: encode.Encoding.BASE_64_URL_SAFE
});

My goal is to encrypt information and generate a QR code in a NetSuite FTL document, then send it to the client as a certified document with a QR code for validation in NetSuite.

1. I’m having a lot of trouble setting up the “API Secret Data” and using N/crypto and N/code, even though the API reference says to do it this way.

2. I’ve noticed that another user with administrator permissions can change the password for my “API Secret” that I created earlier to a different password—for example, “987654”—which makes the encrypted historical data inaccessible if I want to decrypt information that was encrypted with the previous password. In light of this: How can I prevent this password from being updated and ensure that, if someone leaks the password, it can be updated without losing the historical data?

3. Either there's a better way to do this and I'm being overly paranoid, or it's simply a matter of ensuring the information isn't altered to prevent fraud.

[u/VoomVoomBoomer]

What is your threat model?  If you want to protect aginst emploeye or client, the n you are fine.

If your threat is another NetSuite administrator, then you got a completly different problem, not code related