FSM Mobile App Gets OAuth 2.0 Authentication (Beta)

Oracle has introduced OAuth 2.0 authentication for the Field Service Management (FSM) mobile app as a beta feature in 2026.1. This moves FSM mobile login toward token-based auth, aligning it with the broader OAuth 2.0 framework already available for other NetSuite integrations and REST/SOAP consumers.

What changed

Previously, FSM mobile app users authenticated via legacy NetSuite login. This beta adds an OAuth 2.0 flow specifically for the FSM mobile client. The implementation involves:

• A dedicated Suitelet endpoint — You need to obtain the external URL of a specific FSM Mobile Suitelet. This Suitelet acts as part of the OAuth redirect/callback chain for the mobile app.
• A new FSM-specific OAuth 2.0 integration record — A standard NetSuite integration record configured for OAuth 2.0, but purpose-built for the FSM mobile app's client credentials.
• API secrets via Secrets Management — OAuth 2.0 client secrets for FSM are stored using NetSuite's Secrets Management feature rather than being handled in plain text or custom fields.

Beta limitations

Oracle is explicit that this is not production-ready:

• Sandbox testing only — do not enable on production accounts.
• Testing should focus on the login and authentication flow, not data sync.
• Concurrency errors and timeouts are expected during data loading and syncing in this beta.
• The feature and its documentation may change or be discontinued without notice.

Permissions

Two permission requirements to be aware of:

• Setup requires the Administrator role or equivalent permissions.
• Custom roles that need to authenticate via OAuth 2.0 must have the Log in using OAuth 2.0 Access Tokens permission explicitly granted. This is not new to NetSuite but is now relevant for FSM mobile users on custom roles. See Setup > Users/Roles > Manage Roles to add this permission.

What to do

1. Enable the OAuth 2.0 feature — Navigate to Setup > Company > Enable Features > SuiteCloud and confirm OAuth 2.0 is enabled. If you already use OAuth 2.0 for other integrations, this step may already be done.
2. Get the FSM Mobile Suitelet external URL — The release notes reference a specific Suitelet that handles the OAuth callback for the FSM mobile app. Oracle's documentation does not specify the exact script ID or deployment ID in this note; consult the linked FSM Security Guide for the precise Suitelet details.
3. Create an FSM OAuth 2.0 integration record — Go to Setup > Integration > Manage Integrations > New. Configure it for OAuth 2.0 with the appropriate callback URL (the Suitelet URL from step 2). Record the resulting Consumer Key and Consumer Secret.
4. Create FSM OAuth 2.0 API secrets — Use Setup > Company > API Secrets (Secrets Management) to store the OAuth credentials securely. The FSM mobile app will reference these secrets at runtime.
5. Update custom roles — For any non-Administrator roles used by FSM mobile technicians, add the Log in using OAuth 2.0 Access Tokens permission.
6. Test in sandbox only — Restrict testing to login/authentication flows. Do not test data sync or field operations until Oracle moves this out of beta.

What's unclear

The release note is light on specifics common to OAuth 2.0 implementations:

• No mention of grant type (likely Authorization Code with PKCE for a mobile app, but not confirmed).
• No detail on token lifetimes, refresh token behavior, or revocation endpoints.
• The exact Suitelet script ID and deployment ID for the callback URL are not provided in this note — you'll need to reference the FSM Security Guide or the in-product setup flow.
• No SuiteScript API surface changes are documented — this appears to be a configuration-only feature with no new modules or methods.