Contents5 sections ↓
You connected Claude or ChatGPT to NetSuite through the AI Connector Service, it worked, and a day or a week later it sends you back to the NetSuite login page. Nothing is broken. That is how the connector's OAuth 2.0 tokens are designed to expire, and two fields on one integration record decide how often it happens.
Direct answer: The NetSuite AI Connector Service signs in with OAuth 2.0 authorization code and a public client. The access token lasts 60 minutes and the AI client renews it silently with a refresh token. On a public client, that refresh token is valid for 48 hours by default and can be used once, and the user must sign in again after the "Maximum Time for Token Rotation", 168 hours (7 days) by default. Both values are set on the integration record and accept 1 to 720 hours. Raising them reduces how often people sign in, up to once every 30 days. It cannot remove the sign-in: the connector has no machine-to-machine mode, so unattended agents need a separate integration.
Checked on November 5, 2026 against Oracle's OAuth 2.0 documentation, linked at the end. For the full setup, see how to connect NetSuite to Claude.
The three clocks
When you connect, NetSuite creates an integration record for the connector with Public Client and Authorization Code Grant checked and the NetSuite AI Connector Service scope enabled. That record runs three timers:
| Timer | Default | Range | What happens when it runs out |
|---|---|---|---|
| Access token | 60 minutes | Fixed | The AI client uses the refresh token to get a new one. You don't notice. |
| Refresh Token Validity (In Hours) | 48 | 1 to 720 | If the connector was not used inside this window, the refresh fails with invalid_grant and you sign in again |
| Maximum Time For Token Rotation (In Hours) | 168 | 1 to 720 | You sign in again, no matter how often you used the connector |
The two last fields only appear when Public Client is checked, and Oracle notes the defaults can differ when the integration is installed from another source. Check the values on your own record.
That table explains the two complaints we hear:
- "It logs me out after a weekend." Nobody used the connector for more than 48 hours, so the single-use refresh token expired.
- "It logs me out every week even though I use it daily." That is the 168-hour rotation limit.
How to change the settings
You need an administrator, or a role that can edit integration records.
- Go to Setup > Integration > Manage Integrations.
- Open the record the connector created. It has the NetSuite AI Connector Service scope checked. If you connected more than one AI client, there may be one record per client.
- On the Authentication subtab, under OAuth 2.0, find Refresh Token Validity (In Hours) and Maximum Time For Token Rotation (In Hours).
- Set them and save. To be sure the new values apply, disconnect and connect the AI client once.
If the fields are read-only on the record your account created, the defaults apply; ask your administrator or Oracle support before building workarounds.
What values to use is a security decision, not a technical one:
| Policy | Refresh Token Validity | Maximum Time For Token Rotation | Effect |
|---|---|---|---|
| Oracle default | 48 | 168 | Sign in weekly, and after any 2-day gap |
| Daily users, normal risk | 168 | 720 | Sign in monthly, and after a week without use |
| Strict | 8 to 24 | 24 to 168 | Sign in daily or weekly |
A longer session means a stolen laptop with an active AI session keeps NetSuite access longer. Keep the role behind the connector narrow (read-only where possible, never Administrator, which Oracle blocks anyway) and longer sessions become a smaller risk. Our NetSuite MCP guide covers role design.
Other reasons you might be sent back to the login
If the timers are long and you still have to sign in, check these:
| Symptom | Cause | Fix |
|---|---|---|
| Login loop: you sign in and land back on the login | Wrong permission on the role ("Log in using Access Tokens" instead of "Log in using OAuth 2.0 Access Tokens"), or an Administrator role | Fix the permission or switch to a non-admin role |
| Works in production, fails in sandbox after a refresh | OAuth 2.0 authorizations are not copied to sandbox, and a refresh clears them | Connect again to the sandbox URL after each refresh |
| Reads work, creates fail with "Access to this URL is restricted" | Not an expiry problem: the role lacks REST Web Services or the record permission, or the MCP Standard Tools SuiteApp is out of date | See the troubleshooting table in our Claude setup guide |
What you can't fix with settings: unattended agents
The AI Connector Service supports one grant, OAuth 2.0 authorization code with PKCE. Oracle's integration record guidance for the connector says to clear the Client Credentials (Machine to Machine) Grant box. So there is no way to run the connector with no person behind it: a refresh token always comes from someone signing in, and after 720 hours at most, someone has to sign in again.
For an agent that runs on a schedule (a nightly reconciliation, an inbox triage, a sync job), use a different path:
- A RESTlet or REST Web Services endpoint authenticated with OAuth 2.0 client credentials, a certificate and a signed JWT. No user sign-in and no refresh token. Our TBA to OAuth 2.0 guide walks through the setup.
- Your own MCP server in front of it, exposing a small set of tools that call that endpoint. The agent talks MCP; NetSuite sees a normal machine-to-machine integration with its own narrow role.
This is more work than the hosted connector, and for people chatting with NetSuite data the hosted connector is the right tool. For background jobs, it is the only design that does not depend on someone's login. Oracle's own SuiteAgents, announced at SuiteWorld 2026, run inside NetSuite and are another route for some of these jobs.
Need an AI agent that runs without anyone logged in?
We build machine-to-machine NetSuite endpoints and custom MCP tools with narrow roles, so scheduled agents run without a user session.
Talk to a NetSuite AI developerSources
- Create Integration Records for Applications to Use OAuth 2.0 (Oracle NetSuite help center): Refresh Token Validity and Maximum Time For Token Rotation fields; AI Connector Service scope
- Refresh Token POST Request to the Token Endpoint (Oracle NetSuite help center): 60-minute access token, single-use refresh tokens for public clients,
invalid_granton expiry - Get Started with the NetSuite AI Connector Service (Oracle NetSuite help center)
What clients ask before signing
Mercedes · BrokenRubik
Replies by email within 24 hours
Mercedes
Connecting a store, a 3PL or another app to NetSuite? Name the two systems and we'll reply with the approach we'd take.
Joaquin Vigna
Co-Founder & CTO
Co-founder and Chief Technology Officer at BrokenRubik with 12+ years of experience in software architecture and NetSuite development. Leads technical strategy, innovation initiatives, and ensures delivery excellence across all projects.