Skip to content
SeamSetTalk to us

All guides

NetSuite AI Connector (MCP) errors: “Your role does not support OAuth2 login” and other fixes

By Arnaud de Turckheim

Last verified against NetSuite 2026.2

In short

“Your role does not support OAuth2 login, please select a different one.” means NetSuite refused the role picked in the sign-in window Claude or ChatGPT opened. Fix: use a non-Administrator role with MCP Server Connection and Log in using OAuth 2.0 Access Tokens, clear its Core Administration Permissions box, log out of NetSuite, and reconnect.

The NetSuite AI Connector Service is Oracle’s hosted MCP (Model Context Protocol) server: it lets Claude, ChatGPT and other AI clients work with NetSuite data through a role each user authorizes with OAuth 2.0. As of NetSuite 2026.2 (September 2026):

  • Usual causes of other errors: the role, the MCP Standard Tools SuiteApp, the server URL, token lifetimes and account concurrency.
  • Check two NetSuite logs first: the integration record’s AI Connector Service (MCP) execution log and the Login Audit Trail Detail column.
  • Some Claude failures were Anthropic-side bugs. If sign-in succeeds but the execution log is empty or shows failures, first check that MCP Standard Tools is installed in that exact account, then disconnect and reconnect in Claude.

Who this is for

NetSuite administrators facing an AI Connector error in Claude, ChatGPT, Claude Code, Codex, Cursor or Copilot Studio. NetSuite MCP not working? Find your message in the error index.

What you need

An Administrator login to edit roles and integration records. The connection itself must use another role, which you can add to your own employee record (step 5 of the first fix). Not connected yet? Start with How to connect NetSuite to Claude, ChatGPT and other AI clients.

Where to look first

  1. MCP execution log. Setup > Integration > Manage Integrations, your AI client’s record (Claude and ChatGPT each get one at the first connection), Execution Log tab, AI Connector Service (MCP) subtab. Rows show date and time, duration, status, user email, HTTP status code, method and URL path, for 21 days (seven in sandbox).
  2. Login Audit Trail. Setup > Users/Roles > User Management > View Login Audit Trail, check Use Advanced Search, add Detail and Token-based Application Name on the Results subtab. Detail gives the error for OAuth 2.0 logins with a status of Failure. Oracle does not say whether the role refusal below appears.
  3. Features. Setup > Company > Enable Features, SuiteCloud subtab: Server SuiteScript and OAuth 2.0, plus REST Web Services for MCP Standard Tools.
  4. SuiteApp status. Customization > SuiteCloud Development > Installed SuiteApp List.
  5. Concurrency. Setup > Integration > Integration Management > Integration Governance.

Error index

Message or symptom (links to the fix) Likely cause Basis
“Your role does not support OAuth2 login, please select a different one.” Administrator, missing OAuth 2.0 permission, Core Administration Permissions Oracle rule, community
“Invalid login attempt” See the Detail code Oracle
“Authorization with the MCP server failed” (Claude) Token exchange, sometimes Claude-side GitHub issues
“Couldn’t reach the MCP server” or “NetSuite returned an error when connecting” (Claude) SuiteApp missing, or Claude-side Anthropic
Connected, but shown disconnected URL missing /all Oracle
No role to pick, role shows “N/A” Session not refreshed, SAML Community, Oracle
Empty tool list, “Access denied.”, tools missing SuiteApp, permissions, File Cabinet Oracle
“Access to this URL is restricted.” Outdated SuiteApp One report
Reconnect every day or week Token lifetimes Oracle settings, community
“Too Many Requests”, “HTTP 504 MCP Request timed out” Concurrency, long calls Oracle, one report
“Record ‘…’ was not found”, or the AI says a table does not exist Role lacks the table’s permission Practitioner video, community
Totals do not match NetSuite Periods ignored, SuiteQL Oracle
The AI gives an internal ID as the record number AI summary after a write Practitioner video
Production works, sandbox fails Per-environment setup, open Claude issue Oracle, GitHub

1. Cannot connect, or authorization failed

“Your role does not support OAuth2 login, please select a different one.”

NetSuite shows this in the sign-in window that Claude or ChatGPT opens, after you pick a role. Short answer: pick a role that is not Administrator, holds MCP Server Connection and Log in using OAuth 2.0 Access Tokens, and has Core Administration Permissions cleared. Then log out of NetSuite and reconnect.

Oracle does not document this string. Its rule: the service cannot run if you log in “with the Administrator role or roles that have full permissions”, which Oracle does not define. Reported causes:

  • Administrator (Reddit, September 2025).
  • No Log in using OAuth 2.0 Access Tokens. Log in using Access Tokens is the token-based authentication (TBA) permission and does not count (Oracle).
  • Core Administration Permissions checked. A Reddit user (August 2026) saw working MCP roles fail until they unchecked it; a second user tied the change to their 2026.2 upgrade. Oracle says the box makes a role “similar to the standard Administrator role”.
  • The deprecated Full Access role, which JR Tallman’s tutorial says will not work (00:55).

Fix, step by step:

  1. As Administrator, go to Setup > Users/Roles > Manage Roles and edit the AI role. No AI role yet? Create one, permission by permission.
  2. On the role record itself, clear the Core Administration Permissions box, even if a tutorial recorded before 2026.2 grants it (Oasis Solutions, 09:35).
  3. On the Permissions > Setup subtab, add MCP Server Connection (Full) and Log in using OAuth 2.0 Access Tokens (Full).
  4. Remove OAuth 2.0 Authorized Applications Management if a tutorial added it (the failing role in the August report held it). Oracle says a role with it “can’t access RESTlets, REST web services, and SuiteAnalytics Connect using OAuth 2.0”; MCP is not named. Save.
  5. Only have Administrator? Add the AI role to your own employee record: Lists > Employees > Employees, Edit, Access subtab, Role field, Add, Save. No extra license: Oracle counts a user with any full-licensed role once, “with or without other roles”.
  6. Log out of NetSuite and back in, or the new role is not offered (Prolecto, 21:07).
  7. Reconnect from the client (Claude: Customize > Connectors; ChatGPT: Apps, the NetSuite app, Connect). If the consent screen shows Administrator, click Choose Another Role (JR Tallman, 03:30).
  8. Check: new execution log rows (a working connection in #69507 logged initialize and tools/list with HTTP 200) and NetSuite tools listed in the client.

Still refused? Check that the role and employee are active (EntityOrRoleDisabled), then see Still stuck.

“Invalid login attempt”

Reported with Microsoft Copilot on a sandbox (Reddit, November 2025; the roles tried included Full Access, a suspect under Oracle’s rule) and with Power Apps (Oracle Community). The message gives no reason; the Login Audit Trail Detail column does. Oracle’s codes:

Detail code Meaning Fix
ScopeMismatched Scope empty or differs from the record On the record’s Authentication subtab, check NetSuite AI Connector Service; the client requests mcp alone
AuthorizationCodeGrantRequired Code grant off Check Authorization Code Grant
InvalidRedirectURI Bad redirect URI Match the record’s Redirect URI exactly
UnknownIntegration, ClientAuthenticationFailed Wrong client ID or secret Use the ID of the record in use
InvalidRequest, InvalidGrant PKCE (Proof Key for Code Exchange) missing or mismatched Use a client with PKCE S256, required for mcp
IntegrationBlocked Record not enabled Set State to Enabled

For other clients (Copilot Studio or Postman, for example), Oracle adds: an automatically created record with the AI Connector scope, for example from a SuiteApp installation, starts pending until an administrator enables it. Manual records need all Token-based Authentication, Client Credentials and other scope boxes cleared.

“Authorization with the MCP server failed” (Claude)

Appears after NetSuite consent, with an ofid_ reference. Reported on the Oracle Community (April 2026) and GitHub (claude-ai-mcp#522, open since July 1, 2026; claude-code#69507, June 2026). In #463, Anthropic traced one token-exchange failure to “a bug on our side”, fixed June 18, 2026.

Fix: read the Detail code first. If the Login Audit Trail shows no failure but the execution log is empty or shows failed requests, disconnect NetSuite in Claude (Customize > Connectors) and connect again; a full reconnect cleared #69507. If it persists, send Anthropic the ofid_ reference.

“Couldn’t reach the MCP server” or “NetSuite returned an error when connecting” (Claude)

In #258 (May 2026) the execution log was empty: NetSuite had answered Claude’s initialize call with HTTP 200 and an empty body, and Anthropic called its own message “misleading here”.

The full second message, “Your account was authorized, but NetSuite returned an error when connecting”, followed a Claude deployment in #69507 (fixed by Anthropic; the log showed failed 404 rows). It also hits sandboxes in #737 (section 7).

Fix (Anthropic’s checklist in #258): MCP Standard Tools (com.netsuite.mcpstandardtools) installed in that exact account, features enabled, role permissions granted. Then disconnect and reconnect.

Claude says connected, but the connector is disconnected

Oracle’s causes: URL missing /all, SuiteApp not installed, or role misconfigured. Use one of Oracle’s two formats, never the bare /services/mcp/v1:

https://<accountid>.suitetalk.api.netsuite.com/services/mcp/v1/suiteapp/com.netsuite.mcpstandardtools
https://<accountid>.suitetalk.api.netsuite.com/services/mcp/v1/all

The first returns MCP Standard Tools only; the second adds custom tools. Copy the domain from the Company URLs subtab of Setup > Company > Company Information. Oracle: “Do not attempt to construct an account-specific domain yourself.”

2. No role offered, or the wrong role

  • New role not listed. Prolecto names three causes: the role lacks the two permissions, it is not assigned to the user, or it was assigned during the current session, which needs a NetSuite logout and login (22:20).
  • SAML (Okta) users see the role as “N/A” or not at all (Reddit, February and June 2026). Oracle: SAML users cannot access roles without the SAML Single Sign-on permission. Two undocumented workarounds, to test in a sandbox:
    • add that permission to the AI role (one commenter; a later reply says it worked);
    • use non-SAML copies of the roles (another user, after NetSuite Support told them SAML-only sessions are not supported).
  • EntityOrRoleDisabled. The role or employee is inactive.

3. Tools missing, or an empty tool list

  • Empty list. Oracle: the SuiteApp “may not have been installed successfully” or the role lacks tool permissions. Check the Installed SuiteApp List for Installation Failed or Validation Failed.
  • “Access denied.” Oracle: the role cannot reach the tools’ File Cabinet folder. In Documents > Files > File Cabinet, edit the folder and clear any Restrict by setting excluding the role (a Reddit suggestion: Restrict by Group on the SuiteApps folder).
  • “API call failed: Access to this URL is restricted.” on record tools while reports and SuiteQL worked (Reddit, August 2026). The reporter fixed it by upgrading MCP Standard Tools. The SuiteApp updates itself, but a failed upgrade leaves the previous version running (Oracle): check the Installed SuiteApp List.
  • Record tools missing. Oracle: record tools, ns_getSuiteQLMetadata and Record Selector need the REST Web Services permission (Full); the feature alone is not enough. Saved search tools need Perform Search (View). In Prolecto’s demo, refreshing the ChatGPT connector after the grant shows the tools, no new sign-in (36:43).
  • Write tools in one account but not the other (Reddit, March 2026, unconfirmed). Check these, then refresh the connector:
    • REST Web Services (Full) on the role: it gates all four record tools, read and write.
    • Claude’s Tool permissions, which Team and Enterprise owners can limit organization-wide (Anthropic).
    • The server URL: one commenter fixed it by switching a custom connector to /all.
  • “This tool is not allowed”. Oracle: the tool needs a permission “the current session doesn’t have.”
  • Custom tools absent. Only /all or their own SuiteApp URL returns them, and only from active toolsets (Oracle). Check the Inactive column at Customization > Scripting > Custom Tools; only the Administrator role can activate a toolset. See Build a custom MCP tool.

4. Claude or ChatGPT keeps asking you to reconnect

Reddit users (March to September 2026) re-authorize Claude or Claude Cowork daily or every couple of days.

Likely cause: AI Connector records are public OAuth clients. Oracle: the access token lasts 60 minutes; the refresh token is “only valid for two days by default and is for one-time use only.” Two integration record fields, each 1 to 720 hours:

Field Default Effect
Refresh Token Validity (In Hours) 48 Unused longer than this: sign in again
Maximum Time For Token Rotation (In Hours) 168 Sign in again after this, used or not

With the defaults, anyone who leaves the connector unused for 48 hours (a weekend) signs in again, and everyone does after 168 hours. A daily reconnect is shorter: read the values on your record, since Oracle says installed records can have other defaults. Prolecto, not Oracle, ties these fields to the reconnects.

Fix: Prolecto shows both fields on the automatic ChatGPT record and suggests raising the rotation time, up to 720 hours, for testing (43:13). Oracle lists only State and Concurrency Limit as editable on the automatic Claude record, so you may not be able to.

Longer values mean longer-lived access: follow your IT policy (Governing AI access).

Sessions also end at each sandbox refresh, or when an administrator revokes the app at Setup > Users/Roles > OAuth 2.0 Authorized Applications.

5. “Too Many Requests”, timeouts and HTTP 504

“Too Many Requests”. Oracle: without a Concurrency Limit on the integration record, the connector shares account concurrency with every integration, and each tool call is “typically preceded by additional requests.”

Base limits: Standard 5, Premium 15, Enterprise 20, Ultimate 20, plus 10 per SuiteCloud Plus license; development and partner accounts stay at 5. Fix: retry, check Integration Governance, and cap the AI record so it cannot starve other integrations.

“HTTP 504 MCP Request timed out”. Reported with ChatGPT on a report (Reddit, September 2026): the 504 appeared in the NetSuite execution log after 160 seconds; the report takes seven minutes in NetSuite. Oracle notes AI clients have their own limits and “large queries may cause timeout”; no NetSuite-side MCP timeout is published.

Fix: ask for less per call (shorter dates, one subsidiary, a named saved search). For SuiteQL queries, use pageSize.

6. Wrong or incomplete numbers

  • “Record ‘employee’ was not found” (any table name), or the AI says a table does not exist. In SuiteQL, NetSuite reports a table the role cannot read as not found, not as denied: Louis Balla (Nuage) saw his read-only Claude call transaction missing until he fixed the role (00:34).
    • Fix: open the table in Setup > Records Catalog as Administrator. Oracle: it shows each record type’s permission requirements, but lists only what your role can access. For transaction, add Find Transaction (permissions guide).
  • Periods. Oracle: “Accounting periods are not supported.” Report tools ignore Report by Period, and the AI may assume a calendar fiscal year. Give exact dates.
  • Subsidiaries. Consolidated subsidiaries have negative IDs, and the role’s subsidiary access shapes results.
  • Custom reports. May return nulls with custom segments as columns; custom filters are unsupported.
  • Rows. About 5,000 rows per call is an AI client limit, per Oracle.
  • SuiteQL. Oracle: “Don’t use SuiteQL or build new reports for financial reports.”
  • Oracle’s skill. netsuite-ai-connector-instructions puts ROWNUM <= 1000 on every SuiteQL query, even a SUM ... GROUP BY; under Oracle Database rules that total covers 1,000 lines at most (not verified in SuiteQL).
  • Record numbers after a write. After ChatGPT created a purchase order with a standard (not custom) tool, it gave the internal ID as the PO number; Crowe’s Alejandro Alvarez caught it in NetSuite (AI & MCP with NetSuite Part 2). Ask for the document number, then check the record.

Check totals against the NetSuite report. More: Claude and ChatGPT on NetSuite for finance.

7. Production works, sandbox fails

  • Check the Installed SuiteApp List in the sandbox itself and install MCP Standard Tools there if it is missing.
  • Oracle: authorizations are not copied to sandbox; users authorize again after every refresh.
  • Use the sandbox domain: account 123456_SB1 becomes 123456-sb1.
  • Users report one Claude directory connector per organization and add a custom connector for the sandbox (Reddit, unconfirmed by Anthropic).
  • Several accounts connected: see Sandbox and multiple accounts for how to keep them apart.
  • #737 (open since July 30, 2026): a sandbox fails with “NetSuite returned an error when connecting” and an empty log, although its SuiteApp matches production.

8. Client-specific failures

Claude Code. Issues #11862 and #21799 (“No client info found”, “SDK auth error: Le”, verbatim and truncated) closed without a confirmed fix. Simplest path: add NetSuite in claude.ai. Claude Code signed in with that account lists it under /mcp, unless an API key (ANTHROPIC_API_KEY, apiKeyHelper) or another provider handles the login.

With a manual integration record: Claude Code v2.1.229 sent http://127.0.0.1:PORT/callback; v2.1.231 restored localhost.

Codex. Oracle’s procedure is SuiteAnswers 1045686 (login required). Codex stops a tool call after tool_timeout_sec, 60 seconds by default, set in ~/.codex/config.toml (OpenAI).

Cursor. A connection broke when Cursor moved its redirect from cursor:// to http://localhost (Reddit, July 2026, no fix in the thread). Oracle’s page says “The http:// scheme isn’t supported” yet describes localhost redirects for Dynamic Client Registration.

ChatGPT. One report (Reddit, October 2025, unresolved): the server “doesn’t implement our specification: search action not found”. OpenAI’s deep research and company knowledge expect read-only tools named search and fetch; MCP Standard Tools’ tools have other names.

Oracle’s documented path is Apps, the NetSuite app, Connect. With custom tools, each new ChatGPT connection needs a new integration record (Oracle).

Copilot Studio. Read the Detail code first. Tanwa Sripan’s blog (February 2026, updated March 2026) and Gurus Solutions (July 2026) both report that Copilot Studio’s built-in OAuth 2.0 option now handles PKCE. Oracle’s procedure: SuiteAnswers 1046882.

The blog’s method: choose OAuth 2.0, then Manual; create the integration record with a placeholder redirect URI, then replace it with the one Copilot Studio generates.

Non-English accounts. ns_updateRecord failed with HTTP 400 “Invalid language” on a Portuguese account while reads worked (#48784, one report).

Common problems

Pitfall Result Fix
Following a 2025 tutorial Retired MCP Sample Tools, admin-level permissions MCP Standard Tools, the two required permissions
Granting Log in using Access Tokens That is the TBA permission, not OAuth 2.0 Grant Log in using OAuth 2.0 Access Tokens
Expecting an API key or machine login The mcp scope needs a user sign-in with PKCE Connect as a user; Oracle requires Client Credentials boxes cleared

Still stuck: what to send

Collect the account ID and environment (production or sandbox), the role name, the client and its version, the Login Audit Trail Detail code, execution log rows (time, HTTP status, method, URL path), and Claude’s ofid_ reference.

If NetSuite logs a failure, start with NetSuite Support. If both NetSuite logs stay empty after the section 1 checks, send the client’s reference to Anthropic or OpenAI.

FAQ

Why does NetSuite say “Your role does not support OAuth2 login, please select a different one”?

NetSuite refused the role picked in the AI client’s sign-in window. Oracle blocks Administrator and “roles that have full permissions”; community reports add roles with Core Administration Permissions checked. Use a role with the two AI permissions, log out of NetSuite and back in, then reconnect and pick it.

Can I connect Claude to NetSuite with the Administrator role?

No. Oracle blocks Administrator and “roles that have full permissions” in case the AI client’s security is at risk. Use a dedicated role: see A least-privilege NetSuite role for AI.

Do I need a separate NetSuite user for the AI connector?

No. Add the AI role to the existing employee record: Oracle counts a user with any full-licensed role once, “with or without other roles”. Each person should connect as themselves, since Oracle asks each user for consent and the execution log records their email.

Why does my Claude connector to NetSuite keep disconnecting every day?

Most likely the integration record’s token settings. By Oracle’s defaults, an unused refresh token expires after 48 hours and everyone signs in again after 168 hours. A daily reconnect suggests other values on your record.

Can Claude connect to a NetSuite sandbox?

Yes. Install MCP Standard Tools there if it is missing, use the sandbox domain from Company URLs, and authorize again after every refresh. Some users report sandbox-only failures (open GitHub issue #737) and use a custom connector for the sandbox.

Where is the log of MCP calls, and how long is it kept?

On the integration record, Execution Log tab, AI Connector Service (MCP) subtab: 21 days in production, seven in sandbox. It shows user, method, URL path and HTTP status; the prompt is not among the fields.

Sources

Oracle NetSuite Help Center (read September 26, 2026)

AI client vendors

Third party