The quick answer
Enable Server SuiteScript and OAuth 2.0, plus REST Web Services if you use the MCP Standard Tools SuiteApp. Give a restricted custom role MCP Server Connection and Log in using OAuth 2.0 Access Tokens, with REST Web Services too for the standard tools, and make sure the user who connects has that role. In ChatGPT, create a custom connector with your account's MCP server URL and OAuth. On NetSuite's consent page, pick the custom role. Administrator is refused, because it and other full-access roles can't authorize the AI Connector Service. Depending on your ChatGPT flow and NetSuite release, an administrator may also need to set up the integration record first.
The screenshots show sample data. Person, company and account names are fictional. Use your own records and values when following the steps.
Before you start
You need someone who can change NetSuite features and roles, and a ChatGPT login that can add a custom connector. The ChatGPT side comes with caveats. In this walkthrough the ChatGPT account has developer mode switched on, and the Create button is on Apps & Connectors only because of that. Whether you can turn developer mode on depends on your ChatGPT plan and your workspace settings, so check those first. The ChatGPT screens in the recording are a simplified stand-in, not a capture of the live product. Labels and menu paths in your ChatGPT version may differ.
The NetSuite side is what this guide is sure about. The role you authorize with has to exist before you start, and it has to be assigned to the user who signs in. Assign it on the employee record (Lists > Employees > Employees, then the Access subtab). The recording doesn't show that step, so check it in your own account. That user's roles also show up on the consent page later, so a role that's missing there isn't assigned to them.
The connection permissions only open the door, and REST Web Services at Full doesn't give access to any record on its own. The role still needs ordinary permissions for the records, reports and searches ChatGPT should reach, such as Lists > Vendors if it should work with vendors. Everything ChatGPT does runs as that user and role, and your subsidiary and employee restrictions still apply. If the SuiteApp's files are restricted in your account, the role may need File Cabinet access to them as well. The AI Connector Service also can't be turned on for healthcare customers with a signed BAA.
This guide connects ChatGPT. It doesn't cover a Claude connection, which has its own flow, and it doesn't cover asking questions after you connect.
01. Check the SuiteCloud features
Go to Setup > Company > Enable Features and open the SuiteCloud subtab. Under SuiteScript, Server SuiteScript is checked.
Further down, OAuth 2.0 is checked under Manage Authentication. REST Web Services is checked under SuiteTalk, and the MCP Standard Tools need it for record operations. Check any that aren't, then click Save. Token-based Authentication is checked in this account too, but the OAuth 2.0 connection doesn't need it.
02. Open the dedicated role
Go to Setup > Users/Roles > Manage Roles and click the role built for this connection. Here it's AI Connector Accountant, a custom role. If you don't have one yet, create one. Don't use Administrator or another role with full access to NetSuite features, because they can't authorize the AI Connector Service. Step 6 shows NetSuite refusing Administrator.
03. Check the Setup permissions and save
On Permissions, click the Setup subtab. MCP Server Connection, Log in using OAuth 2.0 Access Tokens and REST Web Services are each at Full. Log in using Access Tokens is a different permission. It's listed right above and is also at Full here, but the connection depends on the OAuth 2.0 one. Add any permission that's missing, then click Save.
NetSuite shows a Role saved. message.
04. Confirm MCP Standard Tools is installed
Open the SuiteApps tab. It sits under the ••• menu when the tab bar is full. Type mcp in Search SuiteApps, press Enter, and click MCP Standard Tools. The right-hand panel shows Installed. If it shows an install button instead, install it first. This SuiteApp supplies the tools ChatGPT will see.
05. Create the custom connector in ChatGPT
In ChatGPT, open the profile menu, click Settings, then Apps & Connectors, then Create. ChatGPT has no built-in NetSuite connector here, so you define your own.
In New Connector, type Larkspur NetSuite in Name. In MCP Server URL, type https://4471926.suitetalk.api.netsuite.com/services/mcp/v1/all, with your own account ID in place of 4471926. Leave Authentication on OAuth. Check I understand and want to continue, which confirms ChatGPT's notice that custom MCP servers carry risk, then click Create. ChatGPT sends you to NetSuite.
Take the account ID from Setup > Company > Company Information rather than copying the example. The /all ending exposes every custom tool the account offers, and the role's permissions still limit what each tool can do. A URL ending in /suiteapp/com.netsuite.mcpstandardtools limits the connector to the MCP Standard Tools. The recording uses /all. A sandbox account ID includes its suffix.
06. Authorize with the dedicated role
Sign in to NetSuite as the user who has the dedicated role. The consent page opens as the role that user is signed in with, here Administrator, and says ChatGPT wants to access Larkspur Freight Co. and refuses: Your role does not support OAuth2 login, please select a different one. This is example text from the recording, and wording can vary by release. Administrator and other full-access roles can't authorize the AI Connector Service, so click Choose another role.
Under Change Role, click Choose Role beside AI Connector Accountant. The Administrator row shows Logging in... instead of a link.
The page now reads ChatGPT has access to Larkspur Freight Co. and As role AI Connector Accountant. Confirm the company and role, then click Continue. ChatGPT acts as that role and no more.
07. Check the connection in ChatGPT
ChatGPT returns to the connector and reports Larkspur NetSuite is now connected. Authorization used is OAuth, and Actions lists ns_createRecord, ns_updateRecord and ns_getRecord. Which tools you see depends on the endpoint you used, the installed SuiteApp version and the role, so your list may differ.
08. Find the integration record
Back in NetSuite, go to Setup > Integration > Manage Integrations. A ChatGPT row is listed, State Enabled, Created On 2026-09-28 10:42:00, matching the moment consent was given. That's where an administrator reviews or blocks this client later.
In this recording NetSuite created the record on its own, and the demo doesn't show the other case. Depending on the client and your NetSuite release, an administrator may have to create the integration record first. That means opening ChatGPT's OAuth settings for its callback URL, then creating or editing a record here with the callback URL and the authorization-code and AI Connector Service options, and then finishing authorization in ChatGPT. The record's name can also differ. Check this list either way.
Check the result
- The consent page reads As role with your dedicated role, not Administrator.
- ChatGPT shows the connector as connected, with OAuth under Authorization used and the MCP Standard Tools actions listed.
- Manage Integrations lists ChatGPT with State Enabled and a Created On time that matches the consent.
Nothing here proves the connection works on your data. Ask a read-only question whose answer you can check in NetSuite first. Review each write request ChatGPT proposes before you confirm it, and check the result in NetSuite. Try the whole thing in a sandbox first, because ChatGPT works on live records.
Common questions
Why does NetSuite say my role does not support OAuth2 login?
Because the role you're signed in with is Administrator or another role with full access, and NetSuite won't let those authorize the AI Connector Service. Click Choose another role on the consent page, pick your dedicated role, and then click Continue. If that role isn't in the list, it isn't assigned to the user.
Can I connect ChatGPT with the Administrator role?
No. You can be signed in as an administrator while you set things up, but the role you authorize with has to be a restricted custom role. Assign it to the employee who connects, and review what it can reach, because ChatGPT acts as that role.
Which permissions does the role need?
MCP Server Connection and Log in using OAuth 2.0 Access Tokens, each at Full. With the MCP Standard Tools SuiteApp, add REST Web Services at Full too. Those only open the connection. The role also needs the ordinary permissions for whatever ChatGPT should read or change, such as vendors or a report.
What MCP server URL do I use, and what's the difference between /all and the SuiteApp URL?
Both start with your account ID followed by the suitetalk.api.netsuite.com domain. The one ending in /services/mcp/v1/all exposes every custom tool in the account, and that's the one this walkthrough uses. The one ending in the standard tools' SuiteApp path limits the connector to the MCP Standard Tools. Sandbox account IDs include their suffix. Either way, the role's permissions still limit what a tool can do.
Why don't I see Create in ChatGPT?
The custom connector option depends on your ChatGPT plan, your workspace settings, and developer mode being on under the Apps & Connectors settings. The recording uses a simplified version of those screens, so your labels may differ. If you can't turn developer mode on, that's a ChatGPT plan or workspace question, not a NetSuite one.
Does connecting ChatGPT create an integration record, and what if it doesn't?
In this recording it did. NetSuite added an Enabled ChatGPT row to Manage Integrations when consent was given. That isn't guaranteed. Depending on ChatGPT's flow and your NetSuite release, an administrator may need to create the integration record with ChatGPT's callback URL before authorization completes, so look in Manage Integrations either way.