The quick answer
Run ssh-keygen -t rsa -m PEM in Terminal to create a key pair. Send the public key, the .pub file, to your bank. Upload the private key in NetSuite under Setup > Company > Keys with Create New, then pick it in Digital Certificate or Private Key Id on the bank's SFTP format profile. NetSuite adds a custkey prefix to the ID you type, so _crescent_federal is saved as custkey_crescent_federal. The private key never goes to the bank.
The screenshots show sample data. Person, company, and bank names are fictional. Use your own records and values when following the steps.
Before you start
An SSH key pair has two halves. The private key stays with you and goes into NetSuite. The public key goes to the bank, which registers it for your SFTP user. Sending the private key to the bank is the one real mistake here, so keep the two files straight from the start.
This example is for a bank statement connection that uses Auto Bank Statement Import. Your bank gives you the SFTP details: the URL, username, host key, host key type, and port. It may also require a specific algorithm or key size. Follow the bank if it does. The command in this guide makes a default RSA key, and a bank that asks for 4096 bits needs an extra option, for example ssh-keygen -t rsa -b 4096 -m PEM -f ~/.ssh/bankname_private.
NetSuite only accepts a private key in PEM format, which is why the command includes -m PEM. The newer OpenSSH key format that ssh-keygen writes by default is not accepted. This guide uses Terminal on a Mac. The tool and steps differ on Windows. The Keys page needs Server SuiteScript turned on and a role that can manage keys, such as Administrator. A script or integration that uses the key later may need its own key access permission, so check the role it runs under. Menu paths are the ones in this account. If a page isn't where it says, search for its name in global search.
01. Generate the key pair in Terminal
Open Terminal and run ssh-keygen -t rsa -m PEM. If an id_rsa file already exists in that folder, ssh-keygen asks before overwriting it. Say no, and use the -f option to write the new key to a different file name, or you'll destroy a key something else may depend on. Otherwise press Return to accept the default file location, then press Return twice to leave the passphrase empty. If you set a passphrase instead, you'll need it in step 5. When it finishes, ssh-keygen reports that the private key was saved as id_rsa and the public key as id_rsa.pub in the .ssh folder of your home directory. It also prints a key fingerprint and a small picture. You don't need either one for this setup.
02. Rename the private key and send the public key
List the folder with ls ~/.ssh. It holds id_rsa and id_rsa.pub. Rename the private key after its purpose so you pick the right file later: mv ~/.ssh/id_rsa ~/.ssh/crescentfederal_private. NetSuite doesn't care about the file name, because the contents decide the format. Listing the folder again shows crescentfederal_private and id_rsa.pub.
id_rsa.pub is a single ssh-rsa line, and it's the file you send to the bank. crescentfederal_private stays with you. This guide doesn't show the contents of either file on purpose.
03. Open Setup > Company > Keys
In NetSuite, go to Setup > Company > Keys. Private Keys lists your uploaded keys with Name, Description, ID, and Locked. In this account the list is empty. Click Create New.
04. Enter the key details
New Private Key opens with three tabs: Details, Files, and Audience. On Details, enter a Name, here Crescent Federal Private, and an ID, here _crescent_federal. Add a Description so the list explains itself later, here "SFTP key for Crescent Federal Bank statement import".
Pick the ID carefully. Integrations and scripts refer to the key by its ID, and the demonstration doesn't show whether it can be changed after you save.
05. Attach the private key file
Click the Files tab. Click Choose a file and select the renamed private key, crescentfederal_private. The field then shows File Attached with a check mark. Leave Password blank, because this key has no passphrase. If you set one in step 1, enter it here. That Password is the key's passphrase. It isn't the SFTP server password.
The Audience tab can restrict the key to employees or scripts. This walkthrough doesn't change it. If a script or integration can't see the key later, check that tab.
06. Save and check the key ID
Click Save. A banner confirms that the new private key was created, and the list shows the key. Look at the ID. NetSuite added the custkey prefix, so the ID you typed as _crescent_federal is now custkey_crescent_federal. That's the value you pick in the next step.
07. Select the key on the format profile
Go to Setup > Accounting > Financial Institution and click Edit next to the bank, here Crescent Federal Bank. On the Format Profile: Configuration subtab, click Edit on the profile that uses SFTP Connectivity, here Crescent Federal BAI2.
Open the Connectivity Configuration subtab. Digital Certificate or Private Key Id now offers custkey_crescent_federal. Select it. The URL, username, host key, host key type, and port come from the bank, and depending on the bank the profile may also need a download directory, a filename pattern, or an SFTP password. That password is separate from the key's passphrase. The host key is the bank server's key. It isn't the public key you generated. After you fill in the connection, click Submit, then continue with Account Linking, as the page's information box says. Linking each bank account to a GL account is its own step and isn't covered here.
Check the result
- Private Keys lists Crescent Federal Private with ID custkey_crescent_federal.
- Digital Certificate or Private Key Id on the format profile shows custkey_crescent_federal.
- Only the public key file, id_rsa.pub, went to the bank.
This walkthrough stops at selecting the key. It doesn't fill in the bank's connection details or submit the configuration, so it doesn't prove the bank accepts the connection. That depends on the bank registering your public key and on the details it gave you.
Common questions
Which key do I send to the bank?
The public key, id_rsa.pub. The bank registers it for your SFTP user. The private key, crescentfederal_private here, goes only into NetSuite. Don't email it or hand it to the bank.
Why does the command include -m PEM?
NetSuite's Private Keys page needs the private key in PEM format. Newer versions of ssh-keygen write the OpenSSH format by default, and NetSuite can reject that file when you upload it. The -m PEM option makes the older format.
What is the Password field on the key page?
It's the passphrase that protects the private key file. It isn't the SFTP password for the bank. This key was made with an empty passphrase, so the field stays blank.
Why does the saved ID start with custkey?
NetSuite adds the custkey prefix to private key IDs when it saves them, so _crescent_federal became custkey_crescent_federal. That saved ID is the one you pick on the format profile and the one a script would use.
Is the host key my public key?
No. Your public key tells the bank who you are. The host key identifies the bank's server to NetSuite, and the bank provides it. Check it with the bank rather than trusting whatever a scan returns.
Can a script use the same uploaded key?
It can. A SuiteScript that connects over SFTP can refer to the key by its saved ID, provided the key's Audience settings and the script's role allow it. This walkthrough only uploads the key and selects it on the format profile. It doesn't enter the bank's URL, host key, or port, and it doesn't test the connection.