title: How do I connect to Oracle Netsuite using OAuth 2.0 Client Credentials Flow and JWT certificate with .net core
body: <p>I am trying to use the Netsuite Rest api. Below are the steps I took.
  <a href="https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_162730264820.html" rel="nofollow noreferrer">https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_162730264820.html</a></p>
  <ol>
  <li><p>Created a Integration Record in Netsuite</p>
  </li>
  <li><p>Create a self signed cert:</p>
  <pre><code>openssl req -x509 -newkey rsa:4096 -sha256 -keyout auth-key.pem -out auth-cert.pem -nodes -days 730
  </code></pre>
  </li>
  <li><p>Added the <code>auth-cert.pem</code> to the integration in Netsuite</p>
  </li>
  <li><p>Tried calling the TokenUrl endpoint to get access token</p>
  </li>
  </ol>
  <p>I keep getting Bad Request (Status code 400) when I call <code>GetNetsuiteJwtAccessToken(string signedJWTAssertion)</code> to get access token from TokenUrl.</p>
  <pre><code>static void Main(string[] args)
      //static string Scope = &quot;rest_webservices&quot;; 
      //static string Aud = &quot;https://&lt;Tenant&gt;-sb1.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token&quot;;
      //static string TokenUrl = &quot;https://&lt;Tenant&gt;-sb1.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token&quot;;
  //static string TenantName = &quot;&lt;Tenant&gt;&quot;;
  
      //static string ClientId = &quot;&lt;ClientId&gt;&quot;;
      //static string Issuer = ClientId;
      //static string ClientSecret = &quot;&lt;Client Secret&gt;&quot;;
      //static string AppId = &quot;&lt;AppId&gt;&quot;;
      //static string Kid = &quot;&lt;Key from the Netsuite for the uploaded Cert&quot;&gt;;
  {
        var jwt= GenerateNetsuiteJWTFromPEMFile(&quot;auth-key.pem&quot;);
        var accessToken = GetNetsuiteJwtAccessToken(signedJWTAssertion: jwt);
                 
  }
  
  public static string GenerateNetsuiteJWTFromPEMFile(string PEMFile)
  {
              var tokenHandler = new JwtSecurityTokenHandler();
  
              var rsaPem = File.ReadAllText(PEMFile);
  
              var privatekey = RSA.Create();
              privatekey.ImportFromPem(rsaPem);
  
              var key = new RsaSecurityKey(privatekey);
              //key.KeyId = Kid;
  
              var signingCredentials = new SigningCredentials(
                  key: key,
                  algorithm: SecurityAlgorithms.RsaSha256 
              );
              //signingCredentials.Key.KeyId = Kid;
  
  
              var Now = DateTimeOffset.UtcNow;
              var Exp = Now.AddMinutes(30).ToUnixTimeSeconds();
              var Iat = Now.ToUnixTimeSeconds();
  
              var jwt = new SecurityTokenDescriptor
              {
                  Issuer = Issuer,
                  Claims = new Dictionary&lt;string, object&gt;()
                  {
                      [&quot;iss&quot;] = Issuer,
                      [&quot;scope&quot;] = Scope,
                      [&quot;aud&quot;] = Aud,
                      [&quot;exp&quot;] = Exp,
                      [&quot;iat&quot;] = Iat                
                  },
  
                  SigningCredentials = signingCredentials
  
              };
              var jws = tokenHandler.CreateToken(jwt);
              var encoded = new JwtSecurityTokenHandler().WriteToken(jws);
              return encoded;
          }
  
   public static string GetNetsuiteJwtAccessToken(string signedJWTAssertion)
          {
              string accessToken;
  
                HttpClient _httpClient = new HttpClient();
  
              _httpClient.DefaultRequestHeaders.Clear();
  
              var requestParams = new List&lt;KeyValuePair&lt;string, string&gt;&gt;
              {
                  new KeyValuePair&lt;string, string&gt;(&quot;grant_type&quot;, &quot;client_credentials&quot;),
                  new KeyValuePair&lt;string, string&gt;(&quot;client_assertion_type&quot;, &quot;urn:ietf:params:oauth:client-assertion-type:jwt-bearer&quot;),
                  new KeyValuePair&lt;string, string&gt;(&quot;assertion&quot;, signedJWTAssertion)
              };
  
              using (var content = new FormUrlEncodedContent(requestParams))
              {
                  var response = _httpClient.PostAsync(TokenUrl, content).Result;
                  var responseContent = response.Content.ReadAsStringAsync().Result;
                  accessToken = responseContent;
              }
  
              return accessToken;
          }
  </code></pre>