Display NetSuite KPIs on TV Without Extra Licenses

Every wall-mounted dashboard in your warehouse or conference room burns a full NetSuite seat if you log in as a named user. Ten displays means ten licenses, thousands of dollars annually for screens that only show read-only metrics. Token-based authentication removes that cost entirely by letting a service account pull data without consuming a user license.

The License Trap Most Teams Fall Into

The typical approach: create a "dashboard user" role, assign it to a generic email, and log in on each Firestick via the Silk browser. NetSuite counts each concurrent session against your license pool. Hit the limit and someone gets kicked off, usually the controller trying to close the month.

Token-based authentication (TBA) sidesteps this. The Firestick authenticates as an integration, not a person. No session counts toward your named-user cap. You can run twenty displays on one token set.

The permission that actually trips people up is Access Token Management, without it, the integration role cannot generate or use tokens even if TBA is enabled.

Enable Token-Based Authentication in NetSuite

Start in the NetSuite UI, not the Firestick.

1. Setup > Company > Setup Tasks > Enable Features
2. Click the SuiteCloud subtab
3. In the Manage Authentication section, check Token-Based Authentication
4. Save, this activates the TBA infrastructure across the account

Important: As of the 2027.1 release, no new integrations using TBA can be created for SOAP web services, REST web services, and RESTlets. Existing integrations will continue working. For new development, use OAuth 2.0 instead.

Next, create the integration record that will hold your consumer credentials:

1. Setup > Integration > Manage Integrations > New
2. Name: TV Dashboard Service (or similar)
3. State: Enabled
4. Leave Token-Based Authentication checked
5. Save, NetSuite generates a Consumer Key and Consumer Secret. Copy both immediately; the secret never displays again.

Build the Service Role and Token

The integration needs a role with read-only access to the dashboards and saved searches you want to display.

1. Setup > Users/Roles > Manage Roles > New
2. Name: TV Dashboard Viewer
3. Permissions > Reports, add:

• SuiteAnalytics Workbook, View
• Saved Search, View
• KPI Scorecard, View

4. Permissions > Setup, add:

• Access Token Management, Full (required for TBA)

5. Save the role.

Now generate the token pair tied to that role:

1. Setup > Users/Roles > Access Tokens > New
2. Application Name: TV Dashboard Service
3. User: select the dedicated service user (create one if needed, e.g., [email protected])
4. Role: TV Dashboard Viewer
5. Save, NetSuite returns Token ID and Token Secret. Copy both.

You now have four secrets: Consumer Key, Consumer Secret, Token ID, Token Secret. Store them in a password manager, they are the only credentials the Firestick needs.

Construct the Dashboard URL for Kiosk Mode

NetSuite SuiteAnalytics workbooks and saved searches render cleanly when you strip the navigation chrome. The embed=T parameter works for this purpose, though it's not officially documented for all content types.

Replace <account> with your account ID (lowercase, no underscores). Find workbook IDs in the URL when editing the workbook; saved search IDs appear in Saved Searches > List.

If the dashboard requires a specific subsidiary or date range, append &subsidiary=<id>&fromdate=01/01/2024&todate=12/31/2024, the same parameters the UI honors.

Configure the Firestick for Unattended Display

You don't need a custom app. The Silk browser in kiosk mode works reliably.

1. On the Firestick: Settings > Applications > Manage Installed Applications > Silk Browser > Clear Data (starts clean)
2. Settings > Device > Developer Options, enable Apps from Unknown Sources and USB Debugging (needed for ADB kiosk launch)
3. Install Fully Kiosk Browser from the Amazon Appstore, it handles auto-reload, screen-off scheduling, and remote config better than Silk
4. In Fully Kiosk: Settings > Web Content > Start URL, paste your workbook URL with embed=T
5. Settings > Device Management > Keep Screen On, enable
6. Settings > Web Auto Reload, set to 300 seconds (5 minutes) for near-real-time KPI refresh

The browser authenticates via OAuth 1.0a headers built from your four secrets. Fully Kiosk supports custom headers, add Authorization with the OAuth signature. If you prefer zero-code, host a tiny proxy (Cloudflare Worker, AWS Lambda, or a $5/month VPS) that injects the OAuth header and serves the dashboard over HTTPS. The Firestick then hits your proxy URL instead of NetSuite directly.

Proxy Example: Cloudflare Worker (Optional but Clean)

export default {
  async fetch(request, env) {
    const url = new URL(request.url);
    const target = `https://${env.NETSUITE_ACCOUNT}.app.netsuite.com${url.pathname}${url.search}`;
    
    const oauth = generateOAuthHeader(
      'GET',
      target,
      env.CONSUMER_KEY,
      env.CONSUMER_SECRET,
      env.TOKEN_ID,
      env.TOKEN_SECRET
    );
    
    const response = await fetch(target, {
      headers: { 'Authorization': oauth, 'Accept': 'text/html' }
    });
    
    return new Response(response.body, {
      headers: { 'Content-Type': 'text/html', 'Cache-Control': 'no-store' }
    });
  }
};

function generateOAuthHeader(method, url, ck, cs, tk, ts) {
  const nonce = crypto.randomUUID().replace(/-/g, '');
  const timestamp = Math.floor(Date.now() / 1000);
  const params = new URLSearchParams({
    oauth_consumer_key: ck,
    oauth_nonce: nonce,
    oauth_signature_method: 'HMAC-SHA256',
    oauth_timestamp: timestamp,
    oauth_token: tk,
    oauth_version: '1.0'
  });
  const base = `${method}&${encodeURIComponent(url)}&${encodeURIComponent(params.toString())}`;
  const key = `${encodeURIComponent(cs)}&${encodeURIComponent(ts)}`;
  const signature = await crypto.subtle.sign('HMAC', 
    await crypto.subtle.importKey('raw', new TextEncoder().encode(key), {name:'HMAC', hash:'SHA-256'}, false, ['sign']),
    new TextEncoder().encode(base)
  );
  const sigB64 = btoa(String.fromCharCode(...new Uint8Array(signature)));
  params.append('oauth_signature', sigB64);
  return 'OAuth ' + Array.from(params.entries()).map(([k,v])=>`${k}="${encodeURIComponent(v)}"`).join(',');
}

Deploy this worker, bind the four secrets as environment variables, and point the Firestick to https://your-worker.workers.dev/app/analytics/workbook/run.nl?wb=123&embed=T. Zero credentials on the device.

Handle Session Expiry and Token Rotation

TBA tokens don't expire by default, but your security policy may rotate them quarterly. Build a rotation reminder:

1. Create a Saved Search > Employee filtered to the service user
2. Add Formula (Text) column: CASE WHEN {lastlogindate} < TRUNC(SYSDATE) - 90 THEN 'ROTATE TOKEN' ELSE 'OK' END
3. Schedule email to the NetSuite admin weekly

When rotating: generate a new token pair in Access Tokens, update the proxy environment variables, and revoke the old token. No Firestick touch required.

What Breaks in Practice

• Subsidiary restrictions: If the service user lacks subsidiary access, the workbook renders blank. Grant Subsidiary permission on the role or set the user's Subsidiary Access to All.
• Two-factor authentication: TBA bypasses 2FA, the token is the second factor. Ensure your security team understands this isn't a gap.
• Concurrent request limits: NetSuite enforces governance limits on TBA calls. Ten TVs refreshing every 5 minutes stays well within typical account thresholds.
• Firestick sleep: Disable Settings > Display & Sounds > Display Sleep or the screen goes black and the browser unloads.

Scale Beyond the Conference Room

The same token set drives lobby displays, warehouse pick-pack boards, and executive office screens. Each location adds a Firestick ($40) and a TV, no NetSuite license increment. For interactive needs (drill-through, parameter changes), swap Fully Kiosk for a lightweight React app hosted on the same proxy, but 90% of KPI walls are read-only.

Next time finance asks why the license count jumped, check the Setup > Company > License Information page. If "TV Dashboard Viewer" sessions appear, you're still logging in as a user. Switch to TBA and reclaim those seats.