Uses OAuth 2.0 with PKCE — your credentials stay with NetSuite