Apps requesting more scopes than necessary will be rejected from the App Marketplace. [2]
Guides · email · Popular APIs
Klaviyo API (private API key or OAuth app)
Create a scoped private API key for your own account, or an OAuth app (PKCE required) for other Klaviyo accounts; App Marketplace listing needs OAuth, least-privilege scopes, 5 active installs and review.
Researched · not yet run liveLast researched 25 October 2026 · Klaviyo · provider site
Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Who owns what
Keys and OAuth apps belong to a Klaviyo account.
- Klaviyo account organisationOwner, Admin or Manager role needed for private keys and OAuth apps.
Steps
Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.
Create a private API key
Settings > API keys > Create Private API Key; choose Custom (pick scopes), Read-Only or Full Access. Scopes can't be changed later.
verapli captures
KLAVIYO_PRIVATE_API_KEYhere by plain code: encrypted in your browser, never shown to AI.Where: https://www.klaviyo.com/settings
Create an OAuth app (other accounts)optional
On the Manage apps page create the app, add exact redirect URIs and scopes, and copy the client ID and secret. Use PKCE (S256) for every authorisation.
verapli captures
KLAVIYO_CLIENT_SECREThere by plain code: encrypted in your browser, never shown to AI.If something goes wrong (1)
- Refresh returns 400 invalid_grant: Treat as uninstall; refresh tokens are revoked after 90 days unused or on uninstall. [2]
Where: https://www.klaviyo.com/
Submit for App Marketplace reviewoptional
With 5 active installs and least-privilege scopes, complete all sections, click Review submission, then Submit; watch for email from app.marketplace@klaviyo.com.
Terms and gotchas
Plain-English summary, not legal advice. Each card links its source.
Until reviewed, users see an OAuth warning that the app hasn't been reviewed. [3]
What you end up with
| Env var | Secret | Format | What it is |
|---|---|---|---|
KLAVIYO_PRIVATE_API_KEY | secret | pk_… | Private API key |
KLAVIYO_PUBLIC_KEY | not secret | 6 characters | Public key / site ID (6 characters, safe for client-side) |
KLAVIYO_CLIENT_ID | not secret | opaque id string | OAuth client ID |
KLAVIYO_CLIENT_SECRET | secret | opaque secret string | OAuth client secret |
For agents
The same entry as JSON: /api/v1/entries/klaviyo/api · requirements /api/v1/requirements/klaviyo/api · terms /api/v1/terms/klaviyo/api.
Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp
> "What do I need for Klaviyo API (private API key or OAuth app), and how long will it take?"
→ tools/call requirements { "provider_id": "klaviyo/api" }Sources
- Authenticate API requests Settings > API keys > Create Private API Key (Owner, Admin or Manager role); Custom, Read-Only or Full Access; scopes can't be edited later; pk_ prefix; Klaviyo-API-Key header; public key is the 6-character site ID; OAuth required for App Marketplace. · accessed 25 October 2026 · official
- Make API calls using OAuth Owner/admin/manager create OAuth apps; Manage apps page for client ID/secret, redirect URIs and scopes; PKCE required for all clients; refresh token revoked after 90 days unused; access tokens about 1 hour; Marketplace needs OAuth, least-permissive scopes, 5 active installs. · accessed 25 October 2026 · official
- Submit your app for review Review submission > Submit; not all apps approved; email from app.marketplace@klaviyo.com; statuses; unreviewed apps show an OAuth warning but can be installed; updates need re-review; no timeline. · accessed 25 October 2026 · official
Provider rules change. This page is generated from verapli registry version 2026.1025.316; spotted something out of date? Tell us. Klaviyo is not affiliated with verapli.