klaviyo-enterprise-rbac

name	klaviyo-enterprise-rbac
description	Configure Klaviyo enterprise access control with API key scopes and OAuth. Use when implementing per-key scoping, configuring OAuth app authorization, or setting up organization-level access controls for Klaviyo. Trigger with phrases like "klaviyo scopes", "klaviyo RBAC", "klaviyo enterprise", "klaviyo permissions", "klaviyo OAuth", "klaviyo access control".
allowed-tools	Read, Write
version	1.7.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","klaviyo","email-marketing","cdp"]
compatibility	Designed for Claude Code

Klaviyo Enterprise RBAC

Overview

Enterprise access control for Klaviyo: API key scoping with granular read/write permissions, OAuth app authorization flows, and application-level RBAC built on top of Klaviyo's scope system. Klaviyo has no built-in roles, so you compose least-privilege access from scoped keys plus an application permission layer.

Prerequisites

• Klaviyo account with API key management access
• Understanding of OAuth 2.0 (for OAuth apps)
• Application requiring per-user or per-role Klaviyo access

Klaviyo Access Control Model

Klaviyo uses scoped API keys and OAuth for access control. There are no built-in "roles" in Klaviyo's API -- you implement RBAC by creating multiple API keys with different scopes.

API Key Scopes

Scope	Read	Write	What It Controls
accounts	Account info	N/A	Organization name, timezone
campaigns	List campaigns	Create/send campaigns	Email, SMS, push campaigns
catalogs	Browse items	CRUD catalog items	Product catalog management
coupons	List coupons	Create coupons	Coupon/discount codes
data-privacy	N/A	Delete profiles	GDPR/CCPA deletion requests
events	Query events	Track events	Server-side event tracking
flows	List flows	Create/update flows	Flow automation
images	List images	Upload images	Email template images
lists	List lists	CRUD lists/members	List management
metrics	Query metrics	N/A	Metric aggregations
profiles	Read profiles