| name | klaviyo-webhooks-events |
| description | Implement Klaviyo webhooks with HMAC-SHA256 signature verification and event handling.
Use when setting up webhook endpoints, handling Klaviyo event notifications,
or creating event-driven integrations with Klaviyo.
Trigger with phrases like "klaviyo webhook", "klaviyo events",
"klaviyo webhook signature", "handle klaviyo events", "klaviyo notifications".
|
| allowed-tools | Read, Write, Edit, Bash(curl:*), Bash(npm:*) |
| version | 1.7.0 |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["saas","klaviyo","email-marketing","cdp"] |
| compatibility | Designed for Claude Code |
Klaviyo Webhooks & Events
Overview
Set up Klaviyo webhooks with HMAC-SHA256 signature verification, event routing, idempotency handling, and the Webhooks API for programmatic subscription management.
This skill covers the full endpoint lifecycle in six steps: create a webhook subscription via the API, verify each request's signature, receive events in an Express handler, route them to per-topic handlers, deduplicate with Redis, and manage subscriptions. The high-level flow and the security-critical signature check live here; the complete step-by-step source is in references/implementation.md and worked scenarios are in references/examples.md.
Prerequisites
- Klaviyo account with webhooks enabled
- HTTPS endpoint accessible from internet
- API key with scopes:
webhooks:read, webhooks:write
- Redis or database for idempotency (recommended)
Klaviyo Webhook Architecture
Klaviyo webhooks fire when specific topics occur in your account. Each webhook is signed with a secret key using HMAC-SHA256, sent in the webhook-signature header.
| Topic Category | Example Topics |
|---|
| Profile | profile.created, profile.updated, profile.deleted |
| List | list.member.added, list.member.removed |
| Segment | segment.member.added, segment.member.removed |
| Campaign | campaign.sent, campaign.delivered |
| Flow | flow.triggered, flow.message.sent |
| Event | Custom metric events |
Instructions
Follow these six steps in order. Each is fully sourced in references/implementation.md; the security-critical signature check is inlined below because getting it wrong is the most common failure.
- Create a webhook subscription — call
webhooksApi.createWebhook with the target endpointUrl and , then save the signing secret from the response as .
