| name | klaviyo-security-basics |
| description | Apply Klaviyo security best practices for API key management and access control.
Use when securing API keys, configuring OAuth scopes, implementing webhook
signature verification, or auditing Klaviyo security configuration.
Trigger with phrases like "klaviyo security", "klaviyo secrets",
"secure klaviyo", "klaviyo API key security", "klaviyo OAuth".
|
| allowed-tools | Read, Write, Edit, Grep |
| version | 1.7.0 |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["saas","klaviyo","email-marketing","cdp"] |
| compatibility | Designed for Claude Code |
Klaviyo Security Basics
Overview
Security best practices for Klaviyo: API key types, OAuth scopes, webhook HMAC-SHA256 signature verification, and secret rotation procedures.
Prerequisites
- Klaviyo account with API key access
- Understanding of environment variables and secret management
- Access to Klaviyo dashboard (Settings > API Keys)
Instructions
Step 1: Understand Key Types
| Key Type | Format | Use Case | Sensitivity |
|---|
| Private API Key | pk_* (40+ chars) | Server-side REST API | CRITICAL -- never expose client-side |
| Public API Key | 6 alphanumeric chars | Client-side Track/Identify only | Low -- safe in browser JS |
Private keys authenticate via Authorization: Klaviyo-API-Key pk_*** header. Public keys pass as company_id query parameter.
Step 2: Store Keys in Environment Variables
Keep every private key and the webhook signing secret out of source: load them
from .env (git-ignored) through a validated config loader that throws on a
missing secret, so misconfiguration fails at boot instead of at first API call.
export const klaviyoConfig = {
privateKey: requireEnv('KLAVIYO_PRIVATE_KEY'),
publicKey: process.env.KLAVIYO_PUBLIC_KEY || '',
webhookSecret: process.env.KLAVIYO_WEBHOOK_SIGNING_SECRET || '',
};
Full .env template, .gitignore entries, and the requireEnv helper:
implementation.md → Environment Variable Configuration.
