Yes, Klaviyo has an API. Server-side /api endpoints use a private API key sent in an Authorization header, or OAuth, and client-side /client endpoints use a public key, which is your 6-character company ID. Every account is rate limited with burst and steady windows, and you'll get an HTTP 429 when you hit either one.
Which key does your project need?
The first decision with the Klaviyo API isn't which endpoint to call. It's which of the three ways to authenticate fits what you're building.
| Method | Used for | Where |
|---|---|---|
| Private API key | Server-side /api endpoints | Authorization: Klaviyo-API-Key your-private-api-key header |
| OAuth | Server-side APIs, recommended for tech partners | OAuth flow |
| Public API key (company ID) | Client-side /client endpoints | company_id query parameter |
If you're connecting your own shop or back office, a private key is the usual choice. If you build an app that other Klaviyo customers will connect, Klaviyo recommends OAuth, citing better security, usability and improved rate limits.
Private keys and their scopes
All /api endpoints use private API keys, and each key carries a scope: Read-only, Full (the default) or Custom. Pick the narrowest one that does the job. A reporting script only needs Read-only, so there's no reason to hand it Full.
If the key is wrong or missing, Klaviyo returns a 400 error, which is the first thing to check when a new integration fails straight away.
Public keys and client-side calls
The /client endpoints are built for publicly browsable places, such as your website's code. They use the public API key, which is simply your 6-character company ID (also called the site ID), passed as a company_id query parameter.
Because that ID is visible to anyone, client endpoints are limited to creating specific types of object, and they don't return sensitive data. Anything you need to read has to go through private key endpoints on your server.
Keys can't be edited once they're made
Klaviyo Developers documentation spells out the part that trips people up. You can't add a scope to an existing private key, or edit a private key at all after it's created. If a key has the wrong scope, you delete it and create a new one, then update every system that used the old one. And since the public key is just your company ID, client endpoints are write-only for specific objects and can't read profile data.
So write down where each key is used before you create it. It makes a replacement a ten-minute job rather than an afternoon of hunting.
Rate limits and the 429
All new API endpoints are rate limited per account, using a fixed-window approach with a burst (short) window and a steady (long) window. Hit either and you get an HTTP 429. The numbers aren't the same for every endpoint: each one lists its own burst and steady limits in the API reference, so check the specific endpoints your integration uses.
Working with the data
The APIs follow JSON:API conventions, so you get relationships, filtering with ?filter, sorting with ?sort (a - prefix reverses the order), sparse fieldsets, pagination and datetime formatting. For tools, Klaviyo offers SDKs, an OpenAPI spec and a Postman collection, and it publishes an API versioning and deprecation policy so you know when older versions will retire. If you're deciding between polling the API and listening for events, my explainer on APIs versus webhooks helps.
How two other email platforms open up
Mailchimp has a Marketing API on version 3.0, and its documented example authenticates with an Authorization: Bearer token header.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Brevo offers an interactive quickstart and SDKs for Node.js, Python and PHP, covering email, SMS and WhatsApp, contacts, custom events and eCommerce data.
For a fuller comparison, see my Klaviyo versus Mailchimp breakdown.
My verdict on the Klaviyo API
Yes, it has a full API, and it's well organised. Use a private key with the narrowest scope on your server, keep the public company ID for website code only, and check each endpoint's own limits before you schedule big syncs. If you're still deciding whether the platform fits, my full Klaviyo review is the place to start.
Want your tool on this list? Featured spots and reviews here are paid partnerships. Here's how to partner with me.
Frequently asked questions
How do I authenticate with the Klaviyo API?
Send your private key in the header Authorization: Klaviyo-API-Key your-private-api-key for /api endpoints.
What is the Klaviyo public API key?
It's your 6-character company ID, used for /client endpoints through a company_id query parameter.
Is the Klaviyo API rate limited?
Yes, per account, with burst and steady windows, and an HTTP 429 when either is reached.
Can I restrict what an API key can do?
Yes. Choose Read-only, Full or Custom scopes when you create the key.
Does Klaviyo have SDKs?
Yes. Klaviyo offers SDKs, an OpenAPI spec and a Postman collection.
