How to protect your Klaviyo account

A compromised Klaviyo login or exposed private API key can let someone view your customer data, send messages, or change your account settings. Here's a checklist straight from the Klaviyo security team for locking both down, including MFA, trusted devices, API key hygiene, user access, a monthly self-audit, and what to do if you suspect a takeover.

What you'll learn

• How to enable multi-factor authentication (MFA) for every user
• When to use trusted-device verification, and when not to
• How to protect private API keys and limit their permissions
• How to give every person their own login and the minimum role they need
• How to spot common signs of an account takeover (ATO)
• How to contact Klaviyo Support safely if something looks wrong

Why it matters

Your Klaviyo account can contain customer data, messaging content, integrations, profiles, lists, segments, flows, and account settings. A compromised login or private API key may allow an unauthorized person to view or change account data, send messages, export information, or alter your configuration.

Security works best as a layered approach. MFA helps protect the login, trusted-device verification adds a check when a new device is used, roles limit what each user can do, and private API key controls help protect server-to-server connections.

What you'll need:

• Access to your Klaviyo account
• An authenticator app or a supported mobile number for MFA
• An Owner or Admin who can manage users and account settings
• A secure password manager or vault for storing backup codes and private API keys
• A short list of the applications, agencies, and vendors that connect to your Klaviyo account

Step 1: How do you enable MFA for every user?

MFA adds an additional verification step after a user enters their username and password. It helps reduce the risk from stolen passwords, phishing, and other login attacks.

Set up MFA for your own user

1. Click your organization or account name in the bottom-left corner of Klaviyo.
2. Select Settings.
3. Open Security.
4. In MFA Methods, select Add method.
5. Choose an authenticator app or SMS, then follow the on-screen instructions.
6. If you use an authenticator app, save the backup codes in a secure location such as an encrypted password manager or vault. Backup codes are single-use and are not a backup method for SMS MFA.

For the full setup walkthrough, see How to set up multi-factor authentication (MFA). If you have questions about how MFA behaves in different scenarios, check the Multi-factor authentication (MFA) FAQs.

Require MFA for the organization

If you are an Owner or Admin, review the user-management and security settings for an organization-wide control. Depending on your account surface and plan, the control may appear under Settings > Users as Require two-step authentication for all users in your organization, or within the account's Security settings.

Paid accounts must have MFA configured or another security measure, such as required SSO. Free-account Owners can require MFA for all users. Because UI labels and availability can change, use the How to set up multi-factor authentication (MFA) article to validate this step before publication.

Step 2: When should you use trusted devices?

Trusted-device verification and MFA are related but different controls:

• A trusted-device code is normally sent by email the first time you sign in from a device that has not been trusted. It is generally a one-time check for that device.
• An MFA code is provided by SMS or an authenticator app and is used as part of the MFA login process.

See How to add trusted devices for the full setup flow.

When logging in from a new device:

1. Sign in to Klaviyo directly, rather than through a link in an unexpected email.
2. Check the inbox associated with your Klaviyo login.
3. Enter the verification code. The code expires after two hours.
4. Select Don't ask again for this device only if the device is private, secure, and under your control.

Do not mark a public, shared, borrowed, or otherwise unmanaged computer as trusted.

If you receive a new-device verification email but did not try to log in, treat it as a warning sign. Change your Klaviyo password immediately and review your account for other unfamiliar activity.

Using incognito mode or a VPN may cause Klaviyo to ask you to verify the device again. That repeated prompt alone does not prove an account takeover, but an unexpected prompt or login alert should never be ignored.

Step 3: How do you protect private API keys?

A private API key is a credential used by an application or server to authenticate API requests to Klaviyo. Depending on its scopes, it can read data or make changes to sensitive account objects. Treat a private API key like a password.

Create keys with the smallest useful scope

If you are an Owner or Admin and need to create a key:

1. Click your organization name in the bottom-left corner.
2. Select Settings > API keys.
3. Select Create Private API Key.
4. Give the key a meaningful name that identifies the integration or use case.
5. Choose Read-only, Full, or Custom access as appropriate.
6. Select only the endpoint scopes the application needs.
7. Copy or download the key immediately and store it in a secure vault or password manager.

Klaviyo does not show the full private key again after creation. Existing keys cannot have their scopes edited; if the required access changes, create a new key with the correct scopes and remove the old one when it is no longer needed. Full walkthrough: How to create or clone a private API key.

Keep private keys out of public places

Never paste a private API key into:

• Website or browser-side code
• Public repositories or public documents
• Screenshots, support tickets, chat messages, or social posts
• Shared notes or unprotected spreadsheets

Use a public API key or Site ID only where Klaviyo's client-side documentation says it is appropriate. Do not substitute a private key into client-side code. For the difference between public and private keys and how to find both, see How to manage your account's API keys.

Rotate keys safely

For planned rotation, use Klaviyo's clone workflow when it is available:

1. Open Settings > API keys.
2. Use the three-dot menu next to the existing key.
3. Select Clone.
4. Securely copy the newly generated key.
5. Update the application or integration that uses the key.
6. Test the integration.
7. Delete the old key after confirming that it is no longer required.

(Full steps in How to create or clone a private API key.)

If a private key may have been exposed, do not wait for a scheduled rotation. Create a replacement, update every integration that used the exposed key, and deactivate or delete the exposed key as soon as it is safe to do so.

Step 4: How do you give every person their own login?

Do not share one Klaviyo login between teammates, agencies, contractors, or departments. Each person should use their own email address and password.

Individual logins provide three important security benefits:

• Accountability: You can associate actions with a specific user.
• Safer offboarding: You can remove one person's access without changing a shared password.
• Better incident response: An unfamiliar user or action is easier to investigate than activity under a generic login.

To review access:

1. Click your organization name in the bottom-left corner.
2. Select Settings > Users.
3. Review every user, email address, and role.
4. Remove people who no longer need access, including former employees, expired contractors, and vendors whose work has ended.
5. Review whether each remaining user has the minimum permissions needed for their responsibilities.

Klaviyo provides different roles and permissions for different types of work — see the User management and privileges reference for what each role can and can't do, and How to add or delete users and manage permissions for the step-by-step flow. Use the least-privilege principle: do not give Owner or Admin access when a more limited role is sufficient. Owners and Admins should review users and permissions regularly, especially after staffing changes or agency transitions.

Step 5: What should you check in a monthly security checkup?

A short review each month, and whenever a teammate or vendor leaves, can identify many problems early.

Check users and roles

In Settings > Users, look for:

• Users you do not recognize
• Former employees, agencies, or contractors who still have access
• Unexpected role changes
• Shared or generic logins
• Users with more access than their role requires

Check private API keys

In Settings > API keys, look for:

• Keys with unfamiliar names
• Keys belonging to an integration that has been retired
• Broad-access keys where a read-only or custom scope would be enough
• Keys that may have been copied into an insecure location

Do not delete a key until you know which application uses it. If a key is unfamiliar or may be exposed, document what you know, create a replacement where appropriate, update the integration, and then remove the old key. (See How to manage your account's API keys.)

Check the activity log, if available

Authorized users can use the customer-facing activity log to review account changes:

1. Open Settings > Account > Activity Logger.
2. Review the timestamp, user email address, and change category for entries you do not recognize.
3. Filter by User, Timeframe, or Keyword to investigate a specific person, launch window, flow, segment, or campaign.

The activity log is an audit trail, not a complete record of every login or API request. Some event details may be limited, and the available history can vary. The absence of an entry does not prove that an action did not happen. For API request-level investigation, use Klaviyo's available API/developer logs where your account provides access, or ask Klaviyo Support for help.

Check recent business activity

Look for changes that your team cannot explain, such as:

• New or modified campaigns, flows, templates, lists, or segments
• Unexpected exports, imports, suppressions, or profile changes
• Unfamiliar integrations or API keys
• Unexpected plan, billing, sender, or account-setting changes
• Messages sent or scheduled without an approved business reason

Step 6: What should you do if you suspect an account takeover?

An account compromise may involve an unauthorized person accessing a user account and viewing, exporting, or changing account data. Possible warning signs include:

• A new-device or login alert that you did not initiate
• Unfamiliar changes to account settings, email templates, campaigns, flows, lists, or segments
• Activity you did not perform, including exports, imports, profile changes, or message sends
• API activity from an unfamiliar source or unexpected API actions
• A password that no longer works because someone else changed it

No single signal proves an ATO. Treat multiple unexplained signals, or any confirmed unauthorized action, as an incident.

Contain the issue

1. Stop using suspicious links or replying to suspicious messages.
2. Change the affected Klaviyo password immediately using Klaviyo directly. Klaviyo states that changing the password ends all active sessions.
3. Review and strengthen MFA. Ask an Owner or Admin to reset MFA for a user if necessary.
4. Revoke unfamiliar or exposed private API keys from Settings > API keys.
5. Review Settings > Users and remove unauthorized users if you are authorized to do so.
6. Preserve evidence before deleting or changing more than necessary: screenshots, timestamps, relevant user email addresses, campaign or flow names, and the approximate time window.
7. Notify your internal IT or security team if your organization has one.

Do not send Klaviyo Support your password, MFA code, backup codes, or full private API key. If a private key has been exposed, describe the exposure without pasting the secret.

Contact Klaviyo safely

If you suspect an account compromise, contact Klaviyo through the Klaviyo Support page or the support option inside the Klaviyo app. State clearly that the request concerns a suspected account compromise or unauthorized activity.

Include:

• Your company or account name and Site ID, if available
• The email address of the affected Klaviyo user
• Your role in the account
• What happened and when you first noticed it
• The suspected user, API key label, campaign, flow, export, or setting involved
• The steps you have already taken, such as changing the password or revoking a key
• Relevant screenshots or message headers, after removing passwords, MFA codes, backup codes, and private API keys

If you are locked out, use the account-access or support request path rather than creating a shared login. Klaviyo may need to verify that you are authorized to access the account before helping with recovery or account information.

Expected outcome

After completing this recipe for security:

• Every user has an individual login and appropriate permissions.
• MFA is enabled for each user, with secure recovery information stored safely.
• Trusted devices are limited to private, controlled devices.
• Private API keys are scoped, labelled, securely stored, and rotated when needed.
• Owners and Admins have a repeatable process for reviewing users, keys, and account activity.
• The team knows what to do if an unexpected login, account change, or API action suggests an account takeover.

Related reading

• General Account Security Tips and Tricks
• How to set up multi-factor authentication (MFA)
• Multi-factor authentication (MFA) FAQs
• How to add trusted devices
• How to keep your account secure
• How to create or clone a private API key
• How to manage your account's API keys
• User management and privileges
• How to add or delete users and manage permissions
• Understanding the activity log
• Suspected Account Compromise
• Suspected Phishing
• Klaviyo Support