The value of state is missing in the Klaivyo authorization callback address.

Hi ​@juzih , 

Are you referring to making API calls with OAuth? If so, based on Klaviyo’s documentation, what you’re describing would be unexpected behavior. Klaviyo should return the same state value provided in the authorization URL as a query parameter in the callback: Make API calls using OAuth.

I’d recommend starting by comparing the authorization URLs for logged-in and logged-out users first. If state is already empty before redirecting to Klaviyo, the issue is likely in how the integration generates or preserves the value for unauthenticated merchants. Klaviyo suggests storing the PKCE verifier server-side and passing a unique identifier as state so it can be matched when the callback returns.

If the authorization URL contains a populated state, but the callback returns state=[""] only when the merchant is logged out, I’d recommend escalating this to Klaviyo Support with the client ID, redirect URI, timestamps, and redacted request URLs so the behavior can be investigated more closely.

 

Temi@Klaviyo