The value of state is missing in the Klaivyo authorization callback address.

Forum|Forum|15 days ago
August 6, 2026
3 replies
115 views

we've noticed that when a merchant isn't logged into the Klaviyo platform, the `state` value in the Klaviyo callback URL is lost after authorization. However, if the merchant logs into the Klaviyo platform first and then authorizes, the `state` value in the callback URL is not lost. Could you please take a look at this issue?

eg:"state":[""]

API

Temi O.

Community Manager

Hi @juzih ,

Are you referring to making API calls with OAuth? If so, based on Klaviyo’s documentation, what you’re describing would be unexpected behavior. Klaviyo should return the same state value provided in the authorization URL as a query parameter in the callback: Make API calls using OAuth.

I’d recommend starting by comparing the authorization URLs for logged-in and logged-out users first. If state is already empty before redirecting to Klaviyo, the issue is likely in how the integration generates or preserves the value for unauthenticated merchants. Klaviyo suggests storing the PKCE verifier server-side and passing a unique identifier as state so it can be matched when the callback returns.

If the authorization URL contains a populated state, but the callback returns state=[""] only when the merchant is logged out, I’d recommend escalating this to Klaviyo Support with the client ID, redirect URI, timestamps, and redacted request URLs so the behavior can be investigated more closely.

Temi@Klaviyo

J

juzihAuthor

Contributor I

I understand. When a user isn't logged in, the state in the redirected login authorization URL is lost, resulting in no state in the callback path.

For example, you can try this path:

https://www.klaviyo.com/oauth/authorize?response_type=code&client_id=01f273d7-5242-48a9-a81a-05c172826e7f&redirect_uri=https://xxxx.xxx.com/api/admin/v2/custom/klaviyo/auth-callback&scope=catalogs:read%20catalogs:write%20profiles:read%20profiles:write%20subscriptions:write%20events:read%20event s:write%20accounts:read%20lists:read%20lists:write%20data-privacy:write%20webhooks:read%20webhooks:write&code_challenge_method=S256&code_challenge= 3mG2O4ytyasdoJGuGarL2IXedddddTejQa0uzYyOOuWlfc&state=%7B%22appKey%22%3A%22 eaaa88b468a98fcf73d89689670105f1e2%22%2C%22handle%22%3A%22yyzzww1030%22%7D

Temi O.

Community Manager

Thanks for the example, that is helpful! So the state value is present in the initial authorization URL, and it does not look like your integration is failing to generate it.

If it disappears only after Klaviyo redirects an unauthenticated user through the login step, that would be unexpected OAuth behavior.

At this point, I would recommend that you escalate this to the Klaviyo Support team as a reproducible issue and include the client ID, redirect URI, authorization URL with sensitive values redacted, the callback URL, timestamps, and the exact steps showing that the issue occurs only when the user is not already logged in. It would also be worth confirming that the URL is sent without any added spaces or line breaks and that the encoded state value is identical before the redirect.

Based on the example you shared, this now looks more like a problem in the login-to-authorization redirect flow than an issue with how your app stores the verifier.

Let me know if you have any trouble creating the ticket with Support!

Temi@Klaviyo

Sign up

Use your Klaviyo credentials

Log in to the Community

Use your Klaviyo credentials