Open OAuth tools

CRM / Finance

Klaviyo OAuth

Klaviyo requires mandatory PKCE, Basic client authentication, account-scoped tokens, API revision headers, and marketplace review rules.

Manual / specialised flowProvider docs Workflow guide

Specialised flow

Manual provider setup

Klaviyo requires mandatory PKCE, Basic client authentication, account-scoped tokens, API revision headers, and marketplace review rules.

Required inputs

  • clientId and clientSecret
  • redirectUri and least-privilege scopes
  • per-request PKCE verifier and S256 challenge
  • authorization code (expires after 5 minutes)
  • API revision used for verification

Workflow guide

How the Klaviyo workflow works

Back to the tool ↑
  1. 01UnderstandReview why this provider needs a specialized setup path.
  2. 02CollectGather the required provider-specific fields.
  3. 03Run setupComplete the provider flow outside the generic OAuth form.
  4. 04ValidateUse the checklist to confirm token and metadata handling.

What this workflow can do

  • Manual provider checklist
  • Provider-specific inputs
  • Generic OAuth form

Before starting

  • clientId and clientSecret
  • redirectUri and least-privilege scopes
  • per-request PKCE verifier and S256 challenge
  • authorization code (expires after 5 minutes)
  • API revision used for verification

Result handling

  • Use the checklist to complete provider-specific setup outside the generic form.
  • Anonymous OAuth Hub workflows do not store secrets, tokens, or provider payloads.

Troubleshooting

  • Send token and revoke traffic to a.klaviyo.com, not www.klaviyo.com.
  • Refresh tokens are revoked after 90 days of inactivity and token requests are rate-limited.

Provider checklist

  1. Create a public OAuth app and allowlist the exact redirect URI.
  2. Generate and retain a unique PKCE verifier for each authorization request.
  3. Exchange the code server-to-server at https://a.klaviyo.com/oauth/token.
  4. Verify the token with an account endpoint using the required API revision header.