CRM / Finance
Klaviyo OAuth
Klaviyo requires mandatory PKCE, Basic client authentication, account-scoped tokens, API revision headers, and marketplace review rules.
Manual / specialised flowProvider docs
What this workflow can do
- Manual provider checklist
- Provider-specific inputs
- Generic OAuth form
Before starting
- clientId and clientSecret
- redirectUri and least-privilege scopes
- per-request PKCE verifier and S256 challenge
- authorization code (expires after 5 minutes)
- API revision used for verification
Result handling
- Use the checklist to complete provider-specific setup outside the generic form.
- Anonymous OAuth Hub workflows do not store secrets, tokens, or provider payloads.
- 01UnderstandReview why this provider needs a specialized setup path.
- 02CollectGather the required provider-specific fields.
- 03Run setupComplete the provider flow outside the generic OAuth form.
- 04ValidateUse the checklist to confirm token and metadata handling.
Specialised flow
Manual provider setup
Klaviyo requires mandatory PKCE, Basic client authentication, account-scoped tokens, API revision headers, and marketplace review rules.
Required inputs
- clientId and clientSecret
- redirectUri and least-privilege scopes
- per-request PKCE verifier and S256 challenge
- authorization code (expires after 5 minutes)
- API revision used for verification
Troubleshooting
- Send token and revoke traffic to a.klaviyo.com, not www.klaviyo.com.
- Refresh tokens are revoked after 90 days of inactivity and token requests are rate-limited.
Provider checklist
- Create a public OAuth app and allowlist the exact redirect URI.
- Generate and retain a unique PKCE verifier for each authorization request.
- Exchange the code server-to-server at https://a.klaviyo.com/oauth/token.
- Verify the token with an account endpoint using the required API revision header.