klaviyo-enterprise-rbac

# Klaviyo Enterprise RBAC ## Overview Enterprise access control for Klaviyo: API key scoping with granular read/write permissions, OAuth app authorization flows, and application-level RBAC built on top of Klaviyo's scope system. ## Prerequisites - Klaviyo account with API key management access - Understanding of OAuth 2.0 (for OAuth apps) - Application requiring per-user or per-role Klaviyo access ## Klaviyo Access Control Model Klaviyo uses **scoped API keys** and **OAuth** for access control. There are no built-in "roles" in Klaviyo's API -- you implement RBAC by creating multiple API keys with different scopes. ### API Key Scopes | Scope | Read | Write | What It Controls | |-------|------|-------|-----------------| | `accounts` | Account info | N/A | Organization name, timezone | | `campaigns` | List campaigns | Create/send campaigns | Email, SMS, push campaigns | | `catalogs` | Browse items | CRUD catalog items | Product catalog management | | `coupons` | List coupons | Create coupons | Coupon/discount codes | | `data-privacy` | N/A | Delete profiles | GDPR/CCPA deletion requests | | `events` | Query events | Track events | Server-side event tracking | | `flows` | List flows | Create/update flows | Flow automation | | `images` | List images | Upload images | Email template images | | `lists` | List lists | CRUD lists/members | List management | | `metrics` | Query metrics | N/A | Metric aggregations | | `profiles` | Read profiles | Create/update profiles | Profile...