klaviyo-security-basics

# Klaviyo Security Basics ## Overview Security best practices for Klaviyo: API key types, OAuth scopes, webhook HMAC-SHA256 signature verification, and secret rotation procedures. ## Prerequisites - Klaviyo account with API key access - Understanding of environment variables and secret management - Access to Klaviyo dashboard (Settings > API Keys) ## Instructions ### Step 1: Understand Key Types | Key Type | Format | Use Case | Sensitivity | |----------|--------|----------|-------------| | Private API Key | `pk_*` (40+ chars) | Server-side REST API | **CRITICAL** -- never expose client-side | | Public API Key | 6 alphanumeric chars | Client-side Track/Identify only | Low -- safe in browser JS | Private keys authenticate via `Authorization: Klaviyo-API-Key pk_***` header. Public keys pass as `company_id` query parameter. ### Step 2: Environment Variable Configuration ```bash # .env (NEVER commit) KLAVIYO_PRIVATE_KEY=pk_*************************************** KLAVIYO_PUBLIC_KEY=UXxxXx KLAVIYO_WEBHOOK_SIGNING_SECRET=whsec_************************* # .gitignore -- mandatory entries .env .env.local .env.*.local ``` ```typescript // src/config/klaviyo.ts -- validated config loader function requireEnv(name: string): string { const value = process.env[name]; if (!value) throw new Error(`Missing required env: ${name}`); return value; } export const klaviyoConfig = { privateKey: requireEnv('KLAVIYO_PRIVATE_KEY'), publicKey: process.env.KLAVIYO_PUBLIC_KEY || '', ...