How to keep your account secure

You will learn

Learn how to review your API keys, user access, and multi-factor authentication (MFA) settings to help protect your Klaviyo account and data.

Review these settings regularly, especially before periods of increased website traffic and messaging from your brand.

Before you begin

Start with these 2 security checkups:

1. Public versus private API key security checkup
2. User review and access checkup

Complete these checks in the Klaviyo account you want to secure. If you cannot manage API keys, users, or account-wide security settings, ask your account’s Owner or an Admin to help. Work with your developer if you do not manage your website’s code.

Public vs. private API key security checkup

To access your account’s API keys:

1. Click your account name in the bottom left corner.
2. Select Settings > API keys.

Your public key, also called your site ID, is in the table in the first section of this page, whereas your private keys are listed in the second table labeled Private API Keys.

• Public API key
  Your public API key, also called your site ID, identifies your Klaviyo account. Use it in the Klaviyo JavaScript library and client-side API calls. It is intended to appear in your website’s public code.
• Private API key
  A key that grants access to read or change data, such as lists in Klaviyo, according to its assigned scopes (permissions). Treat private API keys like passwords: keep them in a secure place and never expose them in public code.
  Private API keys start with “pk_”. New keys also include your account ID before the random characters. For example: pk_ABC123_0123456789abcdef0123456789abcdef01. Some existing keys use the older format without the account ID.
  

Verify that all client-side code uses your public API key

Have you written any custom code using the Learnq, klOnsite, or Klaviyo objects, code that calls our client-side API endpoints, or did you install Klaviyo.js manually? If yes to any of the above, it's important to verify that you're only using your public API key in these instances.

You'll want to check each page on your site with custom code. You can start with your homepage:

1. Open your website.
2. Right-click and select View Page Source.
3. Use your browser’s Find command to search the page source for “pk_”.
4. Make sure that no private keys are used as a company_id, "token" value, or, in rare cases, account value.
5. If you find any private API keys (value starts with “pk_”), review the section below on what to do when your private API key is exposed.

What to do if your private API key was exposed

If your private API key was used instead of your public API key, replace and delete the exposed key promptly. Replacing it in your website’s code does not revoke it. Deleting it prevents applications from continuing to authenticate with it, so those applications will need replacement keys.

1. Record the exposed key securely so you can identify it later, then replace it in your website’s client-side code with your public API key.
2. Identify every integration and application that uses the exposed private key, including custom server-side code.
3. For each integration and application that uses an exposed private API key, create a new key in your account settings by selecting Create Private API Key.
4. Enter a descriptive Private API Key Name and select the access level the integration needs. To limit access to specific API scopes, choose Custom Key and grant only the permissions the integration requires. Click Create.
5. On the confirmation page, click Copy Key and save the key in a secure location before closing the page. You cannot view the full key again.
6. Update each affected integration or application with its new private API key and check that it works. Keep private keys in server-side configuration, not in public website code.
   • Deletion cannot be undone. Check the key’s name and ending characters before you confirm deletion.
7. Return to Settings > API keys. Find the exposed key using its name and the last 4 characters shown in the table. Open its actions menu and select Delete, then click Delete in the confirmation dialog.

Deleting the exposed key revokes its access to your account. It does not undo any access or changes that occurred before deletion.

For more information on API key security, head to How to manage your account’s API keys.

User management and data access checkup

It is important to understand who has access to different features and information in your account. To see all users who have access to your account:

1. Click your account name in the bottom left corner.
2. Select Settings > Users.

Periodically review the users within your account and their access levels. These 3 activities will help secure your account:

You cannot delete the account Owner. If your account uses SCIM to manage users through an identity provider (IdP), remove the user from your IdP before deleting them in Klaviyo.

• User review
  Review all users and identify anyone who no longer needs access. If the Inactive users tab appears, review it as well as Active users. Open the actions menu beside a user, select Delete user (or Cancel invite for a pending invitation), then click Delete user in the confirmation dialog. Common reasons for removing access include:
  • Role change within the company
  • Termination of an employee
  • Contract expiration of a third-party vendor.
• Role review
  Check that each user has only the permissions they need for their job. For details on the permissions included in each static user role, see User management and privileges.
• Multi-factor authentication
  Multi-factor authentication adds a verification step, such as a one-time code, to your username and password. It helps reduce the risk of unauthorized access if someone obtains your password. To require MFA for users in your account:
  1. Go to Settings > Security.
  2. Under MFA methods, turn on Require for all users in your account. If the requirement is already enforced, leave it on.
  3. If you turned on the requirement, click Enable in the confirmation dialog.

Users who sign in with a username and password and have not set up MFA will be prompted to do so when they next log in. New users will be prompted during registration. Users signing in through required single sign-on (SSO) follow your SSO authentication requirements.

Additional resources