Managing Your API Keys: Disabling and Re-enabling

Klaviyo allows you to disable and re-enable private API keys without permanently deleting them. This is useful if you want to temporarily pause a key’s activity (for example, while investigating suspicious behavior) while preserving the option to restore it later.

This article covers:

• How to disable an API key
• How to re-enable an API key
• What to do if Klaviyo has disabled a key on your behalf

Before you begin

You need permission to edit API keys to disable or re-enable them. If you cannot use the options described below, contact your account owner or admin for help.

How to disable an API key

1. Log into your Klaviyo account.
2. Navigate to Settings > API keys.
3. In Private API Keys, locate the key on the Active or Inactive tab. You can use the key name or the partial key value to identify it.
4. Click the … (more options) menu next to the key.
5. Select Disable.

Disabling the key stops API calls that use it. It appears on the Disabled tab. No data is deleted, and the key can be re-enabled when you are ready to use it again.

How to re-enable an API key

If Klaviyo disabled the key because of suspected exposure or unusual activity, review the guidance below before re-enabling it.

1. Log into your Klaviyo account.
2. Navigate to Settings > API keys.
3. In Private API Keys, select the Disabled tab and locate the key.
4. Click the … (more options) menu next to the key.
5. Select Enable.

Re-enabling the key allows API calls that use it to resume.

What do I do if Klaviyo disabled my API key?

Klaviyo can automatically disable private API keys after 730 days without use. For a key that has never been used, this period starts when it is created. This is a security measure to reduce the risk of dormant keys being exploited. Klaviyo may also disable a key on your behalf if we believe it to be exposed and at risk of abuse.

If your key was disabled for one of these reasons, you can find it on the Disabled tab. Check the notification sent to your account’s security contact for the reason and next steps.

What to do:

• If your key was disabled for inactivity and you still need it, follow the steps in the How to re-enable an API key section above, then resume using it in your integration.
• If Klaviyo disabled the key for suspected exposure or unusual activity, review its activity in Developer Tools > Logs. If the activity is legitimate, you can re-enable the key. If the key was exposed or the activity looks suspicious, delete it and create a new private API key, then update the integrations that used the old key. If you are unsure, reply to the notification for help.
• If you no longer need the key, you can leave it disabled or delete it permanently. To delete it, open the … menu, select Delete, then confirm with Delete.

Related articles