Agent skill · security · jeremylongshore
klaviyo-security-basics
Apply Klaviyo security best practices for API key management and access
Why this skill is useful
Provides specific procedures for securing Klaviyo API keys and implementing OAuth scopes that the AI wouldn't reliably generate on its own.
What it needs
Requires klaviyo account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Klaviyo Security Basics Overview Security best practices for Klaviyo: API key types, OAuth scopes, webhook HMAC-SHA256 signature verification, and secret rotation procedures. Prerequisites Klaviyo account with API key access Understanding of environment variables and secret management Access to Klaviyo dashboard (Settings > API Keys) Instructions Step 1: Understand Key Types Key Type Format Use Case Sensitivity ---------- -------- ---------- ------------- Private API Key pk (40+ chars) Server-side REST API CRITICAL -- never expose client-side Public API Key 6 alphanumeric chars Client-side Track/Identify only Low -- safe in browser JS Private keys authenticate via Authorization: Klaviyo-API-Key pk header. Public keys pass as companyid query parameter. Step 2: Store Keys in Environment Variables Keep every private key and the webhook signing secret out of source: load them from .env (git-ignored) through a validated config loader that throws on a missing secret, so misconfiguration fails at boot instead of at first API call. Full .env template, .gitignore entries, and the requireEnv helper: implementation.md → Environment Variable Configuration. Step 3: Scope Keys per Environment (Least Privilege) Issue a separate key for each environment with only the scopes that environment needs — read-only in dev and CI, full read/write in staging, the exact production scope set in prod — so a leaked key has the smallest possible blast radius. Scope table and per-environment env-var layout: implementation.md → Least-Privilege API Key Scopes. Step 4: Verify Webhook Signatures (HMAC-SHA256) Klaviyo signs each webhook payload with your signing secret. Recompute the HMAC-SHA256 digest over the raw body and compare with crypto.timingSafeEqual to defeat timing attacks; reject anything that does not match with 401. Full verifier plus the Express raw-body middleware that returns 401 Invalid signature: implementation.md → Webhook Signature Verification and Express Webhook Middleware. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/klaviyo-security-basics