Klaviyo API

API Paid Caution Email

Pricing

$20/mo

Klaviyo Email at 500 active profiles and 5,000 emails a month. Rises with profile count.

Free tier

Free plan (250 profiles); API access not confirmed

Auth

API key

Private key in the Authorization header as Klaviyo-API-Key. Public company ID for client endpoints. OAuth for apps.

Data it gives

Profiles
Events
Lists and segments
Campaigns and flows
Metrics

Pricing checked on 23 Oct 2026 · Pricing page · Docs · Sign up

Description

The Klaviyo API exposes profiles, events, lists, segments, campaigns, flows and metrics. It uses JSON:API style requests with cursor pagination and a dated revision header.

It fits e-commerce teams that want an agent to push events, build segments or pull campaign and flow data.

Klaviyo also has client endpoints with a public key for browser use. Do not use a private key there.

Key endpoints

GET /api/profiles/: list profiles
GET /api/events/: list events
POST /client/events/: create an event with a public key

Example request

curl "https://a.klaviyo.com/api/profiles/" -H "Authorization: Klaviyo-API-Key YOUR_API_KEY" -H "revision: 2026-10-15"

Tech details

API style: REST
Base URL: https://a.klaviyo.com
Rate limits: Tiers XS to XL. XS: 1/s burst, 15/min steady. M: 10/s, 150/min. XL: 350/s, 3,500/min.
Official SDKs: See docs

Use Cases

Lists and segments

Campaigns and flows

Editor’s note What our review found

Editorial research, reviewed 23 Oct 2026. We read Klaviyo's pricing page and developer docs. We did not run live calls. This listing is not an endorsement.

Cost: the Free plan allows up to 250 active profiles and 500 emails a month, plus $5 of mobile messages and $5 of Composer usage a month. The pricing page's Marketing tab shows Klaviyo Email at USD 20 a month for 500 active profiles and 5,000 emails a month (a limited-time $19 off the first month was shown); price rises with profile count. Whether the API works on the Free plan is not stated on the page, so not confirmed.

Credentials and data: private API keys start with pk_ and go in the Authorization header. Store them in an environment variable or secret manager, never in code or client-side. You handle customer profiles and events, so GDPR and consent rules apply. OAuth is available for apps.

Good to know: rate limits are tiered per endpoint, with burst and steady windows. Private-key integrations share one quota per account. Always send the revision header (the docs show revision 2026-10-15 as the current one).