Authorization header as Klaviyo-API-Key <key>, which is not a bearer token. Klaviyo scopes a private key at creation and will not widen it later, so give it the read and write scopes you need up front.
Things that shape the calls:
- Every request carries a
revisionheader. Klaviyo versions the API by date and this plugin sends the revision it was built against. - Bodies are JSON:API. A write is
{ data: { type, attributes } }. This plugin takes flat fields and builds that envelope; reads answerdatapluslinks. - Filters are expressions.
filteris a string such asequals(email,"a@b.com"), combined withand()andor(). Field names and operators differ per resource. - Paging is cursor-based. Pass the
nextCursorfrom one response ascursorto read the next page. Klaviyo returns the cursor insidelinks.nextas a full URL, and this plugin parses it out for you. The largestpageSizediffers per route: 10 for lists and segments, 25 for tag groups, 50 for tags, 100 for profiles and 1000 for events. Metrics and webhooks take no page size. - Subscription is a job.
profiles.subscribegrants marketing consent, so Klaviyo queues it and answers 202 with no body. The result confirms the request was accepted, not that the profile is subscribed yet. - Events are recorded by metric name, and Klaviyo creates the metric on first use. The event then counts towards any flow listening for it.
- Segments evaluate server-side. A new segment is not populated immediately, and its
definitionis a condition group rather than a filter string. - Webhooks need a secret, and Corsair does not receive the deliveries. Klaviyo signs every delivery with the
secretKeyyou set at creation. This plugin manages the webhook registrations; you host the endpoint that receives them and verify the signature there. - Rate limits run a burst and a steady window per account, and a 429 carries
Retry-After.
- 39 typed API operations
Setup
1
Install
2
Add the plugin
corsair.ts
multiTenancy: true, scope calls with corsair.withTenant(id). See Quick start for KEK + Hub keys, and Multi-tenancy for account isolation.3
Choose authentication
- API Key (Recommended)
No setup required yet. When you make your first request as a tenant, Corsair prompts for the API key.More: API Key
4
Connect a tenant
Mint a connect link and send the tenant to it. Hub hosts the page and delivers the result to your app — see Connect / OAuth.
Example API calls
Find a profile by emailWhat’s next
API reference
Every
klaviyo.api.* operation with input and output types.Connect / OAuth
createLink, Hub delivery, and tenant connect flows.
Use with agents
Expose this plugin’s operations as MCP tools.