Leaked Klaviyo API Key: what to do in the first hour

• Server code with the key written in. An integration that sends events or syncs profiles, committed with the private key in the source instead of an environment variable.
• Environment files. A .env file or deployment file that holds the key next to other secrets, and was never excluded from version control.
• Shopify, WordPress and other plugin settings. Exported configuration files or a copied settings page that includes the key.
• Front-end code. A private key placed in browser code by mistake, which ships it to every visitor. Only public identifiers belong in the browser.
• Logs and support threads. A debug log that records the request headers, pasted into an issue or a chat thread to ask about an error.

1. Create a replacement key first. In your Klaviyo account, open Settings, then API keys, and create a new private key. Choose the narrowest scope the integration needs rather than full access. Save the value straight into your secret manager, because Klaviyo does not show a key again after it is created.
2. Deploy the new key. Update the integration or the application, restart it if needed, and make one read call and one event call. Confirm both succeed and that the test event appears in the right account view.
3. Delete the exposed key. On the same API keys page, delete the old key. Deletion is permanent, and calls with the old value fail from then on. Klaviyo’s guidance is to delete the exposed key and create a separate key for each integration that used it.
4. Check what the key did. Look at the activity for the period since the exposure. Check for profile exports, bulk list changes, new segments or flows you did not build, and events from unfamiliar sources. Look at the sending activity too, because a new campaign or a flow with a changed template is an easy way to send phishing that looks legitimate.
5. Review your flows and campaigns. Open the flows and campaigns that were edited or created recently. Pause anything you did not expect, and check the links and sender details in active templates.
6. Review users and other keys. Check which users can manage API keys and which other keys exist. Delete any key that nobody can name an owner for, and remember that only certain account roles can create or delete private keys, so the owner may need to do this step.
7. Clean the repository. Remove the value from the code and, if you want the old copy gone from history, rewrite it. See I accidentally pushed an API key to GitHub.

Not sure what else leaked? Run a free scan.

Private API keys are managed in your account under Settings, then API keys. Find the key by its name and delete it. If the integration still needs access, use the clone option, which creates a replacement with the same scopes, and then delete the old key once nothing uses it. You can also disable a key and re-enable it later, which pauses the integrations and workflows that depend on it. Disabling is a useful step if you need to stop the key right away while you work out what depends on it, but it leaves the value valid for re-enabling, so delete the key once you are sure.

Only the account roles that are allowed to manage API keys can create, clone, disable or delete them, so if the page is missing or read-only for you, ask an owner or an admin to make the change. Klaviyo does not let you view a private key after it is created and does not let you change its scopes later, which is why the replacement key must be created with the scopes you want. The API keys page of your account is the place to start.

The rule is called “Klaviyo API Key”. It looks for the literal prefix pk_, then either exactly 34 lowercase hexadecimal characters, or six letters or digits followed by an underscore and the same 34 hexadecimal characters. The value must have a word boundary on both sides. The fixed prefix and the fixed length make false positives uncommon, and short public identifiers without the long hexadecimal body are not reported. The severity is high, and the impact class is software-as-a-service, because the key controls customer data and sending in your account. This type is not checked live: LeakWatch does not send any request to Klaviyo with the key it finds.