General Account Security Tips and Tricks

General Account Security Tips and Tricks

Estimated 3 minute read

Updated May 19, 2026, 12:00 AM EST

Table of contents

For all users
For Admins and Owners

For all users

Use strong passwords

Create a unique, strong password for your Klaviyo account that includes numbers, letters, symbols, and at least 12 characters.
Never share your password with others, including your teammates or colleagues, and never reuse it across different sites.

Enable multi-factor authentication (MFA)

Turn on MFA for additional protection, and add a backup method to help prevent account lockout. If you use an authenticator app, save your backup codes in a secure place. Each code can only be used once.
Klaviyo suggests using an authenticator app-based MFA over SMS, but any form of MFA is better than none.

Beware of phishing

Klaviyo employees will never ask you for your password, MFA code, or recovery codes. Never give these out.

Check the sender address before opening any Klaviyo-related email. We will only send you emails directly from an @klaviyo.com email address, so please double check before opening.
Never click on suspicious links or download unknown attachments.
Don’t enter your Klaviyo login credentials on unfamiliar websites. Always navigate to www.klaviyo.com directly if you’re unsure.

Access Klaviyo from trusted devices only

Avoid using public/shared computers or unsecured Wi-Fi when logging in to Klaviyo.
Always log out after your session, especially on shared devices.

Promptly report security issues

If you notice suspicious emails, unexpected password prompts, or odd behavior in your Klaviyo account, reach out to reportphishing@klaviyo.com right away, and notify your IT department or security team, if applicable.
We also advise you to change your password immediately, to prevent anyone from gaining access to your account.
Share as much information as you can safely gather - such as the email address you received content from, the email header, or any screenshots you think are relevant.

For Admins and Owners

Require strong authentication

Instruct all users to create strong, unique passwords for their Klaviyo accounts.
Require MFA for all users in your account. Paid accounts already require MFA. If you require SSO, manage MFA for SSO logins through your identity provider.
We recommend enabling single sign-on (SSO) if your organization has an identity provider (IdP).
Note: this is only available for paid plans.

Regularly audit user access

Periodically review all users and roles in your Klaviyo account.
Remove users who no longer need access (such as former employees, partners, marketing agencies, or contractors).
Follow the principle of least privilege. When you're setting up permissions, give your users the smallest scope of permissions required to do their job, and no more.

Ensure you’re never sharing login credentials between multiple people. You can have as many people as you want on your Klaviyo account for free. Shared user accounts make it impossible for you to tell who took an action in your account, and also make it harder for Klaviyo to detect if someone is accessing your account who shouldn’t.

Monitor account activity

Validate the users and roles in the account, and check for new users you don’t recognize.

Manage integrations and API keys carefully

Restrict who can create or manage API keys and integrations by assigning the appropriate user role.
Migrate API keys to OAuth when possible.
Rotate private API keys in your account regularly. Generate a new key, update each integration that uses the old key, and confirm it works before deleting the old key. Regular rotation limits the potential damage if a key is compromised.
Tip: You can create a replacement with the same permissions by cloning your existing private API key. Cloning leaves the original key in place. Copy or download the new key and store it securely before leaving the page, since you cannot view it again. Limit each integration’s access to only the data it needs.

Keep contact and recovery information up to date

Ensure your organization's admin contact info on file with Klaviyo is always current to support account recovery in emergencies.

Stay informed

Monitor Klaviyo’s status page, blog, and trust center for important updates or security advisories.
Adapt your practices as new security features or threats emerge.

Was this article helpful?

YesNo

Use this form only for article feedback. Learn how to contact support.