Understand how KlaviyoAIBot works

Understand how KlaviyoAIBot works

Estimated 4 minute read

Updated Oct 23, 2026, 12:00 AM EST

Table of contents

What is KlaviyoAIBot?
How it works
How to identify KlaviyoAIBot
What KlaviyoAIBot crawls
Data use and privacy
Additional resources

Learn about KlaviyoAIBot, including:

What it is and what it crawls
How to identify authentic requests
How crawling respects site rules and how to control it

This article is for anyone who sees traffic from KlaviyoAIBot and wants to confirm if it is legitimate or adjust how it is allowed to crawl.

What is KlaviyoAIBot?

KlaviyoAIBot is a user-agent used by Klaviyo’s AI features, including Customer Agent. For Customer Agent, KlaviyoAIBot fetches publicly available pages from domains and URLs connected to your account. By indexing this content, Klaviyo can tailor AI experiences both on your website and within Klaviyo. This is useful for content generation, AI answers, and product recommendations.

You can add sources beyond your primary storefront, including help centers (such as Zendesk), blogs, and news articles. KlaviyoAIBot does not sign in to access pages behind authentication or paywalls.

How it works

Consent and scope Customer Agent scans your connected storefront and additional sources you add. For instance, it can crawl public Shopify pages connected to your Klaviyo account, but it won’t search Wikipedia for related content.
Respect for site rules Customer Agent checks robots.txt when choosing pages from your site’s sitemap. The Robots Exclusion Protocol (REP) is defined in RFC 9309.
Politeness When a page request receives HTTP 429, Customer Agent waits before retrying, with longer waits between attempts. These retries do not use the Retry-After header to set the wait time.
Revisits Customer Agent periodically recrawls sources with automatic syncing enabled. Frequency varies based on change signals and your configuration.

How to identify KlaviyoAIBot

The user-agent identifies crawler traffic, while HTTP message signatures help verify its origin.

Treat requests as unverified unless you can validate their signatures or confirm their identity through Cloudflare. A user-agent string alone does not prove that a request came from Klaviyo.

User-agent

KlaviyoAIBot/1.0 (+https://help.klaviyo.com/hc/en-us/articles/40496146232219)

After an HTTP 400 or 403 response, Customer Agent can retry a page request without this user-agent when robots.txt permits access. Use signature verification to identify these requests.

HTTP message signatures (web bot auth)

Customer Agent signs its page, sitemap, and robots.txt requests using HTTP Message Signatures RFC 9421 and Cloudflare’s Web Bot Auth. You can use this to verify that the request genuinely came from KlaviyoAIBot without relying on IP allowlists.

Signed requests include Signature-Agent, Signature-Input, and Signature headers. Validate the signature against Klaviyo’s public key directory; the presence of these headers alone is not proof of authenticity.

Tip: If your site is behind Cloudflare and Web Bot Auth verification is enabled, Cloudflare can validate Klaviyo’s signatures and mark verified traffic with cf.bot_management.verified_bot = true. This field identifies verified bots generally; it is not specific to Klaviyo. Consider that scope when using it in WAF rules.

I see traffic that says it is KlaviyoAIBot. How do I know it is real? If you use Cloudflare, check the request’s verified status and bot identity. If you do not use Cloudflare, validate the HTTP Message Signature headers against Klaviyo’s public key directory according to RFC 9421 and Web Bot Auth.

What KlaviyoAIBot crawls

Your ecommerce store The ecommerce domain connected to Klaviyo.
Additional sources Other sources you add to Customer Agent, such as help centers (e.g., Zendesk), documentation portals, knowledge bases, blogs, and news articles.
Public content Use publicly accessible pages as sources. Robots rules guide website scans; they do not protect private content. Use authentication or other access controls for private pages.

How to control or limit crawling

Robots.txt Add or update robots rules for the KlaviyoAIBot user-agent to control which sitemap pages are included in website scans. Find out more about robots.txt and REP.
Temporary slowdowns Return HTTP 429 to make Customer Agent wait before retrying page requests. Do not rely on 503 responses or Retry-After to set that retry delay.
Choose what’s connected You can add or remove the domains and URLs connected to Customer Agent in Knowledge.

To remove a source, you need permission to edit Customer Agent. Deleting a website source also removes its indexed subpages.

Open Customer Agent > Knowledge and select the source you want to remove.
Open More actions and select Delete. The source is removed, and you return to the Knowledge page.

Can I block a specific section of my site? Yes. Use robots rules for KlaviyoAIBot in robots.txt to disallow those paths in website scans. If you need help editing the file, contact your website administrator. To remove content already indexed in Customer Agent, delete the source from Knowledge.

Does the bot obey temporary slowdown signals? Customer Agent waits before retrying page requests that return HTTP 429. The wait increases between retries. It does not use Retry-After to set that delay, and a 503 response does not trigger the same page-request retry behavior.

Data use and privacy

KlaviyoAIBot retrieves content to power AI features, such as for content generation, AI answers, and product recommendations. Crawled content is tied to your account and follows your settings.

Automatic syncing lets Customer Agent periodically update indexed content from publicly available source pages. Sources without automatic syncing enabled need a manual resync to refresh their content. To refresh a source, open it in Knowledge and select Resync.

During a completed website resync, Customer Agent removes indexed subpages that are no longer in the site’s sitemap or are disallowed by robots.txt. Removal depends on when the website is successfully resynced, so a change on your site does not immediately remove indexed content. To remove content directly, delete its source from Knowledge.

When you delete a source from Customer Agent, Klaviyo removes that source and its indexed subpages from your account’s knowledge base.

Do you publish IP ranges?

No. Verification is based on cryptographic signatures and Cloudflare’s Verified bots program rather than static IP allowlists.

Additional resources

Getting started with Customer Agent

Learn how to activate Klaviyo's Customer Agent, an AI-powered tool that provides instant support to your website visitors. Customer Agent ingests information from your Shopify store, and learns any additional information you provide, to answer shopper inquiries across web chat, email, SMS, and WhatsApp. - Understanding how Customer Agent works

Learn how Klaviyo's Customer Agent understands and answers shopper questions, including what information it uses and the types of questions it can help with.

Was this article helpful?

YesNo

Use this form only for article feedback. Learn how to contact support.