Applications API overview

OpenAPI Spec

Machine-readable spec for the Applications API: beta/categories/applications.json

Before you begin

Check out our general API overview to make sure you're ready to get started with specific endpoints.

🚧

Beta

The Applications API is in beta. Send the revision: 2026-07-15.pre header to call these endpoints. Endpoints may change before general availability.

The Applications API lets you work with apps in the Klaviyo application marketplace. Use it to:

• Browse the apps listed in the marketplace.
• Create and manage your own OAuth apps, and submit them for review.
• See which apps are installed in an account, and uninstall them.
• See which accounts installed an app you own.

Use cases

Here are example use cases supported by the Applications API:

• Show a list of Klaviyo applications on your own website, filtered by category.
• Create an OAuth app from your own tooling, instead of in the Klaviyo UI.
• Check if your app is still installed in an account before you sync data.
• Let a user disconnect your app from Klaviyo from inside your product.
• Count the accounts that have installed your app.

Required scopes

To use the Applications API, your private key or OAuth app needs the following scopes:

• applications:read - required to read apps and app installs.
• applications:write - required to create, update, or delete apps and to uninstall apps.

An OAuth app does not need these scopes to act on itself. For example, your OAuth app can get its own install, update its own details, or uninstall itself with only its access token. Private keys do not have an app identity, so they always need the scope.

Data model

The Applications API has two resources: application and application-install.

Application

An application is an app in the Klaviyo marketplace. It has the following fields:

• id

  The 26-character ID of the app.

• attributes

  • name

    The display name of the app.

  • developed_by

    The name of the company that built the app.

  • status

    Where the app is in its listing lifecycle. One of draft, submitted_for_review, published, or unpublished. See App status.

  • short_description and description

    A one-line summary and a longer description of the app.

  • categories

    The marketplace categories the app is listed under, for example ecommerce_platform or reviews.

  • icon_url and banner_image_url

    Images shown on the app's marketplace tile.

  • features, gallery_items, video, and articles

    Listing content, such as feature highlights, screenshots, a YouTube video, user guides, and case studies.

  • install_url

    The URL that starts the install flow for the app.

  • client_id and scopes

    The app's OAuth client ID and the API scopes it asks for when an account installs it.

  • oauth_callback_urls

    The app's OAuth redirect URIs. Only the account that owns the app can see this field.

  • privacy_policy_link, support_link, website_link, preferences_link, and pricing_information_link

    Links to the app's policies, support, website, settings, and pricing.

  • created_at

    The date and time the app was created.

• relationships

  • account

    The account that owns the app.

  • application-install

    Your account's install of this app, if it has one.

  • application-installs

    All installs of an app you own.

What you see depends on who you are:

• Owners see the latest saved version of their own app at any status.
• Everyone else sees the published version of an app. For an app that is not published, you only get the basic fields needed to identify and install it.

Application install

An application-install is one account's install of an app. It has the following fields:

• id

  The app ID and the account ID, joined by a colon. For example, 01K5T8ZQ4M9V2XJH7R3N6B1CDE:XyZ9Ab.

• attributes

  • installed_at

    The date and time the app was installed.

• relationships

  • application

    The app that is installed.

  • account

    The account the app is installed in.

Endpoints

The Applications API has two groups of endpoints.

Server-side endpoints

Call these endpoints from your server with a private key or an OAuth access token.

When you call an install endpoint with an OAuth access token, you only see your own app's install.

Client-side endpoints

These endpoints do not need an API key, so you can call them from a browser. They only return published apps.

Browse the marketplace

Use Get Applications or Get Client Applications to list apps. Results are sorted newest first.

Filtering

You can filter apps by the following fields:

To leave out apps from a developer, wrap the developed_by filter in not(). For example, not(equals(developed_by,'29 Next')).

See our filtering guide to learn more.

Pagination

These endpoints use cursor pagination. Use page[size] to set the number of results per page. The default is 25 and the maximum is 100. See our pagination guide to learn more.

Get Client Applications example request

The request below gets published apps in the reviews category:

curl --request GET \
  --url "https://a.klaviyo.com/client/applications?filter=equals(categories,'reviews')&page[size]=10" \
  --header 'accept: application/json' \
  --header 'revision: 2026-07-15.pre'

The response looks like this:

{
  "data": [
    {
      "type": "application",
      "id": "01K5T8ZQ4M9V2XJH7R3N6B1CDE",
      "attributes": {
        "name": "Demo Reviews",
        "developed_by": "Klaviyo Demo",
        "status": "published",
        "short_description": "Collect product reviews and sync them to Klaviyo.",
        "description": "Demo Reviews sends review requests after each order and syncs submitted reviews to Klaviyo as events.",
        "categories": ["reviews"],
        "icon_url": "https://static.klaviyo.com/applications/01K5T8ZQ4M9V2XJH7R3N6B1CDE/icon.svg",
        "banner_image_url": null,
        "install_url": "https://reviews.klaviyo-demo.com/klaviyo/connect",
        "client_id": "3f6c2a1e-8b7d-4c59-9e0a-2d4b6f8c1a73",
        "scopes": ["events:write", "profiles:read"],
        "oauth_callback_urls": null,
        "features": [
          {
            "title": "Send review requests",
            "short_description": "Trigger review request flows in Klaviyo after an order ships."
          }
        ],
        "gallery_items": [
          {
            "image_url": "https://static.klaviyo.com/applications/01K5T8ZQ4M9V2XJH7R3N6B1CDE/gallery1.png"
          }
        ],
        "video": null,
        "articles": [
          {
            "type": "user_guide",
            "title": "Connect Demo Reviews to Klaviyo",
            "link": "https://help.klaviyo-demo.com/klaviyo",
            "description": "Step-by-step setup walkthrough.",
            "image_url": null
          }
        ],
        "privacy_policy_link": "https://klaviyo-demo.com/privacy",
        "support_link": "mailto:[email protected]",
        "website_link": "https://klaviyo-demo.com",
        "preferences_link": "https://reviews.klaviyo-demo.com/settings",
        "pricing_information_link": "https://klaviyo-demo.com/pricing",
        "created_at": "2025-11-03T14:22:10Z"
      },
      "links": {
        "self": "https://a.klaviyo.com/client/applications/01K5T8ZQ4M9V2XJH7R3N6B1CDE"
      }
    }
  ],
  "links": {
    "self": "https://a.klaviyo.com/client/applications?filter=equals(categories,'reviews')&page[size]=10",
    "next": null,
    "prev": null
  }
}

Create and manage your app

Create Application request details

Use Create Application to create a new OAuth app. The new app starts in draft status. The request body has the following fields:

• Title (required)

  The name of your app. It can be up to 30 characters.

• Client JWK (required)

  An RSA public key in JWK format, at least 2048 bits long. Klaviyo uses this key to encrypt your client secret. See Get your client secret.

• Description (optional)

  A description of your app. It can be up to 300 characters.

• OAuth callback URLs (optional)

  The redirect URIs for your OAuth flow.

• Scopes (optional)

  The API scopes your app asks for when an account installs it. Only scopes that are available to OAuth apps are allowed.

Create Application example request

{
  "data": {
    "type": "application",
    "attributes": {
      "title": "Demo Reviews",
      "description": "Collect product reviews and sync them to Klaviyo.",
      "oauth_callback_urls": ["https://reviews.klaviyo-demo.com/oauth/callback"],
      "scopes": ["events:write", "profiles:read"],
      "client_jwk": {
        "kty": "RSA",
        "e": "AQAB",
        "n": "uAbybLcX19kBAo894yXDQTaT43edPQAj7v2GCLN9gnR_1-xsDvUp2W2V0djRU98ZLsx0gTTRgLz0CYn8AAjvC37ZSuGgkxVGv5xEnblIBb6TdvROHIrCaLOx79WYitnxdfzy8dDwN1L0CkcfJSa3rCZR30vZbuG4976o7i6kqPy0fGKX0SebxmPscetjWzHRlGonqW2JdC7ddBMAXggfAwasmDASMW8PyebHn6UbuYE874u70an2yJqZLZSP8Ua4FK0TjbmyhHubfKRXFC_9OUYOMUMuAqf7_J1wrgdH2gsfPNpM5MQQeTffu5MlYAOecI_O-mSE71XotBTZbC5elw"
      }
    }
  }
}

The 201 response looks like this:

{
  "data": {
    "type": "application",
    "id": "01K5T8ZQ4M9V2XJH7R3N6B1CDE",
    "attributes": {
      "title": "Demo Reviews",
      "status": "draft",
      "description": "Collect product reviews and sync them to Klaviyo.",
      "oauth_callback_urls": ["https://reviews.klaviyo-demo.com/oauth/callback"],
      "scopes": ["events:write", "profiles:read"],
      "client_id": "3f6c2a1e-8b7d-4c59-9e0a-2d4b6f8c1a73",
      "client_secret_jwe": "eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.tVzYenyYlDqqb9Clzi_sY0sJa6zIsRTHQetJ56iHlfxzmgVv_yatAQCMxpxt6oYeE8PtNOfOLhAO1mZ46mTh4T9QMSvwkUFRv8uJnKaTToT522Pt2T8DjE2s0Q7zixVXmeK-BqGVe3GZaDd8kiYUOVW-_8KUgEl-nMnVk_90AqvN7EevipkotRpbfbYlUX7vTSJ_EwGQv83ev0XNeB5YKGP96pQN88LV8AFO7NCK1vkKs9MDBu1gHe8eLeDL5_XAxMCyjwzbyXcYBtIccvHRSngopiUFjxQ-1y15vrEPlccL9rX9b4GBu9z4KbNSFDncdbZ0Pa_iAQ5jq5dh8bctzQ.XQEbqVGM8dWrwvZA.n8i9E8YUCgjaCJyTMAsZXvOsrguGQVVfmlovOUM88bVj3fAAeQBQ7ngwPqdLNGuuPF_IMYxoCB6Ad7WFLeCIOXDH5v0vlx7oj6f77hMR2WT4f_t-FfA.5obABbaBYigqn20ch4Z8SA",
      "install_url": "https://www.klaviyo.com/oauth/authorize?client_id=3f6c2a1e-8b7d-4c59-9e0a-2d4b6f8c1a73&response_type=code&scope=events%3Awrite+profiles%3Aread",
      "created_at": "2026-09-24T15:04:32Z"
    },
    "links": {
      "self": "https://a.klaviyo.com/api/applications/01K5T8ZQ4M9V2XJH7R3N6B1CDE"
    }
  }
}

Get your client secret

Klaviyo never returns your client secret in plain text. Instead, the Create Application response includes client_secret_jwe: your client secret, encrypted with the public key you sent in client_jwk. It uses compact JWE with RSA-OAEP-256 and A256GCM.

To get your client secret, decrypt client_secret_jwe with your matching private key. Most JOSE libraries support this, such as jose for Node.js or joserfc for Python.

🚧

Klaviyo only returns the client secret once, when you create the app. Decrypt it and store it in a safe place right away. Keep your private key secret.

App status

An app moves through the following statuses:

Use Update Application to change the status. You can make the following changes:

• draft to submitted_for_review, to submit your app for review.
• submitted_for_review to draft, to withdraw your app from review.
• published to unpublished, to remove your app from the marketplace.

You can't publish an app with the API. Klaviyo publishes your app after it passes review.

Update Application example request

Use Update Application to change your app's title, description, oauth_callback_urls, scopes, or status. Only send the fields you want to change.

The request below submits a draft app for review:

{
  "data": {
    "type": "application",
    "id": "01K5T8ZQ4M9V2XJH7R3N6B1CDE",
    "attributes": {
      "status": "submitted_for_review"
    }
  }
}

To edit an app that is submitted_for_review or published, move it out of that status in the same request. For example, you can send "status": "draft" together with a new description to withdraw the app and edit it at the same time. If you try to edit an app that stays locked, you get a 409 error.

Delete an app

Use Delete Application to delete an app you own. Before you delete an app, make sure that:

• The app is not published.
• No other account has the app installed. Each account must uninstall the app first.

Deleting an app also revokes its OAuth client, so its access tokens stop working.

Work with app installs

Check if your app is installed

Use Get Application Install for Application to see if an account has your app installed. Call it with your OAuth access token:

curl --request GET \
  --url https://a.klaviyo.com/api/applications/01K5T8ZQ4M9V2XJH7R3N6B1CDE/application-install \
  --header 'Authorization: Bearer your-access-token' \
  --header 'accept: application/json' \
  --header 'revision: 2026-07-15.pre'

If the app is installed, the response looks like this:

{
  "data": {
    "type": "application-install",
    "id": "01K5T8ZQ4M9V2XJH7R3N6B1CDE:XyZ9Ab",
    "attributes": {
      "installed_at": "2026-09-01T18:45:00Z"
    },
    "relationships": {
      "application": {
        "data": {
          "type": "application",
          "id": "01K5T8ZQ4M9V2XJH7R3N6B1CDE"
        },
        "links": {
          "self": "https://a.klaviyo.com/api/application-installs/01K5T8ZQ4M9V2XJH7R3N6B1CDE:XyZ9Ab/relationships/application",
          "related": "https://a.klaviyo.com/api/application-installs/01K5T8ZQ4M9V2XJH7R3N6B1CDE:XyZ9Ab/application"
        }
      },
      "account": {
        "data": {
          "type": "account",
          "id": "XyZ9Ab"
        }
      }
    },
    "links": {
      "self": "https://a.klaviyo.com/api/application-installs/01K5T8ZQ4M9V2XJH7R3N6B1CDE:XyZ9Ab"
    }
  }
}

If the app is not installed, data is null.

Uninstall an app

Use Delete Application Install to uninstall an app from your account. An OAuth app can uninstall itself with its own access token. For example, you can call this endpoint when a user clicks Disconnect from Klaviyo in your product.

List installs of your app

Use Get Installs for Application to list every account that installed an app you own. Results are sorted newest first and use cursor pagination. The default page size is 25 and the maximum is 100.

Rate limits

See our rate limits guide to learn more.

Limitations

• App titles can be up to 30 characters and descriptions can be up to 300 characters.
• You can't publish an app with the API. Klaviyo publishes apps after review.
• You can't edit an app while it is submitted_for_review or published.
• You can't delete a published app, or an app that another account has installed.
• The client secret is only returned once, when you create the app.

Additional resources

• Set up OAuth
• Filtering
• Pagination
• Relationships