Email Agency Klaviyo Access: Roles and Permissions to Open

Before handing Klaviyo to an email agency, the brand has to decide which access to open, for whom, and with which role. Klaviyo documents adding users, the available roles and a log of changes. This article covers those pages with their exact scope, then lists what the brand sets up before BFCM.

TL;DR. In a standard Klaviyo account, Owners and Admins can add or remove users and change their roles, as can users whose custom role includes permission to edit user management. Eight static roles exist: Owner, Admin, Manager, Analyst, Campaign Coordinator, Content Creator, Support and Social Media Manager. Among the static roles, Owner, Admin and Manager are the ones that create flows and edit their triggers and filters. In our view, the role is chosen according to the mission entrusted.

Want an outside view before you build? We offer a Q4 readiness audit: 30 minutes, free, no strings attached, as well as a Klaviyo audit.

This article is part of our Klaviyo BFCM guide, which covers the preparation for the season.

The scope of the Klaviyo pages

Three scopes coexist, and the pages do not carry over from one to another. The add-users page states that it concerns users who are not the Owner in a standard Klaviyo account, and points to other articles for transferring ownership and for users in a portfolio (Klaviyo, how to add or delete users and manage permissions). The static roles reference page covers the permissions of account users and points elsewhere for portfolio roles (Klaviyo, user management and privileges reference for static user roles). A third page describes roles at the organization level, with distinct roles (Klaviyo, understanding user roles for organizations).

What follows concerns the standard account. Organization roles (Super Admin, Analyst and custom roles) belong to another framework: read that page separately if your structure depends on it.

Who can add a user

According to the add-users page, Owners and Admins can add or remove users and change their roles. Users with a custom role that includes permission to edit user management can also do so. The reference page confirms that, among static roles, only Owners and Admins can add new users.

Custom roles have their own permissions, and feature availability also depends on the account's plan, integrations and data residency.

Adding a user step by step

The steps described by the page:

1. Click the account name at the bottom left, then Settings > Users.
2. Click Add new user and type the email address.
3. Select a language: for a new user, it sets the language of the invitation and of their personal experience.
4. Under User Role, select a custom role created for the account or one of the seven standard roles offered: Admin, Manager, Analyst, Support, Campaign Coordinator, Content Creator, Social Media Manager.
5. Click Add User.

The user receives an email from Klaviyo's Support team. Invitation links expire after 24 hours: you resend the invitation from Settings > Users (the Active users tab if the page shows tabs), three-dot menu, Resend Invites.

Removing a user, SSO and changing a role

The page states that you cannot delete yourself or the Owner: to remove an Owner, you must first transfer account ownership. From Settings > Users, Delete user applies to a user who has completed setup, Cancel invite to a pending invitation. If the account manages its users through SCIM via an identity provider, you must remove the user in that provider before deleting them in Klaviyo.

To change a role, you open the user in Settings > Users, select the new role under User Role, then Update. If the account uses SSO with just-in-time provisioning or SCIM, the role is changed in the identity provider, except for users on the SSO exception list.

What the eight static roles allow

The reference page describes a single Owner per account. The Owner has access to everything, can edit and close the account, create private API keys and edit the Domains page. The Admin has full account access, can add or delete users, cancel a paid subscription and create private API keys, but cannot fully close the account.

The other roles are more restricted:

1. Manager: access to the core features, with limits in flows, lists, segments and analytics. They cannot edit or delete users, or export recipient activity or addresses.
2. Analyst: access to analytics, segments and reporting. On flows, they can only view and export analytics and preview messages.
3. Campaign Coordinator: creates and sends campaigns, creates and edits templates. On flows, they only edit the name, the tag and message content, and preview.
4. Content Creator: creates and edits templates. They can neither schedule nor send campaigns.
5. Support: responds to customers in Helpdesk and views profiles.
6. Social Media Manager: manages social content, with access to media and analytics.

Roles and flows: what the table says

The flow permissions table is the most useful one for an email mission. Creating, cloning and deleting a flow, editing its triggers and filters, its message settings, its components and the status of actions are open to the Owner, the Admin and the Manager. Campaign Coordinator and Content Creator can edit message content and flow details. The Analyst can view and export flow analytics.

For billing, the settings table gives closing the account to the Owner alone, and canceling the plan to the Owner and the Admin. The Manager can view the billing overview and upgrade the plan.

In our view: which role for which mission

The readings that follow are Deliver's, not Klaviyo's.

In our view, the question to ask is the mission: who has to do what in the account. A mission of creating campaigns and templates matches the Campaign Coordinator's permissions; a mission that includes building or editing flows, their triggers and their filters requires, according to the table, an Owner, Admin or Manager role, or a custom role whose detail we have not reread here. A read-only audit mission matches the Analyst rather well.

This choice depends on the brand and the scope of the contract. To compare providers, our article on the criteria for choosing a Klaviyo agency gives a grid, and our Klaviyo agency page describes how we work. For a broader approach to email, see our email marketing agency.

Tracing changes: the activity log

Klaviyo offers an activity log, under Settings > General > Activity log, that lists recorded edit actions: user, action and time (Klaviyo, understanding the activity log). It is reserved for Owners, Admins and Managers, as well as users whose custom role includes View access to Account settings or User management. Data is available starting November 11, 2025.

You can filter by user, role, action and period (last week by default), and download the current page as a CSV. In our view, this log is useful to check after the fact who changed a flow or a campaign, for example during BFCM. Our article on Klaviyo audit mistakes complements this check.

To set up on the brand side before BFCM

These points are Deliver advice.

1. Identify the account Owner and confirm they stay with the brand.
2. List the tasks entrusted: campaigns, templates, flows, reports.
3. Pick for each person the role that covers those tasks.
4. Plan for the invitation window: the link expires after 24 hours.
5. Check who can access the activity log.
6. Write down the planned access end date and the person who will remove the user.

FAQ

Who can add a user in Klaviyo?

In a standard account, Owners and Admins, as well as users whose custom role includes permission to edit user management.

How long is the invitation valid?

Links expire after 24 hours. You can resend the invitation from the users page.

Which role can edit a flow's triggers and filters?

According to the reference page table: the Owner, the Admin and the Manager.

Are organization roles the same as account roles?

No. The organization roles page describes distinct roles, such as Super Admin and Analyst at the organization level.

Want an outside view on your Klaviyo access? We run Q4 readiness audits, or you can talk directly with the Deliver team.