Conversions API — Server-Side Conversions

Overview

The browser Pixel is increasingly unreliable — ad blockers, iOS App Tracking Transparency, ITP cookie caps, and consent banners all suppress client-side events. A server-side Conversions API (CAPI) closes that gap by sending the conversion from your infrastructure straight to the ad platform. It is now the industry-standard signal for campaign optimisation on every major network.

Affclix runs CAPI as a first-class part of the tracking pipeline. When a conversion is attributed and saved, the tracker automatically pushes a matching server event to each active destination you have configured — Meta, TikTok, or Google. No SDK, no advertiser-side tag, and no custom middleware to maintain.

• Three destinations — Meta Conversions API, TikTok Events API, Google Offline Conversions
• Fires automatically — one event per saved conversion, per active destination — no code on your side
• Deduplicated — the conversion ID is used as the event ID so the platform never double-counts against the browser Pixel
• Consent-controlled identity — you choose exactly which match signals leave your platform
• Encrypted credentials — access tokens are encrypted at rest with AES-256-GCM and never rendered back in the UI

How It Works

CAPI dispatch is part of the conversion save pipeline, so latency on the visitor-facing tracking edge is never affected — delivery happens on the server, asynchronously, with retries.

Add a Destination

Open Integrations → Conversions API → Add Destination. The common fields below apply to every platform; the credential fields that follow depend on the platform you pick.

Meta Conversions API

Sends server events to your Meta Pixel / dataset via the Graph API. Create a system-user access token with the ads_management permission in Meta Events Manager → Settings.

TikTok Events API

Sends web events to TikTok Events API 2.0. Generate an access token in TikTok Events Manager for the pixel you want to feed.

Google Offline Conversions

Imports conversions into Google Ads against a click identifier (gclid / gbraid / wbraid) using the Google Ads API. This requires a developer token and an OAuth refresh token for an account with access to the target customer.

Event Mapping

Your conversions carry a goal or event token (for example sale, lead, install). The event map translates each token into the platform's event name. Use "*" as a catch-all for any token you have not mapped explicitly.

{
  "sale":   "Purchase",
  "lead":   "Lead",
  "signup": "CompleteRegistration",
  "*":      "Purchase"
}

Identity Signals (Match Keys)

Match keys are a consent allow-list. Only the signals you tick are attached to the outbound event — everything else is withheld, regardless of what the conversion carries. Leaving the list empty sends every signal that is available. Configure this to match your Data Processing Agreement and regional consent obligations.

Deduplication & Idempotency

Two layers protect you from double-counting: platform-side deduplication (between the browser Pixel and the server event) and Affclix-side idempotency (a saved conversion is never delivered twice).

Credential Security

Access tokens and OAuth secrets are encrypted at rest using AES-256-GCM. Non-secret identifiers — pixel ID, advertiser ID, customer ID — are stored in the clear so they remain searchable.

• Encrypted at rest — all credential columns use authenticated AES-256-GCM encryption
• Never rendered back — secret fields always display blank; leave them empty on edit to keep the stored value
• Tenant-isolated — every destination is hard-scoped to your workspace; cross-tenant access is not possible

Testing

Use the Test button on each destination to validate the setup before it goes live. The test runs on the server against the real platform, so your credentials are exercised end-to-end.

CAPI Delivery Report

Every delivery attempt is recorded in Reports → Delivery Logs, on the CAPI Delivery tab. Filter by date, platform, destination, and status to audit exactly what reached each ad platform.