What Is the Conversions API (CAPI)? A Plain-English Explanation

Meta calls it the Conversions API. TikTok calls it the Events API. Underneath the branding it's one idea: stop trusting the browser to be the only messenger. Here it is in plain English.

Why does the Conversions API exist?

Because browser tracking stopped being reliable. A pixel is JavaScript running inside your visitor's browser, and that browser is now hostile to it: ad blockers strip the script, Safari's ITP caps script-set first-party cookies at seven days, Apple's App Tracking Transparency cut off a large share of iOS signal. When the pixel doesn't fire, the platform never learns the sale happened — even though it did, and your bank account knows it. Your server always knows.

1. Purchase happens — Order confirmed in your backend
2. Server builds event — Purchase, value, currency, timestamp
3. Identifiers hashed — Email and phone SHA-256; IP sent raw
4. Platform matches — Hashes compared to its own user records
5. Conversion credited — Tied to the ad that earned it

How does a Conversions API actually work?

Your server sends an HTTP request to the platform's endpoint. Three parts to every call:

1. The event. A name the platform recognizes (Purchase, Lead), plus timestamp, value, currency.
2. The identifiers. Email, phone, name, city, zip — hashed with SHA-256 before they leave your server, so the platform never gets raw personal data. IP and user agent go unhashed.
3. The match. The platform hashes its own user records the same way and looks for one. Find it, and your conversion ties back to the ad that earned it.

No magic. It's a database join on hashed values.

What is deduplication, and why do you need event_id?

Deduplication stops a platform counting one conversion twice when both the pixel and the CAPI report it. Most advertisers run both on purpose, so the same purchase arrives twice.

You fix it by sending the same event_id on both copies. Meta matches on event name plus event_id and keeps one. TikTok works the same way. Generate the ID once per event and share it across both paths — an order number works, a fresh random string per hit does not.

Which identifiers improve matching?

More high-quality identifiers, more matched conversions. Meta scores this on its 0–10 Event Match Quality scale. Roughly in order:

Identifier	Why it matters
Email (hashed)	Strongest single match key on nearly every platform
Phone (hashed, E.164)	Close second, especially in lead gen
Click ID (_fbc, ttclid, gclid)	Points at the exact ad click — deterministic
Browser ID (_fbp)	Ties the server event to the browser session
IP, user agent, name, city, zip	Weak alone, but they lift match rate at the margin

The catch: your server only knows the click ID and browser cookie if you captured them at click time and carried them to checkout. Most broken CAPI setups aren't broken at the API — nobody stored _fbc and _fbp when the visitor landed.

What does a Conversions API not do?

• It isn't a conversion multiplier. CAPI recovers conversions that happened but went unreported. If reported numbers jump past what your back office shows, that's a dedup problem, not a win.
• It doesn't replace consent. Sending from a server changes the transport, not your legal basis. In the EEA, no consent still means no marketing data.
• It doesn't fix bad event design. If Purchase fires on page load or sends the wrong value, CAPI delivers that garbage more reliably.

What's it called on each platform?

Platform	Name
Meta	Conversions API
TikTok	Events API
Google Ads	Enhanced Conversions and offline conversion imports
GA4	Measurement Protocol
Snapchat, Pinterest, Reddit, LinkedIn	Conversions API

Do you actually need one?

You need a CAPI if the platform's algorithm optimizes on your conversion events and a meaningful chunk of your audience sits on iOS, Safari, or an ad blocker. That's most eCommerce and lead-gen advertisers now. If missing conversions would change which campaigns you keep running, it pays for itself. Compare last month's platform-reported conversions to your actual orders. That gap is what you're buying back.

One-click integration	Server-side GTM	Custom code
Shopify app, WooCommerce plugin	One container on your own subdomain	Developers call the API directly
Zero code, fast to enable	Fans events out to every platform	Maximum control
You get the vendor's payload	You control what each payload carries	Maintenance on every spec change
Often ships order data only	Dedup handled once, not five times

What are the three ways to set it up?

1. Platform-native, one click. Shopify's Meta app, a WooCommerce plugin, Meta's Conversions API Gateway. Fast, zero code, and you get whatever payload the vendor chose to send.
2. Server-side Google Tag Manager (sGTM). One container on your own subdomain takes events and fans them out to every platform. More setup, far more control.
3. Custom code. Developers call the API from your backend. Maximum control, plus maintenance every time a platform changes its spec.

The honest trade-off: one-click gets a green checkmark, not good data. Custom code gets good data and a permanent engineering chore. sGTM sits in the middle. That's what I build on.

Layer	What sits there
Inputs	Click ID at landing page (_fbc), Browser cookie (_fbp), Backend order record, Hashed email and phone
data.yourstore.com	Builds one event, stamps a shared event_id, applies consent before anything leaves
Destinations	Meta Conversions API, TikTok Events API, Google Ads Enhanced Conversions, GA4 Measurement Protocol

Why does first-party server-side tracking make CAPI worth having?

Quick definition, since most people have never heard the phrase. Server-side tracking means data goes to a server you control — on your own subdomain, like data.yourstore.com — before anywhere else. "First-party" means the request looks like your site talking to itself, because it is.

That matters because a CAPI call is only as good as what you feed it, and the two things that lift match quality most — the ad click ID and the browser cookie — are exactly what a blocked or capped browser script loses. A first-party container captures them on the landing page, sets cookies from your own domain, and holds them through checkout. The purchase then leaves with email, phone, click ID, and browser ID attached instead of an IP address and a shrug.

Three payoffs. Higher match rates, so platforms optimize on real buyers and your cost per acquisition drops. One source of truth feeding Meta, TikTok, Google, and GA4, so numbers agree and dedup is handled once instead of five times. And control over what leaves your server, per consent state, so you stay compliant without going blind.

Frequently asked questions

Is the Conversions API the same as server-side tracking?

No. CAPI is the destination — the platform endpoint that accepts server events. Server-side tracking is how you collect and process events before sending them. One server container can feed many CAPIs.

Do I still need the pixel if I have CAPI?

Yes. Meta and TikTok both recommend browser and server together. The browser catches what the server can't see, the server catches what the browser loses, and event_id dedup keeps the count honest.

Does CAPI bypass ad blockers and iOS privacy limits?

Partly. The server call can't be blocked by a browser extension. But if the blocker stopped you capturing identifiers in the first place, the event arrives with weak matching data. First-party collection closes that half.

How do I know if my CAPI is working?

In Events Manager, check three things: are server events arriving, what's the Event Match Quality score, and how much is deduplicated against browser events. Then compare reported purchases to real orders.

What is event_id used for?

It's the shared key that lets a platform recognize the browser copy and server copy of one conversion as the same event and count it once. An order ID works well. Send the identical value on both paths.