Conversion APIs Explained: Sending Conversions Back to Ad Platforms

Why platforms ask for server events

Ad platforms optimise bids on the conversions they can see. A browser pixel misses a growing share of them: blocked scripts, short cookie lifetimes, in-app browsers and conversions that happen days later on a network's domain where your pixel never loads. A Conversion API (CAPI) is the server-side alternative: your system tells the platform about a conversion directly, over HTTPS.

For affiliate traffic this matters even more, because the conversion often happens on a page you do not control. The only reliable signal you have is the postback that reaches your tracker. Forwarding that signal to the ad platform closes the loop.

What a conversion event contains

The exact fields differ by platform, but every event has the same building blocks:

• Event name: lead, purchase, registration, or a custom name the platform knows.
• Event time: when the conversion happened, not when you send it.
• Click identifier: the platform's own click ID captured on the first click, such as gclid, fbclid or ttclid.
• Value and currency, if you optimise on value.
• An event ID so the platform can drop duplicates.

From postback to ad platform

1. The visitor clicks the ad. The platform appends its click ID to your URL.
2. The tracker stores that click ID with the click, next to its own click ID.
3. The network sends a postback with the tracker's click ID when the visitor converts.
4. The tracker finds the click, takes the platform's click ID from it and sends the event to the platform's Conversion API.
5. The platform attributes the conversion to the ad and uses it for bidding.

XPNSR Tracker supports eight conversion APIs and keeps a retry queue, so a platform outage does not lose events. Whatever you use, make sure failed sends are retried and visible, not silently dropped.

Match quality and deduplication

Platforms grade how well they can match your events to their users. A click ID gives the best match. Without one, some platforms accept hashed identifiers such as an email address, but only if you have the right to share them.

If you also run a browser pixel, send the same event ID from both sides. The platform keeps one and drops the other. Without a shared ID you double count and the bidding algorithm overpays.

Consent and privacy

• Send only what the platform needs to attribute the conversion. A click ID and a timestamp are often enough.
• Respect consent signals from your landing pages. In regions that require consent, do not forward events for visitors who refused it.
• Never send raw personal data. Platforms that accept identifiers expect them normalised and hashed.
• Keep a record of what is sent where, so you can answer a deletion request.