Meta Conversions API for affiliates: setup and deduplication

The Meta Conversions API (CAPI) is Meta's server-to-server channel for conversion events. Your tracker or server sends a registration or deposit straight to Meta, so optimization does not depend on a browser pixel firing on a page you control. For affiliates, whose conversions happen on an operator's site, it is often the only way to report them.

This guide covers that case: you own the ad and the landing page, the operator owns the sign-up and the cashier, and the conversion reaches you as a postback.

What is the Meta Conversions API

Meta describes the Conversions API as a connection between an advertiser's marketing data and Meta's systems. The data can come from a server, a website platform, a mobile app or a CRM, and it can cover website events, app events, business messaging events and offline conversions.

It was formerly the Facebook Conversions API, and earlier still the Server-Side API. "Facebook conversion API", "conversion API Meta" and "CAPI" all refer to the same endpoint in Meta's Marketing API.

Two terms matter for setup:

• Dataset. Server events are linked to a dataset ID in Events Manager. The dataset also holds your Meta Pixel, and Meta tells you to use the same Pixel ID for browser and server events.

• Offline events. Meta lists offline conversions among the data the Conversions API carries, so the "Meta offline conversions API" is documented in the same place.

How CAPI works for affiliates

An affiliate funnel crosses two domains, and only one is yours, so your tracker relays each conversion to Meta:

1. Click. A user clicks your ad. Meta adds an fbclid parameter to the landing URL.

2. Tracker records the click. It stores its own click ID together with the fbclid, the visitor's IP address, user agent and timestamp, then passes the click ID to the operator link as a sub ID.

3. Conversion on the operator's site. The player registers and makes a first deposit. The operator records both against your sub ID.

4. Postback. The operator's system calls your tracker with the sub ID and the event type. Our guide to postback tracking explains how that call is built.

5. Tracker calls Meta. The tracker finds the stored click, converts the fbclid into the fbc value Meta expects (a fb. prefix, a subdomain index, a creation timestamp and the fbclid, joined by dots), and sends the event with its name, time, ID and user data.

6. Meta tries to match. It looks for the person who saw or clicked the ad; matched conversions show up in reporting and feed delivery.

The weak point is step 2. Meta still accepts an event from a click saved without its fbclid, but has little to match it with unless you also send contact data.

Meta Pixel vs Conversions API

The Pixel runs in the visitor's browser and reports what happens on that page. CAPI is a request your own system sends once it learns of a conversion, wherever it happened.

Meta's best-practice page recommends running the Conversions API in addition to the Pixel and sharing the same events through both. Affiliates have to adapt that, because the Pixel cannot see the events that pay.

Meta Pixel or Conversions API: which do you need?

Most iGaming affiliates need both: the Pixel for on-page behavior, CAPI for registrations and deposits. The deciding question is where the conversion is recorded.

• On the operator's site. That is most casino and sportsbook affiliate traffic. The Pixel only sees your pages, so without CAPI you optimize for click-outs, and Meta learns to find people who click rather than people who deposit.

• Mostly iPhone and Safari traffic. Browser privacy limits cut how long cookies live and how much a pixel can report, so the server signal carries more weight.

• High volume. Every missing event is signal the delivery system never gets, and delivery leans on that signal, as our guide to Meta Andromeda explains.

• A small test on a form you own. If the lead is captured in one step on your own page, the Pixel alone is enough to start. Add CAPI once the test earns a budget.

A media buyer running iGaming offers on Meta lands in the first group almost every time.

How to set up the Conversions API with a tracker

Setup with a tracker runs in four steps: dataset, connection method, events and token, then tracker settings and a test event. Events Manager screens change, so check them as you go.

1. Pick or create the dataset

You need a Meta Business Suite and a Pixel ID. In Events Manager, connect a web data source or reuse the dataset that already holds your Pixel. Connect every ad account that will optimize on these events to that dataset.

2. Choose the connection method

Meta's help center lists three routes: a partner integration, a Meta-enabled option for web events, and manual setup. Meta also offers a Conversions API Gateway, and some teams use server-side tagging, such as a server-side Google Tag Manager container.

For a tracker that receives operator postbacks, manual setup fits: the events start from postbacks, so the tracker builds the requests itself. The Gateway, hosted in a cloud account you own, receives its events from browsers through the Pixel, not from an operator's postback. A server-side tag container could accept them, but it would duplicate the tracker's job.

3. Events and access token

Select only events your postbacks can actually report. A common mapping is CompleteRegistration for a sign-up and Purchase for a first deposit.

Generate the access token in Events Manager under manual setup. Only people with developer privileges in the business see that link. Meta then creates a Conversions API app and system user for you, with no App Review. If you already run your own app, assign the Pixel to an existing system user in Business Suite and generate the token there.

Anyone holding the token can send events into your dataset. Keep it in the tracker's settings, never in page code or a shared sheet, and replace it when someone with access leaves.

4. Tracker side and test events

Enter the Pixel ID and token in the tracker's Meta integration and map each postback status to one event name. Confirm that the tracker stores fbclid, IP and user agent at click time, and sends those rather than its own server's IP.

Every event also needs action_source, which Meta marks as required; for a web funnel the usual value is website. Using the API means you agree the value is accurate to the best of your knowledge.

For website events, set event_source_url to your own landing page: Meta requires it and says it should match your verified domain, so the operator's URL does not belong there. Then send a test conversion and check in Events Manager that it arrives, is deduplicated and is matched.

Deduplication: how to avoid double-counted events

Meta counts a browser event and a server event as one conversion when the Pixel's eventID equals the server's event_id and the Pixel's event equals event_name. Around that match:

• 48-hour window. Meta deduplicates only events received within 48 hours; a later copy with the same ID counts again.

• First received wins. When the two copies do not meaningfully differ, Meta generally keeps the one it received first.

• A second method. Meta also matches on event_name plus fbp and/or external_id, used consistently on both sides. This generally works only when the browser event is sent first; a server event with no browser event in the previous 48 hours is kept.

• One source, no dedup. Meta does not deduplicate a browser-only or server-only stream. Two identical server events are both kept.

Where affiliate setups break:

1. One name, two actions. The Pixel fires Lead when a visitor clicks out to the operator, and the tracker sends Lead for registrations. Meta now learns from two different actions under one label. Give each action its own name.

2. IDs that never meet. The page creates one event_id and the tracker another. Dedup needs the same event name and the same ID on both sides; a mismatch in either leaves two events. If an action really fires in both places, generate the ID once, at the click or on the page, and pass that exact value to the Pixel and to the postback.

3. Late postbacks. Deposits are often confirmed days after the click. A postback landing after 48 hours can no longer merge with an earlier browser event, so both count. Keep deposit-level events server-only.

4. Repeated postbacks. Operators resend postbacks or send status updates for the same player. Server-only duplicates are kept, so the tracker must send each event type once per click.

5. Stale events. event_time can be at most seven days old. If one event in a request is older, Meta returns an error for the whole request and processes none of it, so send events as they arrive instead of batching a backlog.

Ads Manager counts conversions under your attribution setting, so it will never match a postback count exactly. Allowing for that, compare registrations and deposits per campaign over the same few days: a persistent surplus in Meta points to duplicates, a persistent shortfall to rejected or unmatched events. Inflated or invented events corrupt optimization and put the ad account at risk, and operators look for the same patterns, as covered in iGaming affiliate fraud.

Meta's one-click CAPI and tracker postbacks

Meta's documentation says that if you have a Pixel, you can set up the Conversions API with Meta for website events in one click, with no code, configuration or setup fees. It is built on your Pixel and covers website events only. For a store with its own checkout that is the whole funnel; for an affiliate it is the landing page, and registrations and deposits on the operator's domain still come only from tracker postbacks.

Overlap is the risk. Meta merges events only by the rules above, so a tracker event with its own event_id will not merge with a Pixel-based copy of the same action. Before switching it on next to a tracker integration, give each action one name and one shared ID, then compare the tracker with Ads Manager for a few days.

Event Match Quality

Event Match Quality (EMQ) is a score out of 10 that Meta shows per event in Events Manager. It indicates how useful the customer information on your server events is for matching, and it currently covers web events only. Meta says sending more customer information parameters may raise it, naming email, IP address, name and phone number as examples.

For an affiliate, the usable parameters are:

• fbc, built from the stored fbclid. The key most directly tied to the ad click.

• fbp, the Pixel's browser cookie, if your landing page sets it and the tracker captures it.

• IP address and user agent from the click. The user agent is required for website events.

• Email and phone, only if the operator passes them and your terms allow it.

Meta's customer information parameters page sets the handling rules. Normalize contact data (email trimmed and lowercased, phone as digits with country code), then hash it with SHA-256. IP, user agent, fbc and fbp go unhashed. Hashed contact data is still personal data, so send only what your privacy policy and program terms let you share.

Gambling ads: what CAPI does not change

Meta's Online Gambling and Games policy allows gambling and gaming ads only once the ad account has Meta's authorization. That includes ads whose landing pages promote gambling without offering it, and the policy names affiliate and aggregator sites as examples.

Advertisers request authorization in the Authorizations and Verifications tab of Meta Business Suite, with evidence that the activity is licensed or otherwise lawful where they want to target. Before first targeting a new jurisdiction, they must declare that intent. Authorized ads may not target people under 18 or the markets Meta lists as unsupported. For US campaigns, legality varies by state, as our overview of online gambling in the US shows.

Server-side tracking measures results; it does not authorize ads. This is a summary of Meta's published policy as of October 2026, not legal advice.

Pre-launch checklist

Before launch, confirm each event reaches Meta once, with click data, its own name and a shared ID:

• Every optimizing ad account is connected to the dataset.

• The token lives only in the tracker.

• Each event carries fbc, IP and user agent from the click, plus action_source.

• Each action has its own event name. Where the Pixel and the tracker both report it, they send the same name and the same event_id.

• The tracker sends one event per type per click, in real time.

• event_source_url points to your landing domain.

• A test event arrived and matched, and a regular tracker-to-Ads Manager comparison is scheduled.

FAQ

What is the Meta Conversions API (CAPI)?

The Conversions API is Meta's API for sending conversion events from your own systems, such as a server, tracker or CRM, directly to Meta. The Facebook Conversions API is the same product under its earlier name.

How do you track conversions on Meta ads without a pixel on the offer?

Your tracker stores the fbclid from each ad click, passes your click ID to the operator as a sub ID, and forwards the operator's postback to the Conversions API with the stored click data.

Can I use only CAPI without the Pixel?

CAPI works without the Pixel, and for operator-side events that is what you do anyway. Still keep the Pixel on your landing page: without it there is no fbp cookie for your server events to carry as a match key, and Meta advises running both.

Does Meta have an API, and is the Conversions API free?

Yes: the Conversions API is part of Meta's Marketing API. Meta describes the one-click option as free of setup fees. A direct integration costs whatever your tracker, server or partner tool costs.

What happens if I enable one-click CAPI on top of tracker postbacks?

One-click CAPI covers website events tied to your Pixel, not conversions on the operator's site. Double counting appears where the Pixel and the tracker report the same action under different IDs or names; align those first, then compare the tracker with Ads Manager.

What is Event Match Quality and why does it matter?

Event Match Quality is Meta's score out of 10 for how well your server events' customer data can be matched to people. Events that cannot be matched carry little weight in reporting and optimization.

Sources

• Meta, Conversions API overview

• Meta, Get started with the Conversions API

• Meta, Deduplicate Pixel and server events

• Meta, Server event parameters

• Meta, Customer information parameters

• Meta, Conversions API best practices

• Meta, Conversions API Gateway

• Meta Business Help Center, Set up and install the Meta Pixel

• Meta Transparency Center, Online Gambling and Games (checked October 28, 2026)

• Meta Business Help Center, Apply for permission to promote online gaming or gambling