What Is a Conversions API? Meta CAPI, GA4 MP and TikTok Compared

This article is the reference. It defines the term, explains how a conversions API differs from a pixel, and puts the three major APIs plus custom webhooks side by side on endpoint, authentication, deduplication key, hashing rules, required fields and freshness. If you want the argument for why server-side tracking matters, read the server-side conversion tracking guide first. This piece assumes you already agree and need the specifics.

What does "conversions API" mean?

"Conversions API" is both a product name and a generic term. Capitalised, it is Meta's product: Meta describes its Conversions API as creating a connection between an advertiser's marketing data, from a server, website platform, mobile app or CRM, and Meta's systems. Lower-cased, the industry now uses "a conversions API" for any platform endpoint that does the same job, regardless of what the vendor calls it.

That is why the same concept goes by three names. Meta calls it the Conversions API, often shortened to CAPI. Google Analytics calls its equivalent the Measurement Protocol. TikTok calls its version the Events API. mParticle, Funnel and Supermetrics all use the generic sense in their explainers, and mParticle lists Meta, Google, TikTok, Pinterest, Snapchat, Reddit and X as platforms that offer one. In this article, "conversions API" without capitals means the category, and "Meta CAPI" means the product.

How is a conversions API different from a pixel?

A pixel runs in the visitor's browser and depends on that browser's cookies, JavaScript and network. A conversions API runs on your server and depends on none of them. Everything else follows from that difference.

Four of those rows matter most in practice. First, action_source: Meta requires you to declare where the conversion happened, with allowed values of website, app, email, phone_call, chat, physical_store, system_generated, business_messaging and other. Second, the clock: the platform trusts your timestamp, which is why every API sets a freshness window. Third, cookies: a server event can be matched without any cookie because it carries hashed identifiers. Fourth, hashing: personal data must be normalised and hashed with SHA-256 before it is sent, so the platform receives a fingerprint rather than the raw value.

Meta CAPI vs GA4 Measurement Protocol vs TikTok Events API vs webhooks

The three platform APIs solve the same problem with different contracts. The table below compares them on the details that determine whether an integration works, drawn from each vendor's developer documentation as of September 2026. Webhooks are included because a custom endpoint is often the fourth destination for the same event.

Meta Conversions API

Meta CAPI is the most demanding of the three because it feeds ad delivery. You POST a JSON array of events to the pixel's events edge with an access token. Meta's documentation lets you send up to 1,000 events per request but recommends sending them promptly rather than batching; any event_time more than seven days old causes the entire request to be rejected. For website events you must also send event_source_url and client_user_agent, and Meta recommends client_ip_address and client_user_agent on every event to improve matching.

GA4 Measurement Protocol

The Measurement Protocol is an analytics ingestion endpoint, not an ad endpoint. It authenticates with an api_secret that Google says must never appear in client-side code, and it needs a client_id that matches the ID the GA4 tag generated in the browser, or reports will not stitch. Requests are capped at 25 events with 25 parameters each, and events can be backdated up to 72 hours. Google is explicit that the protocol exists to augment gtag and Tag Manager collection, and that sending events solely through it produces partial reporting.

TikTok Events API

TikTok's Events API behaves much like Meta's. You authenticate with an access token from Events Manager, identify the pixel with its pixel code, and send events with a timestamp and an event ID. External identifiers must be SHA-256 hashed, IP address and user agent are sent in the clear, and the ttclid URL parameter and _ttp cookie carry the click and browser identity. TikTok's deduplication documentation describes identical events arriving within five minutes being merged and duplicates within 48 hours being removed.

Custom webhooks

A webhook is a conversions API you define yourself. There is no platform contract: you choose the URL, the auth scheme, the payload and the retry policy. Webhooks matter because the same conversion that goes to Meta usually also needs to reach a CRM, a warehouse or a Slack alert. Treat them with the same discipline as the platform APIs: stable event IDs, server timestamps, and hashing for anything personal.

What is not a conversions API?

Three things get lumped in with conversions APIs but are different mechanisms. Knowing the difference avoids buying or building the wrong thing.

• Google Ads Enhanced Conversions is not a conversions API. Google describes it as supplementing existing conversion tags by sending SHA-256 hashed first-party data alongside the tag. The event still originates in the browser tag; enhanced conversions improves matching on it.
• Offline conversion import is not a conversions API in the sense used here. Google Ads' ConversionUploadService accepts click conversions keyed on a gclid, gbraid or wbraid with a conversion_date_time. It is a batch upload of conversions that happened off-site, not a real-time event stream from your site.
• Server-side Google Tag Manager is not a conversions API. Google describes a server container as running on infrastructure you control, receiving requests from devices, turning them into events and forwarding them. It is a router you host. Meta CAPI, GA4 MP and TikTok Events API are the destinations it routes to.
• A customer data platform is not a conversions API either. CDPs like mParticle send to conversions APIs; they are senders, not receivers.

Do I need a conversions API if I already have a pixel?

Yes, if you run meaningful spend on Meta or TikTok. Both platforms recommend running the pixel and the server API together, and both make deduplication a condition of doing so. The pixel captures click IDs and browser identity; the server event survives blockers, cookie limits and fast bounces, and carries backend data the page never sees. Together they give the platform one complete, matched conversion.

How redundant setup and deduplication work across all three

Redundant setup means sending the same event twice, once from the browser and once from the server, with a shared ID so the platform keeps one copy. The rules differ per platform, and GA4 has no rule at all.

1. 1Generate a unique event ID at the moment the conversion happens, for example the order number or a UUID minted on the server and passed to the page.
2. 2Fire the browser pixel with that ID: Meta's eventID parameter, TikTok's event_id parameter. Keep the event name identical to the server event, including case.
3. 3Send the server event with the same ID in Meta's event_id or TikTok's event_id, within the platform's window. Meta deduplicates events received within 48 hours of the first; TikTok merges identical events within five minutes and removes duplicates within 48 hours.
4. 4For GA4, do not send the same event from both the tag and the Measurement Protocol. GA4 does not deduplicate, so choose one path per event, and send server-only events such as refunds or offline qualifications through the protocol with the tag's client_id and session_id.
5. 5Verify in each platform's test tool: Meta's Test Events with test_event_code, TikTok's test event code in Events Manager, and GA4's Realtime report. Confirm one conversion per order, not two.

Meta also offers a fallback deduplication method based on fbp and external_id, but its documentation notes it only works when the browser event arrives before the server event. The event_id method is the one to design around.

What data does a conversions API send, and what should you not send?

A conversions API sends three groups of data: the event itself, the identity signals that let the platform match it to a user, and the context that lets the platform value and attribute it. Send all three, and send nothing that violates the consent the visitor gave.

What you should send

• The event: name, server timestamp, action or event source, and the page URL for website events.
• Hashed identifiers: email and phone, normalised exactly as the platform specifies (Meta: trimmed and lower-cased email; phone digits with country code and no leading zeros) and then SHA-256 hashed. Meta also accepts hashed first name, last name, city, state, postcode, country, date of birth and gender.
• Unhashed technical signals the platforms explicitly want in the clear: client IP address, client user agent, and the platform's own click and browser IDs (fbc and fbp for Meta, ttclid and _ttp for TikTok).
• Value and currency for purchase events, and an order or lead ID as external_id so the platform can tie later events to the same customer.
• The event ID used for deduplication.

What you should not send

• Raw personal data. If a field is on the platform's hash list, hash it. Sending plaintext email to Meta or TikTok is both a policy problem and a data breach waiting to happen.
• Events from visitors who declined tracking. GA4's protocol has a consent object for ad_user_data and ad_personalization; Meta has an opt_out flag that restricts an event to attribution only. Your consent tool decides; the API carries the decision.
• Sensitive categories such as health, finance or religion inferred from the page, which platforms restrict in their terms.
• Your api_secret or access token anywhere near the browser. Both Google and Meta are explicit that these are server-only credentials.

Where a first-party event stream fits

A conversions API is only as good as the event that reaches it, and the event is only as useful as the campaign context attached to it. The platforms match on identity, but your reporting needs to know which campaign, source and landing page produced the conversion. That context lives in the visit, not the conversion.

This is the case for a first-party event stream sitting between your site and the APIs. A lightweight snippet on your own domain records the visit with its UTM parameters, referrer, click IDs, device and engagement. When a conversion happens, the server already knows which visit it belongs to, so it can send Meta a well-matched event and send your own reports a fully attributed one. The alternative, reconstructing campaign context inside each ad platform, gives you three inconsistent answers. Clean parameters make this work; see how to fix UTM parameters for the hygiene that keeps the visit-to-conversion chain readable.

It also makes the redundant-setup problem tractable. If one system mints the event ID, fires the pixel with it and sends the server event with it, deduplication is a property of the pipeline rather than a coordination task between three teams.

How EndFrame exposes each conversions API as a destination

EndFrame treats each conversions API as a destination toggle on a conversion goal. Its snippet collects the first-party visit and action stream, you define a goal by event match or URL match, and you switch on the destinations that should receive it: Meta Conversions API, GA4 Measurement Protocol, TikTok Events API, or a custom webhook. EndFrame hashes identifiers before forwarding and attaches a shared event ID for browser-to-server deduplication, so there is no separate server-side GTM container to host. Each conversion keeps its campaign and source breakdown in EndFrame's reporting, and the raw visit-to-action-to-conversion chain is stored so attribution can be audited.

For clarity, here is what EndFrame does not do as of September 2026. It does not send Google Ads Enhanced Conversions or Google Ads offline conversion imports. It does not connect to Pinterest, Snapchat or LinkedIn conversion APIs. It does not act as a consent management platform, filter bots, resolve identity across devices, or accept offline conversions. If you need one of those, you still need another tool alongside it. The Free Website Tracking Audit will show which pixels a site loads today and estimate what a browser-only setup is losing; the Tracking Pixel Inspector will show what each tag is sending.

The bottom line

A conversions API is a server-side door into an ad or analytics platform: the same events a pixel sends, delivered from your server with a trusted timestamp, hashed identifiers and a shared event ID. Meta CAPI and the TikTok Events API exist to attribute and optimise ads and expect you to run them alongside the pixel with deduplication. The GA4 Measurement Protocol exists to complete an analytics dataset and expects you to avoid duplicates yourself. Get the event ID, the hashing and the freshness window right for each, keep credentials on the server, and anchor every conversion to a first-party visit so you know which campaign earned it.