How to set up the Meta Conversions API (and actually deduplicate events)

In Events Manager → select your pixel → Settings tab → scroll to "Conversions API."

Click "Generate access token." A long string appears (looks like EAAxxx...).

Copy and save it securely (1Password, etc.). This token gives anyone full event-posting rights to your pixel.

If you ever suspect the token leaked, revoke it from the same screen and generate a new one. You'll need to update wherever it's used.

For audit trails, name the token (Settings → Token Manager → rename). Examples: "Stape sGTM Production," "Shopify Channel App."

Shopify admin → Settings → Apps → Facebook & Instagram by Meta → Settings.

Scroll to "Customer Information Sharing." Confirm it is set to "Maximum."

If it shows "Standard" or "Enhanced," click to change → select "Maximum" → confirm.

Maximum enables CAPI for all standard Shopify events: PageView, ViewContent, AddToCart, InitiateCheckout, Purchase. Lower tiers disable CAPI events for some of these.

Go to Events Manager → Overview. Each event row should show a 'Server' badge alongside 'Browser.' If you only see Browser, the channel app setting did not propagate — uninstall and reinstall the channel app.

Sign up at stape.io. Free tier covers ~10k requests/month; paid plans scale linearly.

Create a new container. Stape provides a custom subdomain like data.example.com.

In Google Tag Manager → Admin → Server Container → set the URL to your Stape subdomain.

Add a "Conversions API" tag (from the template gallery, Meta-published).

Configure it: Pixel ID, Access Token (from Step 1), Event Name (use a variable that maps from the client-side event name).

Trigger: "Custom" → match on incoming client events (e.g., trigger when the incoming hit has event_name=purchase).

Make sure to pass eventID, currency, value, user data (hashed email/phone/name). These are all standard variables in the sGTM Meta template.

Publish the sGTM container. Then on your site/client-side GTM, configure your existing Meta browser pixel events to ALSO send to Stape (Conversions API → Endpoint = your Stape subdomain).

Endpoint: POST https://graph.facebook.com/v18.0/{PIXEL_ID}/events?access_token={TOKEN}

Payload: { "data": [{ "event_name": "Purchase", "event_time": unix_timestamp, "event_id": "evt_xyz", "user_data": { "em": [hashed_email], "ph": [hashed_phone], ... }, "custom_data": { "value": 99.99, "currency": "USD", "content_ids": [...], "content_type": "product" }, "action_source": "website", "event_source_url": "https://example.com/order/123" }] }

All user_data fields (em, ph, fn, ln, ct, st, zp, country) must be SHA256-hashed and lowercased before posting. Meta cannot use unhashed PII.

eventID MUST match the eventID passed in the browser pixel for the same event. Otherwise dedupe fails.

Test with the Test Event Code parameter first (Events Manager → Test Events → generate code). Send events with "test_event_code": "TEST123" in the payload. Events appear in Test Events tab without affecting production data.

Once verified, remove test_event_code from production posts.

In Events Manager → Settings → 'Event deduplication.' Status should read 'Set up.'

If it reads 'Not set up' or shows yellow warnings: at least some of your events lack matching eventIDs.

Generate eventID on the client (e.g., 'evt_' + Date.now() + '_' + random()). Pass it to the browser fbq() call as eventID. Push it to the dataLayer for server-side use. Pass it in the CAPI POST as event_id.

For Shopify channel app: dedupe is handled automatically using Shopify customer event IDs. Verify in Events Manager → the badge should appear next to events.

For Stape: in your Meta CAPI tag, the eventID field must reference {{Event Data - eventID}} (the incoming hit's eventID). Stape auto-forwards it from the client-side event.

Wait 24 hours after configuration. Check Diagnostics for any 'Duplicate event ID' or 'Missing event ID' warnings. Resolve all of them before trusting reports.

For every CAPI event, include user_data with as many fields as available: em (email), ph (phone), fn (first name), ln (last name), ct (city), st (state), zp (zip), country, external_id (customer ID).

All fields MUST be SHA256-hashed and lowercased. Most CAPI integrations (Stape, Shopify channel app) handle hashing automatically — but verify in Test Events that user_data is being sent and that the hash format is correct.

Aim for Event Match Quality (Events Manager → Diagnostics → EMQ score) of 8+/10 on Purchase events. Below 6/10 means you are leaving significant attribution unrecovered.

Best practice: collect email at the earliest funnel step possible (newsletter signup, account creation) so it's available for ALL downstream events, not just Purchase.

Events Manager → Test Events → "Test Events Tool." Generate a Test Event Code if posting directly via API, or use your browser test ID if firing via Stape/channel app.

Open your site in incognito. Trigger the event you want to test (purchase, add to cart). Within 60 seconds, the event should appear in Test Events with TWO rows: one Browser, one Server.

Click the event to expand. Verify: eventID matches between Browser and Server rows. Status reads "Deduplicated."

In the Server event, expand user_data. You should see at least em (hashed email) and ph (hashed phone). Empty user_data = Advanced Matching is broken.

After validation, monitor Diagnostics tab for 7 days. Address every warning (low EMQ, missing parameters, event delays).