Server-to-Server Integration

POST https://b.adverfly.com/e
Content-Type: application/json

The same endpoint the browser pixel uses. One event per request, sent in real time: events are timestamped when they arrive, so a batch sent hours later lands on the wrong day and outside its session.

Create a server-side key in Adverfly under Data Exports → Server-side keys and send it with every S2S request:

X-Adverfly-Key: adv_s2s_…

• Once your workspace has a key, every request with is_s2s: true without a valid key is rejected with 401. Without any key, S2S requests are accepted as before.
• The key is shown once when you create it; Adverfly stores only a SHA-256 hash of it. Authorization: Bearer <key> is accepted as well.
• Rotation: two keys can be active at once. Create the new key, switch your server over, then revoke the old one. Changes take effect within a minute.
• Keep the key on your server only — never in an app bundle or a website. The browser pixel uses the same endpoint without a key, so the key authenticates your server-side events, not every event of the workspace.

An array of plain-text strings. Send every stable identifier you have; several of the same kind are fine. Adverfly hashes each key (SHA-256) before storage.

• Stitching is automatic: when one request carries a key we already know, every other key in that request is linked to the same visitor. After login, send the install ID and the customer ID together once.
• A key stays linked to its visitor for 28 days, and the link is reset after a purchase — the same as for the browser pixel.

Send the click IDs you have as properties on every event. They are forwarded to the ad platforms from there.

{
  "properties": {
    "_fbc": "fb.1.1727600000000.IwAR2xYz...",
    "_fbp": "fb.1.1727600000000.123456789",
    "gclid": "Cj0KCQjw9...",
    "gbraid": "0AAAAADx...",
    "wbraid": "CjkKEQjw...",
    "ttclid": "E.C.P.CqgBkTg...",
    "msclkid": "1a2b3c4d5e6f7a8b9c0d...",
    "sclid": "7f3e2a1b-...",
    "epik": "dj0yJnU9...",
    "tblci": "GiDk3m...",
    "obclid": "00a1b2c3..."
  }
}

• Matching with your order sync: the purchase event is joined to the synced order on transaction_id. The synced order provides the money (totals, shipping, tax, refunds), the event provides the attribution. That only works when both carry the same ID.
• One purchase per order: a second purchase with an ID we already have is answered with 400 Transaction ID already exists — for example when the web checkout pixel already reported that order. Treat it as success and do not retry.
• A purchase without transaction_id gets a random ID and can never be matched to an order.

{
  "store_id": 123456,
  "is_s2s": true,
  "ip": "185.32.100.42",
  "event_type": "event",
  "name": "pageview",
  "hostname": "app.myshop.com",
  "pathname": "/products/sneakers",
  "store_currency": "EUR",
  "store_timezone": "Europe/Berlin",
  "keys": [
    "app:3f9c2e1a-7b4d-4c8e-9a1f-2d6b8e0c4a7f",
    "cus:gid://shopify/Customer/7234567890123"
  ],
  "parameters": "?utm_source=facebook&utm_campaign=autumn&fbclid=IwAR2xYz...",
  "properties": {
    "_fbc": "fb.1.1727600000000.IwAR2xYz...",
    "platform": "ios",
    "app_version": "3.4.0"
  }
}

{
  "store_id": 123456,
  "is_s2s": true,
  "ip": "185.32.100.42",
  "event_type": "event",
  "name": "add_to_cart",
  "hostname": "app.myshop.com",
  "pathname": "/products/sneakers",
  "store_currency": "EUR",
  "store_timezone": "Europe/Berlin",
  "keys": [
    "app:3f9c2e1a-7b4d-4c8e-9a1f-2d6b8e0c4a7f"
  ],
  "properties": {
    "_fbc": "fb.1.1727600000000.IwAR2xYz..."
  }
}

{
  "store_id": 123456,
  "is_s2s": true,
  "ip": "185.32.100.42",
  "event_type": "conversion",
  "name": "purchase",
  "hostname": "app.myshop.com",
  "pathname": "/checkout/thank-you",
  "store_currency": "EUR",
  "store_timezone": "Europe/Berlin",
  "keys": [
    "app:3f9c2e1a-7b4d-4c8e-9a1f-2d6b8e0c4a7f",
    "cus:gid://shopify/Customer/7234567890123"
  ],
  "transaction_id": "6123456789012",
  "transaction_currency": "EUR",
  "transaction_gross_revenue": 9900,
  "customer_id": "customer@email.com",
  "transaction_items": [
    {
      "transaction_item_id": "SKU-001",
      "transaction_item_name": "Sneaker",
      "transaction_item_price": 4950,
      "transaction_item_quantity": 2
    }
  ],
  "properties": {
    "_fbc": "fb.1.1727600000000.IwAR2xYz..."
  }
}

Adverfly does not check consent server-side; sending an event means you have the legal basis for it. Apply the same rule as for your website tracking. Click IDs and anything that is forwarded to ad platforms typically require marketing consent.