# Meta server events

Open Connections → Meta, enter the Pixel ID, enable Send events from your server too, paste an access token and select Save changes. Settings and credentials use separate protected requests; a partial failure is reported and the replacement draft is retained. An empty replacement field preserves the existing token. The status view returns a fixed mask only. Test codes are effective for 24 hours. An explicit test-event action requires an active test code and shows a redacted response.

The browser sends the same cryptographic UUID to `fbq` and the site's public `/pixelpair/v1/event` endpoint. The endpoint accepts same-origin POSTs with a bounded schema, configured event allow-list, bot/exclusion checks, a separate 60/minute/IP rate budget, and current marketing consent. WordPress's signed logged-in cookie is independently verified because core resets cookie authentication for nonce-free REST requests. No cached nonce or browser-provided user identity is used. A client can misreport its own consent, but cannot choose another visitor's identity or the server destination.

Matching details are collected only after consent and eligibility. Standard fields are normalized then SHA-256 hashed. Country codes must be ISO-2; phone numbers must include their country calling code and cannot start with a local trunk zero. No country is guessed. A missing `_fbp` is created; `_fbc` is created only with a valid fbclid. These identifiers and a random visitor identifier expire after 90 days. The random visitor cookie is HttpOnly. Logged-in external IDs use the local user ID, hashed before sending. Unknown profile fields are omitted; trusted integrations can supply raw fields with `pixelpair_user_data`.

Advanced matching is off by default. When enabled it also performs a consented, uncached, same-origin identity request for browser matching hashes; this optional request is separate from default fast-mode eligibility. Names/email/phone are never embedded in cached HTML. Tokens and matching data are encrypted using AES-256-GCM with a key derived from WordPress AUTH_KEY and SECURE_AUTH_SALT plus the site ID. Rotating keys invalidates stored ciphertext; re-enter credentials after rotation. There is no insecure encryption fallback.

The queue stores encrypted event payloads in a site-specific table. Scheduler arguments contain only job IDs. A unique event key prevents repeated collector submissions from creating multiple jobs; a conditional SQL lease prevents simultaneous workers claiming the same attempt. Action Scheduler is used when installed. Otherwise WP-Cron plus core's nonblocking cron loopback handles delivery; when DISABLE_WP_CRON is enabled the site must run cron externally. An hourly sweep recovers missed callbacks/expired leases. Transient/network failures receive up to three retries at 60, 300 and 900 seconds. Meta receives the original event ID on every attempt. Disabling CAPI, changing the Pixel ID, or a current server consent veto cancels queued work. Already accepted events cannot be retracted by a later browser action. Meta deduplication is still needed if a worker dies after remote receipt.

Queued payloads are cleared on terminal outcomes, and replay records expire after seven days. Logging is off by default. When enabled, logs contain event/status/HTTP code and allow-listed redacted request/response metadata only, with a 1–90 day retention setting. The log screen supports status filtering, paging, CSV export of the current page and confirmed clearing. No full token, IP, email, matching hash or raw vendor error message is logged. Lifecycle cleanup respects each site's uninstall-retention setting.

The sensitive-context setting removes context parameters and URL paths/query strings from PixelPair's server event payload. It does not control the page URL independently collected by Meta's browser SDK. Limited Data Use adds Meta's documented processing options. Forwarded IP headers remain ignored unless the owner explicitly enables proxy trust; only enable it where a trusted proxy replaces X-Forwarded-For on every request and direct origin access is blocked.

## Protocol references and verification

- [Meta SDK API configuration](https://github.com/facebook/facebook-python-business-sdk/blob/main/facebook_business/apiconfig.py): Graph API v26.0 verified on 2026-10-01 and centralized in `Config::GRAPH_VERSION`.
- [Meta server event fields](https://github.com/facebook/facebook-python-business-sdk/blob/main/facebook_business/adobjects/serverside/event.py): event ID/time/source, website action source, referrer and data-processing fields.
- [Meta matching fields](https://github.com/facebook/facebook-python-business-sdk/blob/main/facebook_business/adobjects/serverside/user_data.py): matching hashes versus browser identifiers/IP/user-agent.

Automated tests intercept the HTTP transport and browser SDK. They establish payload shape, local ID sharing and retry behavior, not live platform acceptance. A real token/Pixel ID, Meta Events Manager Test Events and browser Pixel Helper are still required to verify receipt and live deduplication. No real tracking events are sent by the test suite.