Meta Conversions API (CAPI) Parameters & Events Checklist: The 2026 Developer Guide
Developer & Integration · 12 min read · November 2026
Complete checklist of Meta Conversions API (CAPI) events and user_data parameters. Master SHA-256 hashing requirements for em, ph, fbc, fbp, client_ip, external_id, and how to verify 9.3+ Event Match Quality (EMQ).
Why Meta Conversions API (CAPI) Parameter Completeness Matters
When implementing Meta Conversions API (CAPI) on Shopify, simply firing a server event is not enough. If your payload lacks crucial User Data Parameters (such as em, ph, fbc, fbp, or external_id), Meta’s matching engine cannot associate the conversion with a real Facebook/Instagram profile.
The direct result: Your Event Match Quality (EMQ) drops to 4.0–6.0/10, your cost per acquisition (CPA) spikes by 30%, and Meta Advantage+ campaigns fail to optimize.
This guide provides the complete 2026 engineering checklist of Meta CAPI standard events, required user parameters, SHA-256 hashing protocols, and server-side verification steps.
The 13 Essential Meta CAPI user_data Parameters
To achieve an industry-leading 9.3+ EMQ score, your server-side payload should provide as many of the following 13 customer parameters as possible:
Parameter Key — Parameter Name — Hashing Protocol — Example Formatted Value
em — Customer Email — SHA-256 (lowercase, trimmed) — 7b2...cf8
ph — Phone Number — SHA-256 (E.164 without '+' or symbols) — 14155552671 → 9a4...de1
fbc — Click ID Token — Do NOT Hash (Raw Cookie String) — fb.1.1668273600.IwAR1...
fbp — Browser ID Token — Do NOT Hash (Raw Cookie String) — fb.1.1668273600.123456789
client_ip_address — Visitor Public IP — Do NOT Hash (IPv4 or IPv6 string) — 198.51.100.42
client_user_agent — Browser User Agent — Do NOT Hash (Raw header string) — Mozilla/5.0 (iPhone; CPU OS...)
fn — First Name — SHA-256 (lowercase, stripped punctuation) — john → 4a9...11c
ln — Last Name — SHA-256 (lowercase, stripped punctuation) — smith → a12...99b
ct — City — SHA-256 (lowercase, stripped spaces) — losangeles → c52...ff4
st — State / Province — SHA-256 (lowercase 2-letter code) — ca → 6b2...ee3
zp — Postal / Zip Code — SHA-256 (lowercase, first 5 digits/standard) — 90210 → 3f1...88c
country — ISO Country Code — SHA-256 (lowercase 2-letter ISO 3166-1) — us → 2a3...dd2
external_id — Shopify Customer ID — SHA-256 (Unique internal ID) — shopify_cust_847192 → 8e4...
7 Standard E-Commerce Events & Recommended Payload Structures
1. Full Purchase Payload Example (JSON)
```json
{
"data": [
{
"event_name": "Purchase",
"event_time": 1730764800,
"event_id": "shopify_order_104829_purchase",
"event_source_url": "https://yourstore.com/checkout/thank_you",
"action_source": "website",
"user_data": {
"em": ["f660ab912ec121d1b1e928a0bb4bc61b15f5ad44d5efdc4e1c92a25e99b8e44a"],
"ph": ["9a4d87210e3954f9a0a09e07583692aa03a08b3e8e1694f4a648b26f56f890cf"],
"client_ip_address": "198.51.100.42",
"client_user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_4...",
"fbc": "fb.1.1730764000.IwAR0exampleClickToken",
"fbp": "fb.1.1730764000.9876543210",
"country": ["2a3..."],
"zp": ["3f1..."]
},
"custom_data": {
"currency": "USD",
"value": 128.50,
"content_type": "product",
"contents": [
{
"id": "SKU-94812",
"quantity": 2,
"item_price": 64.25
}
],
"order_id": "104829"
}
}
]
}
```
3 Critical Pitfalls to Avoid in Meta CAPI Implementations
1. Inconsistent event_id Between Browser and Server
If your browser pixel sends event_id: "order_104829" but your server CAPI payload sends event_id: "shopify_webhook_104829", Meta cannot deduplicate them. Meta will count 2 purchase conversions for a single customer order, creating artificially high ROAS. Review our complete Meta CAPI Deduplication Guide.
2. Failure to Capture _fbc on Shopify Checkout Pages
Meta's click ID (fbclid) is present only on the initial landing page URL. Once a visitor navigates through product and cart pages, Shopify strips the URL parameters. Without a first-party DNS proxy to store _fbc in a server-accessible cookie, your server webhook will fire without the single most valuable matching token.
3. Raw Plaintext Leaks in Customer Data
Sending unhashed email or phone strings directly over the API triggers immediate Meta Events Manager compliance warnings and risks account throttling. All PII must pass through SHA-256 before transit.
Why DTC Brands Choose GotTracked Over Manual Custom Coding
Manually formatting, hashing, and debugging CAPI webhooks across Shopify theme updates is an expensive maintenance headache. GotTracked delivers:
- Automatic SHA-256 PII Sanitization: Real-time irreversible hashing in full GDPR and ATT compliance.
- First-Party DNS Proxy Persistence: Captures
_fbc and _fbp under your own root domain to withstand Safari ITP restrictions.
- Deterministic Event Deduplication: Synchronizes
event_id natively across all checkout steps to guarantee 9.3+ EMQ.
Frequently Asked Questions (FAQ)
What user parameters are required for Meta Conversions API?
While technically an event will fire with just an IP address or User Agent, Meta requires at least one hashed identifier (email or phone) plus client_ip_address and client_user_agent to achieve acceptable match rates. Passing _fbc (click ID) and _fbp (browser ID) elevates your EMQ to the highest 9.0+ tier.
Does the Meta CAPI click ID (fbc) need to be hashed?
No. The fbc and fbp tokens, along with client_ip_address and client_user_agent, must be sent as raw plaintext strings. Only personal identifying information (PII) like email (em), phone (ph), name, and address must be SHA-256 hashed.
How do I check if my Meta Conversions API is working properly?
In Meta Events Manager, navigate to your Pixel > Overview > Data Sources. Look for events with the connection method marked as "Browser • Server". Verify that the Event Match Quality (EMQ) score is at least 8.0/10 and that the deduplication rate matches 100%.
Try the Free Shopify ROAS & Ad Tracking Loss Calculator | Explore GotTracked Server-Side CAPI | View All Attribution Guides