Current boundary: the generic HTTPS relay can configure code-approved receivers. Direct Meta, TikTok, and Google adapters are not active yet because they still need provider-specific authentication, payload mapping, authoritative ads consent, and sandbox tests. Never place an access token in a destination URL. A completely new native SDK must still be compiled, reviewed, and released through Apple or Google.

Operator to-do

  1. Open the Conversion Relay and connect with the Conversion admin token.
  2. Register the app and leave first-open measurement disabled until its app build is tested.
  3. Create a generic destination only after its receiver host has been reviewed in Worker code; choose an exact credential-free HTTPS URL, request format, consent gate, and HMAC signing.
  4. Select install_first_open, sign_up_completed, trial_started, and/or subscription_started.
  5. Map only the required fields: event ID/name, date, amount/minor amount, currency, plan/product, install/account hashes, platform/app ID, and approved email representation.
  6. Preview the exact outbound request with the destination disabled; verify it against a non-production receiver.
  7. Apply, test retries and signature verification, then explicitly enable with a second reviewed plan.
  8. Monitor delivery counters and the stable event ID at the receiver; disable immediately if consent, mapping, or attribution is wrong.

Truth and privacy rules

  • First-open comes once from the compiled bridge; signup comes from authenticated account completion.
  • Trials and paid starts come only from verified RevenueCat/store events.
  • Unpanic currently emits these canonical events with advertising delivery denied. A client-supplied ads_allowed value is not sufficient for a production advertising integration; use server-owned consent and attestation.
  • email_sha256 is preferred; raw email requires authoritative backend origin, explicit ads consent, encrypted PII configuration, and an approved partner contract.
  • Stable event IDs make retries idempotent. Private or unreviewed hosts, unsafe redirects, malformed maps, and excess payloads fail closed.

Background delivery

The Cloudflare scheduler claims durable dispatch rows, sends bounded signed requests, retries transient failures, preserves the same event ID, and records terminal delivery status. Disabling a destination stops new dispatches without erasing audit history.

Required tests

Run node server/test/conversion_relay_test.mjs. It covers JSON/form planning, duplicate intake, transient retry, HMAC verification, consent denial, app isolation, and host rejection. V1 has no one-click rollback, manual replay, scoped deletion, or provider readback endpoint. To revert, preview and apply known prior values. Confirm one non-production delivery at the receiver before enabling production traffic.