Shopify Pixel + Conversions API, No Double-Counting

"Integrate social media" gets read as "add share icons." For a store that spends on paid social, the real integration is the signal pipeline — how purchase and add-to-cart events reach Meta, TikTok, and Pinterest reliably enough to train their ad algorithms. Since iOS 14.5 broke browser-only tracking, doing this well means running a browser pixel and a server-side API together, deduplicated. Here's how that actually fits on Shopify.

Why one pixel is no longer enough

The Meta Pixel fires from the browser. Apple's App Tracking Transparency, Safari's ITP, and ad blockers now drop a large share of those browser events before they reach Meta. The fix is the Conversions API (CAPI): your server sends the same events directly to Meta, bypassing the browser entirely. Run both — pixel for coverage and real-time signals, CAPI for the events the browser loses — and you recover most of the gap.

The catch: you must deduplicate

Run both without coordination and Meta counts every purchase twice — once from the pixel, once from CAPI — inflating conversions and misleading the optimizer. Meta deduplicates when both events share an event_id (and ideally event_name). The pattern: generate one id per event on the page, hand it to both paths.

// Server-side CAPI purchase (Node) — mirrors the browser pixel event
await fetch(`https://graph.facebook.com/v20.0/${PIXEL_ID}/events`, {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    data: [{
      event_name: "Purchase",
      event_time: Math.floor(Date.now() / 1000),
      event_id: order.eventId,          // SAME id the browser pixel used
      action_source: "website",
      user_data: {
        em: [sha256(order.email.trim().toLowerCase())],  // hashed PII only
        client_ip_address: req.ip,
        client_user_agent: req.headers["user-agent"],
        fbp: order.fbp, fbc: order.fbc, // pixel cookies improve matching
      },
      custom_data: { currency: order.currency, value: order.total },
    }],
    access_token: CAPI_TOKEN,
  }),
});

Two non-negotiables: all customer PII (em, phone, name) must be SHA-256 hashed before sending, and passing the pixel cookies fbp/fbc from the browser to the server dramatically improves match quality. Skip the hashing and Meta rejects the payload; skip the cookies and your match rate — and therefore attribution — collapses.

On Shopify: where each piece lives

• Browser pixel → a custom Web Pixel subscribing to standard events (the checkout is sandboxed; you can no longer edit checkout.liquid), emitting the client-side event with event_id.
• CAPI → your app/server, triggered by the orders/create webhook (verified by HMAC), sending the mirrored server event with the same event_id.
• Shopify's native Facebook & Instagram channel already offers a CAPI path — if you use it, do not also run a custom CAPI for the same events, or you're back to double-counting.

The catalog is the other half

Dynamic product ads and Instagram/Facebook Shopping need a synced product catalog, and the join key is the ID. The content_ids in your pixel/CAPI events must match the item IDs in the catalog feed (typically the variant ID or SKU). Mismatch there and Meta can fire events all day but never attribute them to a product, so dynamic retargeting silently shows nothing. Pick one ID convention (variant ID is safest on Shopify) and use it in the feed and every event.

Same shape for TikTok and Pinterest

TikTok's Events API and Pinterest's Conversions API follow the same browser-plus-server, dedup-by-event-id model. Build the server relay once with a clean event schema and fan out to each platform — don't hand-roll three divergent pixel setups in the theme.

The share button is not the integration. The integration is whether a purchase that Safari blocked still reaches Meta, exactly once, matched to the right product — that's what actually lowers cost-per-acquisition.WS24 — how we scope paid-social plumbing

Real social commerce on Shopify is an engineering problem, not a widget: one deduplicated event pipeline, hashed PII, matching catalog IDs, and server-side delivery for the events the browser can no longer be trusted to send.