Preserving _fbp, _fbc, and fbclid through server-side Meta attribution

The identity envelope Meta receives

The failure modes that lower attribution

• The landing page captures fbclid in the URL but never persists it before the user leaves for checkout.
• The Pixel writes _fbc after consent, but the server-side Purchase only reads cookies at webhook time, where no browser cookies exist.
• Stripe, Paddle, Shopify, or an app-store flow redirects the user, and the final purchase webhook has no event_source_url from the original landing context.
• CAPI receives Purchase with value and currency but no fbp, fbc, external_id, client_ip_address, or client_user_agent, so the event arrives but matches weakly.
• A new anonymous ID is minted on the pricing page and another one on the checkout success page, splitting a single visitor into multiple identities.

A server-side identity envelope should look like this

The exact storage layer does not matter. The invariant is that every checkout session and every webhook can recover the same click and visitor fields.

type MetaIdentityEnvelope = {
  visitorId: string;          // first-party anonymous ID, stable pre-login
  sessionId: string;          // landing/session scope, not a replacement for visitorId
  fbp?: string;               // fb.1.<creation_ms>.<random>
  fbc?: string;               // fb.1.<creation_ms>.<fbclid>
  fbclid?: string;            // raw click ID, stored only to reconstruct fbc if needed
  landingUrl: string;         // canonical event_source_url for server events
  userAgent?: string;
  ipAddress?: string;
  consentState: "granted" | "denied" | "unknown";
};

Fallback _fbc construction

When the URL contained fbclid but the _fbc cookie is missing, reconstructing fbc server-side is better than dropping click identity completely.

function fbcFromFbclid(fbclid: string, createdAtMs = Date.now()) {
  return `fb.1.${createdAtMs}.${fbclid}`;
}

const fbc =
  request.cookies.get("_fbc")?.value ??
  (landingSession.fbclid ? fbcFromFbclid(landingSession.fbclid, landingSession.createdAtMs) : undefined);

Implementation sequence

1. 1On first page view, parse fbclid, utm parameters, referrer, and the canonical landing URL before any checkout redirect can erase them.
2. 2Persist a first-party visitor ID and landing session in a same-site cookie or server session keyed by a signed cookie.
3. 3After consent, let Pixel write _fbp and _fbc, but do not depend on Pixel timing as the only source of click identity.
4. 4Attach the visitor/session key to checkout metadata, subscription customer metadata, or your own order row.
5. 5When the verified Purchase webhook fires, rebuild user_data from the stored envelope, not from the webhook provider's request context.