The OpenAI Conversions API: Server-Side Tracking for ChatGPT Ads

The OpenAI pixel sees only what the browser lets it see. The OpenAI Conversions API is the other half: your server reports conversions directly to OpenAI, immune to ad blockers, able to log the deal that closes three weeks after the click. Here is the full technical picture: endpoint, auth, batching, user matching, and the dedup rules that let both halves run together.

What the Conversions API is, in one paragraph

OpenAI's measurement stack for ChatGPT ads has two halves. The client half is the pixel, oaiq.min.js, which fires from the shopper's browser; we cover it end to end in our OpenAI pixel guide. The server half is the Conversions API: your backend sends conversion events straight to OpenAI over HTTPS, no browser involved (OpenAI developer docs, 2026). Same events, same conversion definitions in Ads Manager, different transport. The pixel is a five-minute install; the API is an engineering task that pays off exactly where the pixel goes blind.

When the pixel alone is not enough

Ad blockers strip the pixel. A script loaded from an ad domain in the shopper's browser is exactly what blockers exist to kill. Your server, reporting after the fact, is untouchable. Every blocked pixel fire is a conversion your campaign paid for and never got credit for, and undercounted campaigns look more expensive than they are. That distortion compounds the attribution gaps we map in dark agentic commerce traffic.

Long sales cycles convert off-browser. A lead that clicks a ChatGPT ad today and signs a contract in week three does not convert on a thank-you page. The purchase lives in your CRM or billing system. Server-side events let you report it when it lands, as long as the timestamp falls inside the API's 7-day event window and your conversion window (30 days by default) still covers the click.

Conversion-optimized CPC is only as good as its data. OpenAI's conversion-optimized bidding steers delivery toward your selected conversion event while still charging per click (OpenAI Help Center, article 20001210). Feed it only the conversions the pixel happens to catch and it optimizes toward a distorted picture. The API closes the gap.

Endpoint, auth, and the API key

The API is one endpoint:

POST https://bzr.openai.com/v1/events?pid=<PIXEL-ID>
Authorization: Bearer <API-KEY>
Content-Type: application/json

The pid parameter is your pixel ID, the same one baked into your on-site snippet. The bearer key is created inside Ads Manager: open Conversions, click the key icon, then Create new key (OpenAI developer docs, 2026). Treat it like any production credential: server-side only, never in the browser.

Two hard limits shape your sending logic. A single request carries up to 1,000 events, so high-volume senders batch rather than fire per-event. And every event timestamp must fall within the last 7 days; anything older is rejected, which makes the API a near-real-time reporting channel, not a historical backfill tool.

Event types: what you can send

The API accepts the same standard events as the pixel: order_created, checkout_started, lead_created, registration_completed, subscription_created, trial_started, and custom for anything that does not fit (OpenAI developer docs, 2026). Two are API-only: app_installed and app_opened, which makes the Conversions API the only route to conversion tracking for mobile apps, where there is no web pixel to fire.

Pick the event that matches the moment. An ecommerce order is order_created with a value and currency; a demo request is lead_created; a new paid plan is subscription_created. The event you link to a campaign is the one conversion-optimized CPC bids toward, so choose the one closest to revenue that fires often enough to learn from.

User matching: hashes and the oppref click ID

A server event arrives with no browser context, so OpenAI needs identifiers to tie it back to the ad click. Two mechanisms do the work.

Hashed identifiers. You send the customer's email and phone number hashed with SHA-256. Normalize before hashing (lowercase and trim emails, strip phone formatting), because a hash of a differently formatted string matches nothing.

The oppref click ID. When a shopper clicks a ChatGPT ad, the landing page URL carries an oppref parameter, and the pixel stores it in the __oppref cookie. This is the strongest join key there is, and the part teams get wrong: the Conversions API does not capture oppref automatically (OpenAI developer docs, 2026). Your server has to pass it explicitly. That means capturing the parameter at landing, or reading the __oppref cookie, then persisting it on the session, the lead record, or the order, so it is still attached when the conversion event finally fires days later. Skip this plumbing and your server events lean entirely on hash matching, which is weaker on its own.

Send both. Redundant identifiers raise match rates, and unmatched events are spend you cannot attribute.

Deduplication: running pixel and API together

The recommended architecture is both halves at once: pixel for immediacy, API for completeness. What keeps the two from double-counting is the event_id. Give the same conversion the same event_id in both the pixel fire and the server event, and OpenAI counts it once: first arrival wins, and the duplicate is discarded (OpenAI developer docs, 2026).

The practical pattern: generate a unique ID per conversion (an order number works), pass it to the pixel on the confirmation page, and send the identical ID in the server event. Skip the shared ID and every conversion the pixel catches gets counted twice once your server reports it, which quietly inflates results and misleads both you and the bidding system.

Testing with validate_only

Before production traffic, set the validate_only flag on your requests. OpenAI validates the payload, returns any errors, and records nothing (OpenAI developer docs, 2026). Use it to check hashing, timestamps, event structure, and the oppref field without polluting your reporting. Flip it off only after a clean run, then watch the Conversions section of Ads Manager to confirm events land and dedup behaves. The wider setup, from creating the conversion definition to linking it to a campaign, is step by step in our conversion tracking walkthrough, and the campaign build itself is in our setup guide.

Where Tru Commerce fits

The Conversions API tells you exactly what the paid layer of ChatGPT delivers. But ads are one of two layers. Sponsored placements are bought and labelled, and they rent the conversation for as long as the budget runs. AI-referred visits to US retail sites converted at a rate 60% higher than non-AI traffic in July 2026, the eleventh straight month ahead (Adobe Analytics, via Digital Commerce 360, 19 August 2026). As our founder put it in The Hindu BusinessLine (Aug 28, 2026), "Brands cannot buy influence over ChatGPT's answers."

So before you invest engineering time in server-side tracking, find out where you stand on the earned layer. Run the free Citation Rank scan: it shows how ChatGPT, Gemini, and Perplexity rank your brand today, with results in 24 hours. And for everything on the paid side in one place, start at our ChatGPT Ads hub.

We saw this firsthand with MyMuse, where GA4 reported ₹11.5K/mo of AI revenue and the real number was ₹81.2K/mo - a 7× gap - read the MyMuse case study. The usual first step is Visibility Score.