Measurement Bridge guide
A reusable checklist for first-open measurement and server-side postbacks.
What it can change remotely
The Cloudflare console can register apps, enable first-open measurement, add or disable destinations on reviewed provider hosts, choose events, map fields, select GET/JSON/form delivery, require consent, and HMAC-sign requests without a mobile release.
It cannot download or execute a brand-new native SDK. Pre-approved SDK adapters must be compiled into an app release; Cloudflare may then enable and configure those adapters remotely. A new postback host needs a Worker allowlist review and deployment, but no app-store release.
Add an app and postback
- Open Conversion Relay, enter the Conversion admin token, and load configuration.
- Choose Register another app, assign its stable
app_id, and leave measurement disabled until its build is tested. - Create a destination on a reviewed provider host, enter its exact HTTPS endpoint, request format, and analytics/ads consent gate.
- Select the events and only the fields the partner contract requires.
- Keep the destination disabled, choose Preview exact plan, and compare the generated request with the partner documentation.
- Apply the reviewed plan, test against a non-production partner endpoint, then enable and apply a second reviewed plan.
- Use delivery counters and the stable event ID in the partner dashboard to verify receipt; retries retain that same ID.
Available events
| Event | Truth source |
|---|---|
install_first_open | Compiled Measurement Bridge, once per pseudonymous installation. |
sign_up_completed | Authenticated backend account completion. |
trial_started | Verified RevenueCat webhook only. |
subscription_started | Verified RevenueCat/store purchase only. |
Available fields
| Field | Use |
|---|---|
event_id, event_name, date | Stable deduplication ID, event type, and UTC occurrence time. |
amount, amount_minor, currency | Provider-confirmed commerce value in major or minor units. |
plan_name, product_id | Reviewed plan label and exact store product identifier. |
install_id, account_id_hash, app_id, platform | Pseudonymous attribution and app/platform routing. |
email_sha256 | Normalized hash; preferred where the partner supports it. |
email | Raw email only for authoritative backend events, explicit ads consent, encrypted PII configuration, and an approved partner contract. |
Background delivery contract
- Every event and destination dispatch is durable and idempotent.
- The Worker scheduler retries transient failures with a bounded attempt count and preserves the same event ID.
- Private hosts, redirects, unsafe URLs, excess response bodies, and unapproved fields fail closed.
- HMAC signing lets the receiver verify timestamped content; reveal and store each destination key as a secret.
- Disabling a destination stops new dispatches without deleting the audit history.
Operator to-do
- Document the partner endpoint, event names, required fields, consent basis, data retention, and deletion path.
- Use hashed identifiers unless a reviewed contract genuinely requires raw PII.
- Run the automated plan/form, replay, transient failure, consent, signature, app-isolation, and disable tests.
- To revert configuration, preview and apply the prior reviewed values; there is no one-click rollback endpoint.
- Run
node server/test/conversion_relay_test.mjsbefore deployment. - After deployment, confirm scheduler health and one non-production partner delivery in that partner's dashboard before enabling production delivery.