Send Criteo conversion events from TrackLayer with OAuth2, hashed identity, and purchase safe payloads.

Request an OAuth2 token

Criteo uses the client_credentials flow. TrackLayer only needs client_id and client_secret, but both must belong to the advertiser scope that will receive the events.

POST https://api.criteo.com/oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&
client_id=YOUR_CLIENT_ID&
client_secret=YOUR_CLIENT_SECRET

Store the correct advertiser id

The conversions endpoint is advertiser scoped. Authentication can succeed while conversion writes still fail if the stored advertiser_id does not match the account context.

CRITEO_CLIENT_ID=YOUR_CLIENT_ID
CRITEO_CLIENT_SECRET=YOUR_CLIENT_SECRET
CRITEO_ADVERTISER_ID=1234567

Map canonical events to Criteo event names

Every event payload needs event_name and event_time. Keep purchase naming exact and align the string with the conversion event configured in the advertiser account.

{
  "event_name": "purchase",
  "event_time": "2026-04-24T13:14:58Z",
  "identifiers": {
    "email_sha256": "4a7d1ed414474e4033ac29ccb8653d9b2f4b1a6f6d8d1df9bca7eac191f85632"
  }
}

Send hashed identifiers and first-party IDs

There is no gclid or fbclid equivalent here. TrackLayer should normalize email to lowercase, trim whitespace, hash with SHA-256, and include customer_id or madid when available. Do not send raw email.

{
  "identifiers": {
    "email_sha256": "4a7d1ed414474e4033ac29ccb8653d9b2f4b1a6f6d8d1df9bca7eac191f85632",
    "customer_id": "cust_78421",
    "madid": "AEBE52E7-03EE-455A-B3C4-E57283966239"
  }
}

Attach transaction_data on purchase

Purchase events should carry order id, currency, value, and item lines. Missing transaction_data is one of the fastest ways to trigger a validation rejection.

POST https://api.criteo.com/2023-07/conversions
Authorization: Bearer ACCESS_TOKEN
Content-Type: application/json

{
  "data": [
    {
      "type": "Conversion",
      "attributes": {
        "advertiser_id": 1234567,
        "event_name": "purchase",
        "event_time": "2026-04-24T13:14:58Z",
        "identifiers": {
          "email_sha256": "4a7d1ed414474e4033ac29ccb8653d9b2f4b1a6f6d8d1df9bca7eac191f85632",
          "customer_id": "cust_78421"
        },
        "transaction_data": {
          "id": "PS-10428",
          "currency": "EUR",
          "value": 149.90,
          "item": [
            { "id": "SKU-BLK-42", "price": 79.95, "quantity": 1 },
            { "id": "SKU-GRN-11", "price": 69.95, "quantity": 1 }
          ]
        }
      }
    }
  ]
}

Validate in the TrackLayer dashboard

Run a controlled checkout, open the event log, and verify token acquisition, advertiser_id, hash coverage, payload shape, and the exact Criteo response before launch.

Testing flow
1. Place a test order with a real email address
2. Open TrackLayer -> Event Log -> purchase
3. Verify token refresh, identifiers, and API status
4. Compare order id, value, and currency with Criteo

401 or 403 on token exchange or conversion write

Recheck client_id, client_secret, and advertiser scope. Also confirm TrackLayer is refreshing short lived tokens instead of replaying an expired bearer token.

TrackLayer sends the event but Criteo rejects it

Start with event_name, advertiser_id, and schema shape. Rejections usually come from identifiers under the wrong object or missing transaction_data keys.

Low match quality or missing attributed conversions

Verify lowercase normalization, whitespace trimming, and SHA-256 hashing. Raw email values or inconsistent normalization will break matching.

Purchase is accepted without full revenue detail

Inspect transaction_data in the dashboard. Value must be numeric, currency must be present, and each item line should include id, quantity, and price.