# Meta Pixel Capi

> Fail-closed Meta Pixel + Conversions API orchestration for Next.js, React, Shopify, WordPress, GoHighLevel, ClickFunnels, Webflow, and static HTML with strict source and security validation.

- Skill: `rileyvibecodes/meta-pixel-capi` (Agent Skill, multi-file: 38 files)
- Install (CLI): `npx skillmds@latest add rileyvibecodes/meta-pixel-capi`
- Raw SKILL.md: https://api.skillmd.com/api/skills/rileyvibecodes/meta-pixel-capi/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: rileyvibecodes (https://skillmd.com/u/rileyvibecodes)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/rileyvibecodes/meta-pixel-capi

---


# Meta Pixel + CAPI Orchestrator (Fail-Closed)

Use this skill to produce implementation guidance only when source integrity, platform coverage,
and security conditions are satisfied.

## Purpose

- Standardize Meta Pixel + CAPI setup across Tier-1 platforms.
- Prevent insecure or unverifiable guidance.
- Guarantee deterministic response structure.

## Non-Negotiables

- Fail closed if required source IDs are stale, missing, or unverified.
- Never output full secrets, tokens, private keys, or live credentials.
- Never provide wildcard CORS configuration.
- Use canonical Graph API major version from `manifests/source-registry.json`.
- Include explicit fallback for unsupported stacks using `references/core/unsupported-fallback.md`.

## Execution Flow

1. Run source integrity check using `manifests/source-registry.json` and `manifests/rule-registry.json`.
2. Detect platform and map to `manifests/platform-matrix.json`.
3. Load required reference files only.
4. Apply platform-specific implementation steps.
5. Return output in the exact response contract order.
6. If any required input or source is unresolved, stop and return failure handling output only.

## Deterministic Output Contract

Always return sections in this exact order:

1. Detection
2. Required Inputs
3. Implementation
4. Verification
5. Failure Handling
6. Security Notes
7. Source IDs Used

No extra top-level sections are allowed.

## Detection

- Detect one of the Tier-1 platforms:
  - `next.js`
  - `react`
  - `shopify`
  - `wordpress`
  - `gohighlevel`
  - `clickfunnels`
  - `webflow`
  - `static-html`
- If no Tier-1 match is available, set platform to `unsupported` and use fallback contract.
- Output automation level from `manifests/platform-matrix.json`.

## Required Inputs

Require these fields before implementation:

- `meta_pixel_id`
- `domain`
- `event_map` (business funnel steps mapped to Meta standard events)

Require these fields for server-side CAPI paths:

- `capi_access_token` (store in env only; never echo)
- `test_event_code` for validation phase

Do not ask users to paste secrets into chat history. Ask for confirmation that env vars are set.

## Implementation

- Read baseline requirements from `references/core/capi-baseline.md`.
- Read platform recipe from `references/platforms/<platform>.md`.
- Apply all `required_checks` in platform matrix.
- Enforce shared `event_id` for Pixel + CAPI deduplication.
- Enforce EMQ input collection rules and hashing normalization from baseline reference.
- For unsupported platforms, use `references/core/unsupported-fallback.md`.

## Verification

Minimum verification steps for all implementations:

- Browser Pixel event observed.
- Server CAPI event observed.
- Deduplication confirmed for paired events.
- Events Manager diagnostics reviewed.
- Test event code validation completed.

If verification evidence is incomplete, mark status `UNVERIFIED`.

## Failure Handling

When any critical condition fails, return only:

- `status`: `BLOCKED`
- `reason_codes`: list of failing rule IDs or source IDs
- `missing_or_stale_sources`
- `missing_inputs`
- `next_actions`

Critical blockers include:

- stale `meta_core` sources (>14 days)
- unresolved or unmapped normative rule
- missing Tier-1 platform reference file
- invalid configured Graph API major version

## Security Notes

- Mask all secrets (`******` except last 4 chars if needed for human debugging).
- Do not include token literals in examples.
- Do not expose cookie values in plaintext logs.
- Do not use `Access-Control-Allow-Origin: *`.
- Keep token handling server-side only.

## Source IDs Used

- Always list source IDs from `manifests/source-registry.json`.
- Do not cite non-allowlisted domains for normative requirements.
- If no valid source IDs are available for a requirement, fail closed.

## Reference Map

- Core baseline: `references/core/capi-baseline.md`
- Unsupported fallback: `references/core/unsupported-fallback.md`
- iOS/AEM context: `references/core/ios-aem-context.md`
- Security policy: `references/security/secret-handling.md`
- Network safety: `references/security/safe-networking.md`
- Troubleshooting: `references/troubleshooting/common-failures.md`

Platform references:

- `references/platforms/nextjs.md`
- `references/platforms/react.md`
- `references/platforms/shopify.md`
- `references/platforms/wordpress.md`
- `references/platforms/gohighlevel.md`
- `references/platforms/clickfunnels.md`
- `references/platforms/webflow.md`
- `references/platforms/static-html.md`