In this guide
- The message means your app has Require App Secret turned on, so every server call must include
appsecret_proof. - The proof is an HMAC-SHA256 of the access token, using the app secret as the key, written in hexadecimal.
- Compute it in your server code, or turn the setting off if your set-up cannot add it.
You send an event to the Meta Conversions API or call the Graph API, and Meta answers with an error that says API calls from the server require an appsecret_proof argument. Nothing is wrong with your event. Meta is telling you that the app uses an extra security setting that your request does not satisfy. This page explains the cause and the fixes. See also Meta Conversions API common mistakes and how to set up the Conversions API.
What it means
In your Meta app's advanced settings there is an option, often shown as "Require App Secret", that makes server calls prove they know the app secret. When it is on, a request with an access token must also carry appsecret_proof. If the parameter is missing or wrong, Meta rejects the call. The protection stops someone who steals an access token from using it from their own machine.
Orders from your store, back to the ad that earned them
Your store sends the order once. Open Tracked passes it on to each ad platform, cleaned and deduplicated.
How the proof is made
The proof is a keyed hash. Use the app secret as the key and the access token as the message, then write the result in lower-case hexadecimal.
// Node.js
const crypto = require("crypto");
const proof = crypto.createHmac("sha256", APP_SECRET).update(ACCESS_TOKEN).digest("hex");
// then call: https://graph.facebook.com/v21.0/{DATASET_ID}/events?access_token=ACCESS_TOKEN&appsecret_proof=PROOF// PHP
$proof = hash_hmac("sha256", $accessToken, $appSecret);Fix it
appsecret_proof as above and add it to every call.Ask Ari instead of digging through reports
Ari reads your tracking and ad data and answers in plain words.
Turn the setting off or on
You can turn "Require App Secret" off in the app's advanced settings if your integration cannot send the proof. This lowers security a little. A better path is to add the proof. Treat the app secret as a password: store it in a secret manager, never in a web page or in a Tag Manager variable that is exposed to the browser.
Check after the fix
- Send a test event with the test event code.
- Check Meta Test Events.
- Check that the call returns success.
- Remove the test code before you go live.
A realistic example
A developer sets up a Conversions API call from a small Node service. The first test returns an error saying that API calls from the server require an appsecret_proof argument. The service had worked in a sandbox app, and the production app has the "Require App Secret" setting on. The developer adds three lines to compute the proof from the token and the app secret, redeploys, and the test event appears in Test Events. Later the team moves the same logic into a server container template that takes the app secret in a secure field. The lesson is to treat the app secret like a password: it belongs on the server, in a secret store, and it should never end up in a browser variable.
3 things to remember
Scroll and the points stack up.
The message means your app has Require App Secret turned on, so every server call must include appsecret_proof.
The proof is an HMAC-SHA256 of the access token, using the app secret as the key, written in hexadecimal.
Compute it in your server code, or turn the setting off if your set-up cannot add it.
Frequently asked questions
What is appsecret_proof?
A hash of the access token, made with your app secret, that proves the call comes from a server that knows the secret.
Why do I get this error?
Your Meta app requires it and the request did not include it, or it was wrong.
How do I compute it?
HMAC-SHA256 of the access token with the app secret as the key, as lower-case hex.
Can I turn the requirement off?
Yes, in the app's advanced settings, but adding the proof is safer.
Where should I keep the app secret?
In a secret manager on the server, never in client-side code.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Integrations · 5 min read
