Installation
How do I sign server-side requests?
Send the header x-metrunio-signature with a timestamp and an HMAC-SHA256 over "<timestamp>.<raw body>", computed with the server key. The time window is five minutes and each signature is accepted exactly once.
How does the HMAC signature and replay protection work?
x-metrunio-signature: t=<unix seconds>,v1=<hex>
v1 = HMAC-SHA256(server_key, "<t>.<raw body>")- Sign the raw body, byte for byte, before any reformatting.
- The timestamp must be at most five minutes in the past or future.
- Each signature is accepted only once; a repeat yields REPLAY_DETECTED.
- For /v1/server/events the signature is optional; for /v1/webhooks/conversions it is required.
Caution
If a framework reformats the body before signing (for example by re-serialising the JSON), the signature no longer matches. Sign exactly the bytes you send.
Last reviewed on 12 Oct 2026
Also asked
- Compute HMAC signature
- Replay protection
- How do I secure the webhook?
Related articles
- How do I report conversions server-side?
How do I send events from my shop, CRM or backend?
Through POST /v1/server/events to the collector, with the server key in the authorization header. The portal shows the address and the ready-made call for your website under “Setup” on the “Server Events API” tab. The call is independent of the browser and therefore robust against ad blockers and short-lived cookies.
- Can my system report conversions by webhook?
When do I use the webhook instead of the Server Events API?
The endpoint POST /v1/webhooks/conversions is meant for systems that fire a webhook of their own rather than letting you program an API call. It always requires a valid signature.
- How do I rotate or revoke a key?
What do I do if a key was published by accident?
You renew the write key and the server key in “Setup”, the server key on the “Server Events API” tab, where you can also revoke it. Read keys are revoked under “Exports & AI connections”, in the “API access” section, where you also create a new one. A new key is shown in full only once, and the old one stops working immediately.