Cloudflare Workers

npm install adscapi
# wrangler.toml — bind platform secrets via `wrangler secret put`

// src/index.ts
import { createAdscapi } from 'adscapi';
import type { AdscapiSecrets } from 'adscapi';

export interface Env {
  // Platform tokens + an optional shared auth gate for callers
  RELAY_AUTH_TOKEN?: string;
  META_CAPI_TOKEN?: string;
  META_PIXEL_ID?: string;
  // …every other secret listed by `npx adscapi platforms`
  [key: string]: string | undefined;
}

export default {
  async fetch(request: Request, env: Env): Promise<Response> {
    if (request.method !== 'POST') {
      return new Response('method not allowed', { status: 405 });
    }

    // Optional: gate the endpoint so only your backends can call it
    if (env.RELAY_AUTH_TOKEN) {
      const auth = request.headers.get('authorization') ?? '';
      if (auth !== `Bearer ${env.RELAY_AUTH_TOKEN}`) {
        return new Response('unauthorized', { status: 401 });
      }
    }

    const body = await request.json<{
      name: string;
      value?: number;
      currency?: string;
      email?: string;
      consent?: { adUserData: boolean; adPersonalization: boolean };
    }>();

    // Pass the Worker env as the secrets bag — process.env is empty on Workers.
    const ads = createAdscapi(env as AdscapiSecrets);

    const results = await ads.conversions.track({
      name: body.name,
      value: body.value,
      currency: body.currency ?? 'USD',
      user: body.email ? { email: body.email } : undefined,
      consent: {
        adUserData: body.consent?.adUserData === true,
        adPersonalization: body.consent?.adPersonalization === true,
      },
    });

    return Response.json({ results });
  },
};

# Put each platform secret on the Worker (never in the request body)
npx wrangler secret put META_CAPI_TOKEN
npx wrangler secret put META_PIXEL_ID
npx wrangler secret put RELAY_AUTH_TOKEN   # optional caller auth
npx wrangler deploy

// Dry-run via query string
const dryRun = new URL(request.url).searchParams.has('dryRun');
await ads.conversions.track(event, { dryRun });

// OAuth platforms: supply a fresh token per call without storing it in env
const ads = createAdscapi(env as AdscapiSecrets, {
  getToken: async (platform) => {
    // look up / refresh from KV, return access_token or undefined
  },
});