Conversion pixel.
From click to event.

// Node.js 22+, YOUR SERVER. Keep the signing key out of the browser.
import { createHmac } from "node:crypto";

async function sendPixelEvent(event) {
  // Persist this event in your outbox after the real outcome, with its original
  // event_id and px_click (or px_tclick). Reuse the same body on retries.
  const raw = JSON.stringify(event);
  const timestamp = String(Math.floor(Date.now() / 1000));
  const signature = createHmac("sha256", process.env.PIXORADS_PIXEL_KEY)
    .update(timestamp + "." + raw).digest("hex");
  // Public px_... ID, not the internal UUID used in cabinet APIs.
  const pixelId = process.env.PIXORADS_PUBLIC_PIXEL_ID;
  const response = await fetch(
    "https://pixora-ads.com/api/v1/pixels/" + encodeURIComponent(pixelId) + "/postback",
    {
      method: "POST",
      redirect: "error",
      headers: {"Content-Type": "application/json",
        "X-PixorAds-Timestamp": timestamp,
        "X-PixorAds-Pixel-Signature": signature},
      body: raw,
      signal: AbortSignal.timeout(8000)
    }
  );
  if (!response.ok) throw new Error("Pixel postback HTTP " + response.status);
  const result = await response.json();
  // 2xx alone does not mean attribution: inspect status/mode/error_code.
  return result;
}

// Example persisted lead payload (replace with values from your backend):
// {event_id: "lead:123", event_name: "Lead", px_click: "<original click token>"}
// For a Purchase, optional value_minor and currency must be supplied together.
// RUB and XTR use 1000 internal units per unit; USD is not accepted here.
// Retry only transport/5xx/429 failures with bounded backoff. Generate a fresh
// timestamp/signature on each delivery, keeping the event_id and body unchanged.