Setting up Meta Conversions API server-side (direct HTTPS to graph.facebook.com/v25.0/<dataset_id>/events) for a small business account surfaced several traps that the official docs and the Events Manager wizard actively make worse.
You do not need a developer account — despite the wizard implying you do. The CAPI setup flow's 'verify your test event' step points at the Graph API Explorer on developers.facebook.com, which requires registering as a Meta developer. That registration can hard-fail on a device-trust check ('you don't usually use this device') with no recourse. None of it is necessary: generate the access token via Events Manager → pixel → Settings → Conversions API → 'Generate access token' (no App Review, no permissions, and since Graph v12 the token works with all API versions), and verify received events via Events Manager → pixel → 'Test events' tab, which is plain UI. The Graph API Explorer path is only relevant for app-based integrations.
Attach test_event_code server-side to see events in the Test Events tab. The tab shows a code like TEST01234; put it top-level in the payload and the event routes to the tab instead of the live dataset — ideal for integration tests and record/replay cassettes, because your test suite then never pollutes real conversion data:
curl -sS "https://graph.facebook.com/v25.0/<dataset_id>/events?access_token=$TOKEN" \
-H 'Content-Type: application/json' -d '{
"data": [{"event_name": "Lead", "event_time": 1700000000,
"event_id": "00000000-0000-4000-a000-000000000000",
"action_source": "website",
"user_data": {"em": ["<sha256 of lowercased email>"]}}],
"test_event_code": "TEST01234"}'
# => {"events_received":1,"messages":[],"fbtrace_id":"..."}Codes are per-dataset and expire after a few days of disuse; reopening the tab regenerates one. TikTok's Events API (POST https://business-api.tiktok.com/open_api/v1.3/event/track/ with an Access-Token header) has the same top-level test_event_code mechanism with codes from its own Test Events tab; success is HTTP 200 with body "code": 0.
Setup flows silently create duplicate datasets. Walking through Meta's pixel/CAPI wizards from different entry points produced two live datasets for one business without any warning. Both were fully real: https://connect.facebook.net/signals/config/<pixel_id> returns HTTP 200 for any ID (as does facebook.com/tr, so neither status code validates anything), but a live pixel's config JS embeds per-pixel blocks like fbq.registerPlugin("<id>", ...) and config.set("<id>", "automaticMatching", {"selectedMatchKeys": [...]}) — grepping the config for the pixel ID is a reliable unauthenticated way to check whether an ID is a real, configured dataset and what its Automatic Advanced Matching keys are. Pick one dataset early and grep your configs; split conversion data is unrecoverable. A dataset created under one browser session can also end up orphaned ('You need access') for the account that thought it created it.
Ignore the 'Marketing API Access Tier' warning. In 2026 Meta relabeled 'Standard Access' to 'Limited Access' and 'Advanced Access' to 'Full Access' and dropped the Full threshold to 500 calls/15 days. The banner looks alarming on the CAPI Get Started page, but it says — accurately — that no code changes are needed. Direct CAPI sends with Events Manager tokens are unaffected at any tier.