Boundary: Cloudflare can remotely configure pre-approved adapters and server postbacks, but a completely new native SDK must still be compiled, reviewed, and released through Apple or Google. A new provider host needs a Worker allowlist review, not a mobile release.

Operator to-do

  1. Open the Conversion Relay and connect with the Conversion admin token.
  2. Register the app and leave first-open measurement disabled until its app build is tested.
  3. Create a destination on a reviewed provider host with an exact HTTPS URL, request format, consent gate, and HMAC signing.
  4. Select install_first_open, sign_up_completed, trial_started, and/or subscription_started.
  5. Map only the required fields: event ID/name, date, amount/minor amount, currency, plan/product, install/account hashes, platform/app ID, and approved email representation.
  6. Preview the exact outbound request with the destination disabled; verify it against the partner’s sandbox.
  7. Apply, test retries and signature verification, then explicitly enable with a second reviewed plan.
  8. Monitor delivery counters and the stable event ID in the partner dashboard; disable immediately if consent, mapping, or attribution is wrong.

Truth and privacy rules

  • First-open comes once from the compiled bridge; signup comes from authenticated account completion.
  • Trials and paid starts come only from verified RevenueCat/store events.
  • email_sha256 is preferred; raw email requires authoritative backend origin, explicit ads consent, encrypted PII configuration, and an approved partner contract.
  • Stable event IDs make retries idempotent. Private or unreviewed hosts, unsafe redirects, malformed maps, and excess payloads fail closed.

Background delivery

The Cloudflare scheduler claims durable dispatch rows, sends bounded signed requests, retries transient failures, preserves the same event ID, and records terminal delivery status. Disabling a destination stops new dispatches without erasing audit history.

Required tests

Run node server/test/conversion_relay_test.mjs. It covers JSON/form planning, replay, transient retry, HMAC verification, consent denial, app isolation, and host rejection. To revert, preview and apply the prior reviewed values; there is no one-click rollback endpoint. Confirm one non-production delivery in the partner dashboard before enabling production traffic.