Client IP Address and User Agent Formatting in Meta CAPI

1. The Cloud Proxy IP Leak Disaster

When servers communicate with Meta CAPI, developers frequently make a critical error: they pass `req.socket.remoteAddress` as the `client_ip_address`. Behind cloud load balancers (Cloudflare, AWS ALB, Fastly), this returns the private IP of the load balancer (e.g. `10.0.1.45`).

Meta's API accepts the event with an HTTP 200 OK, but internally discards the IP because it is a non-routable private address. Over weeks, your Event Match Quality suffers silently without throwing a single error in your server logs.

2. Comparative Analysis: Standard Tracking vs CAPI Control

The table below outlines the architectural and financial differences between passive conversion tracking and active signal governance:

3. True Client IP Extraction Middleware

Extract the true public IP address across multiple cloud proxies and reverse tunnels:

// True Client IP Extraction Function
export function getTrueClientIP(headers) {
  // Cloudflare Connecting IP (Most reliable if on Cloudflare)
  if (headers["cf-connecting-ip"]) return headers["cf-connecting-ip"];

  // Standard X-Forwarded-For header (First IP is the true client)
  const xForwardedFor = headers["x-forwarded-for"];
  if (xForwardedFor) {
    const ips = xForwardedFor.split(",").map(ip => ip.trim());
    return ips[0]; // Client is always the leftmost IP
  }

  // Fastly / AWS Real IP headers
  return headers["x-real-ip"] || headers["true-client-ip"];
}

How to Deploy CAPI Control to Fix This Today

1. Step 1: Check your server-side payload logs to confirm `client_ip_address` is a public routable IP.
2. Step 2: Confirm that `client_ip_address` and `client_user_agent` are sent as raw plaintext (NOT hashed).
3. Step 3: Deploy CAPI Control to automatically parse edge network headers correctly.
4. Step 4: Observe immediate EMQ score recovery in Meta Events Manager.