The endpoint
POST https://serverside.datafirefly.com/v1/eventsThree required headers:
| Header | Content |
|---|---|
X-Dfss-Tenant | Your Site ID |
X-Dfss-Timestamp | Unix timestamp in seconds, 300-second tolerance. NTP-synced clock recommended. |
X-Dfss-Signature | HMAC-SHA256 of the exact raw body sent, lowercase hex, computed with your HMAC secret |
The golden rule of signing
Serialize the JSON once, sign that string, send that same string. Nearly every invalid_signature error comes from re-encoding the body between signing and sending.
Complete PHP and Node examples are provided in the Custom platform guide of your client area, on the Modules page.
The browser channel
POST https://serverside.datafirefly.com/v1/collect/YOUR-PUBLIC-TOKEN
Content-Type: text/plainThis lightweight channel uses the Public pixel token from your site page. It is designed to be called from pages: it only accepts browsing events and refuses purchases and refunds by design, which must go through the signed server channel.
If something goes wrong
401 unknown_tenant: site not activated yet, or wrong Site ID.401 invalid_signature: the body was re-encoded between signing and sending.401 timestamp_out_of_window: timestamp in milliseconds instead of seconds, or unsynced clock.- The full detail is in the troubleshooting guide.
Updated: September 1, 2026