Also called: GA4 Measurement Protocol, MP, server-side GA4 events
Requests need the data stream's Measurement ID plus an API secret created in the GA4 admin. The API secret is a credential: it allows anyone holding it to write events into your property, so it must stay server-side and out of version control.
Measurement Protocol events should carry the same client_id (and session_id where possible) as the browser events for the same user, or GA4 treats the server event as a separate anonymous session and attribution breaks.
The API accepts events silently — a malformed payload returns a 2xx and is discarded. Use the debug endpoint (/debug/mp/collect) during development, because the production endpoint will never tell you an event was rejected.
A silent-accept API combined with a required client_id makes the Measurement Protocol the easiest way to believe you are tracking server-side conversions while sending nothing GA4 can attribute.
Send them to the debug endpoint at https://www.google-analytics.com/debug/mp/collect, which returns validation messages describing exactly what is wrong. The production endpoint accepts everything and reports nothing.
Yes. Moving collection to the server changes the transport, not the legal basis. If the user denied analytics consent, the server-side event should not be sent either.
TagEasy's free auditor checks any URL for Consent Mode v2 signals, PII in tracking, duplicate pixels, and 10 other tracking-quality faults. No signup.
