Your approach using cookie-parser to get _fbp and _fbc from cookies and then passing them to the Facebook API is correct and what I've successfully used too.

The challenge I've run into is that sometimes _fbp isn't generated because of cookie consent issues, ad blockers, or browser tracking prevention. However, Facebook emphasizes sending _fbp for better Event Match Quality with server-side events.

This brings up the question: How can we obtain an _fbp value to send with server-side events when it's not available via browser cookies?