AdSovereign logo

    RTB Architecture

    Prebid Server Go vs Java: Differences, Feature Parity and When to Choose Each

    Published · Last updated
    Next scheduled review:

    By Art Kukharenko, CEO

    Prebid Server Go and Prebid Server Java expose the same endpoints and request format, but they differ in features, modules, adapters and operations. Java has more privacy and operations features, including US state GPP modules and a circuit breaker. Go has more bid adapters and a lighter runtime. Prebid's advice: check the feature list, then pick your team's language.

    Contents

    Key facts

    Jump to the table

    Definition

    Prebid Server Go (PBS-Go) and Prebid Server Java (PBS-Java): two independent, Apache-2.0 implementations of the same open-source server-side header bidding service, maintained by Prebid.org in separate repositories. PBS-Go is the original. Rubicon Project, now Magnite, ported it to Java because it "had more Java talent than Go" (Prebid Server FAQ).

    What Prebid itself recommends

    The choice only affects the server leg of header bidding; the browser side runs Prebid.js either way, as described in header bidding explained and our Prebid.js guide. Prebid's version overview gives three rules for hosts (Prebid Server code bases, accessed 9 November 2026). If you plan to use long-form video, use Go. Check the feature index for anything you need that only one build has. Otherwise, "choose the language your engineering team is most comfortable with inspecting and enhancing."

    For demand partners, the advice is to write new adapters in Go, and the team ports them to Java "within a couple of months". That explains why Go carries more adapters at any moment. The adapter build process is covered in Prebid Server bidder adapters.

    The long-form video advice needs one update. Both builds deprecated the /openrtb2/video endpoint in their 4.0 releases, and both keep a switch to re-enable it: video.enable_deprecated_endpoint in Go and video.enable-deprecated-endpoint in Java (PBS-Go v4.0.0; PBS-Java 4.0.0). If you rely on that endpoint, plan for its removal.

    The two builds side by side

    20 of 20 rows

    Columns (3)

    Latest release

    4.11.1, 2 Nov 2026

    4.5.0, 4 Nov 2026

    Major 4.0 release

    6 Mar 2026

    6 Aug 2026

    Runtime

    Go 1.26.2 or newer; cgo and libatomic needed

    Java 25; Spring Boot 4.0; Vert.x 5.0

    Official image

    Docker Hub prebid/prebid-server (amd64)

    GHCR prebid-server-java, -bundle

    App and admin ports

    8000 and 6060

    8080 and 8060

    Config system

    Viper: env PBS_*, pbs.json, pbs.yaml

    Spring Boot: YAML, properties, env, CLI

    Core adapters (aliases)

    281 (116)

    266 (103)

    General modules in repo

    5

    11

    Analytics modules in repo

    3 (file, Pubstack, Agma)

    5 (log, Pubstack, Greenbids, Agma, LiveIntent)

    Stored request back ends

    Files, Postgres, MySQL, HTTP

    Files, Postgres, MySQL, HTTP, Amazon S3

    Account data

    YAML defaults, files or HTTP API

    Database query, files, HTTP, S3

    Geo lookup

    None built in

    MaxMind, Netacuity

    TLS in process

    No

    Optional (server.ssl, Java keystore)

    Metrics back ends

    Prometheus, InfluxDB

    Prometheus, InfluxDB, Graphite, console

    Admin port endpoints

    /currency/rates, /version, Go pprof

    Version, currency rates, stored request push, cache invalidation, request logging, trace logging

    Seat non-bid reason codes

    4 of 16 documented codes

    15 of 16 documented codes

    Cookie sync defaults

    No limit, cooperative sync off

    Limit 8, cooperative sync on

    magnite bidder code

    Alias of rubicon

    Core adapter since 4.0.0

    June 2026 critical advisory

    CVE-2026-54735, fixed in 4.4.0

    CVE-2026-54734, fixed in 3.43.0

    Named commercial user

    Microsoft Prebid Server Premium

    AWS reference guidance (tested on Java only)

    Latest release

    PBS-Go

    4.11.1, 2 Nov 2026

    PBS-Java

    4.5.0, 4 Nov 2026

    Major 4.0 release

    PBS-Go

    6 Mar 2026

    PBS-Java

    6 Aug 2026

    Runtime

    PBS-Go

    Go 1.26.2 or newer; cgo and libatomic needed

    PBS-Java

    Java 25; Spring Boot 4.0; Vert.x 5.0

    Official image

    PBS-Go

    Docker Hub prebid/prebid-server (amd64)

    PBS-Java

    GHCR prebid-server-java, -bundle

    App and admin ports

    PBS-Go

    8000 and 6060

    PBS-Java

    8080 and 8060

    Config system

    PBS-Go

    Viper: env PBS_*, pbs.json, pbs.yaml

    PBS-Java

    Spring Boot: YAML, properties, env, CLI

    Core adapters (aliases)

    PBS-Go

    281 (116)

    PBS-Java

    266 (103)

    General modules in repo

    PBS-Go

    5

    PBS-Java

    11

    Analytics modules in repo

    PBS-Go

    3 (file, Pubstack, Agma)

    PBS-Java

    5 (log, Pubstack, Greenbids, Agma, LiveIntent)

    Stored request back ends

    PBS-Go

    Files, Postgres, MySQL, HTTP

    PBS-Java

    Files, Postgres, MySQL, HTTP, Amazon S3

    Account data

    PBS-Go

    YAML defaults, files or HTTP API

    PBS-Java

    Database query, files, HTTP, S3

    Geo lookup

    PBS-Go

    None built in

    PBS-Java

    MaxMind, Netacuity

    TLS in process

    PBS-Go

    No

    PBS-Java

    Optional (server.ssl, Java keystore)

    Metrics back ends

    PBS-Go

    Prometheus, InfluxDB

    PBS-Java

    Prometheus, InfluxDB, Graphite, console

    Admin port endpoints

    PBS-Go

    /currency/rates, /version, Go pprof

    PBS-Java

    Version, currency rates, stored request push, cache invalidation, request logging, trace logging

    Seat non-bid reason codes

    PBS-Go

    4 of 16 documented codes

    PBS-Java

    15 of 16 documented codes

    Cookie sync defaults

    PBS-Go

    No limit, cooperative sync off

    PBS-Java

    Limit 8, cooperative sync on

    magnite bidder code

    PBS-Go

    Alias of rubicon

    PBS-Java

    Core adapter since 4.0.0

    June 2026 critical advisory

    PBS-Go

    CVE-2026-54735, fixed in 4.4.0

    PBS-Java

    CVE-2026-54734, fixed in 3.43.0

    Named commercial user

    PBS-Go

    Microsoft Prebid Server Premium

    PBS-Java

    AWS reference guidance (tested on Java only)

    Download JSON

    Table by AdSovereign, CC BY 4.0.

    Sources, all accessed 9 November 2026. PBS-Go: README, Dockerfile, config.go, admin router and releases. PBS-Java: README, config-app.md, admin-endpoints.md and 4.0.0 notes. Prebid docs: FAQ, hosting guide, database guide and auction endpoint. Others: advisories GHSA-4p3g-4hcj-wpvx and GHSA-fr2c-g2f8-qchg, Microsoft Learn, 21 October 2025 and the AWS guidance README. Module and adapter counts are ours, from the repositories' master branches.

    Every feature that differs, and what it means for you

    Prebid's feature index is the official parity list. These are the 20 rows where the builds differ, with the practical consequence of each (feature index).

    20 of 20 rows

    Columns (4)

    Privacy

    USGen privacy module (GPP sections 7 to 12)

    Java

    Ready-made US state privacy decisions from GPP strings

    Privacy

    US custom logic privacy module

    Java

    Accounts write their own reading of US GPP sections

    Privacy

    Activity control conditions on gppSid, geo, gpc

    Java

    Finer rules for which bidders get which data

    Privacy

    TCF geo-lookup

    Java

    Server decides GDPR scope from IP when the request does not say

    Privacy

    TCF geo-fencing from device.geo.country

    Go

    Enforces EEA scope from a country the client already sent

    Supply chain

    Copy source.ext.schain (OpenRTB 2.5) to source.schain

    Go

    Accepts older clients that send schain in the 2.5 location

    Supply chain

    Copy ext.schain (OpenRTB 2.4) to source.schain

    Go

    Same for 2.4-era clients

    Anti-fraud

    Ads.Cert 2.0 authenticated connections (experimental)

    Go

    Signs outgoing bid requests to supporting bidders

    Operations

    Circuit breaker

    Java

    Stops calling a failing database, geo service or host for a while

    Operations

    Request logging admin endpoints

    Java

    Capture raw requests for one account or bidder on demand

    Stored data

    Stored request IDs unique per account

    Java

    Two publishers can both use the ID "leaderboard"

    Stored data

    Stored response JSON supplied on the request

    Java

    Mock a whole response without a database row

    Cache

    Application storage

    Java

    Modules can cache their own data in Prebid Cache

    Currency

    Bidder currency filter

    Java

    Skip bidders that cannot bid in the auction currency

    Targeting

    Custom targeting prefix instead of hb

    Java

    Run two wrappers side by side without key clashes

    Targeting

    hb_env for AMP

    Java

    Line items can tell AMP traffic apart

    Multiformat

    Preferred media type per bidder

    Java

    Send only video to a bidder that mishandles multiformat

    Analytics

    Client-side analytics tags

    Java

    Server details reach Prebid.js analytics adapters

    Enrichment

    Request correction module

    Java

    Patch known client bugs on the server

    Response

    Response correction module

    Java

    Fix known bidder response problems

    Privacy

    Feature

    USGen privacy module (GPP sections 7 to 12)

    Only in

    Java

    What it means in practice

    Ready-made US state privacy decisions from GPP strings

    Privacy

    Feature

    US custom logic privacy module

    Only in

    Java

    What it means in practice

    Accounts write their own reading of US GPP sections

    Privacy

    Feature

    Activity control conditions on gppSid, geo, gpc

    Only in

    Java

    What it means in practice

    Finer rules for which bidders get which data

    Privacy

    Feature

    TCF geo-lookup

    Only in

    Java

    What it means in practice

    Server decides GDPR scope from IP when the request does not say

    Privacy

    Feature

    TCF geo-fencing from device.geo.country

    Only in

    Go

    What it means in practice

    Enforces EEA scope from a country the client already sent

    Supply chain

    Feature

    Copy source.ext.schain (OpenRTB 2.5) to source.schain

    Only in

    Go

    What it means in practice

    Accepts older clients that send schain in the 2.5 location

    Supply chain

    Feature

    Copy ext.schain (OpenRTB 2.4) to source.schain

    Only in

    Go

    What it means in practice

    Same for 2.4-era clients

    Anti-fraud

    Feature

    Ads.Cert 2.0 authenticated connections (experimental)

    Only in

    Go

    What it means in practice

    Signs outgoing bid requests to supporting bidders

    Operations

    Feature

    Circuit breaker

    Only in

    Java

    What it means in practice

    Stops calling a failing database, geo service or host for a while

    Operations

    Feature

    Request logging admin endpoints

    Only in

    Java

    What it means in practice

    Capture raw requests for one account or bidder on demand

    Stored data

    Feature

    Stored request IDs unique per account

    Only in

    Java

    What it means in practice

    Two publishers can both use the ID "leaderboard"

    Stored data

    Feature

    Stored response JSON supplied on the request

    Only in

    Java

    What it means in practice

    Mock a whole response without a database row

    Cache

    Feature

    Application storage

    Only in

    Java

    What it means in practice

    Modules can cache their own data in Prebid Cache

    Currency

    Feature

    Bidder currency filter

    Only in

    Java

    What it means in practice

    Skip bidders that cannot bid in the auction currency

    Targeting

    Feature

    Custom targeting prefix instead of hb

    Only in

    Java

    What it means in practice

    Run two wrappers side by side without key clashes

    Targeting

    Feature

    hb_env for AMP

    Only in

    Java

    What it means in practice

    Line items can tell AMP traffic apart

    Multiformat

    Feature

    Preferred media type per bidder

    Only in

    Java

    What it means in practice

    Send only video to a bidder that mishandles multiformat

    Analytics

    Feature

    Client-side analytics tags

    Only in

    Java

    What it means in practice

    Server details reach Prebid.js analytics adapters

    Enrichment

    Feature

    Request correction module

    Only in

    Java

    What it means in practice

    Patch known client bugs on the server

    Response

    Feature

    Response correction module

    Only in

    Java

    What it means in practice

    Fix known bidder response problems

    Download JSON

    Table by AdSovereign, CC BY 4.0.

    The list was last edited on 20 March 2025, while both builds have shipped many releases since. For example, PBS-Go 4.7.0 added per-bidder iframe sync blocking, which the index does not track (v4.7.0). Check the release notes for anything you depend on. US privacy signal handling is covered in depth in GPP and TCF implementation for engineers, and the schain rules in schain, ads.txt and sellers.json together.

    Modules: where Java pulls ahead

    Modules plug into fixed stages of the auction, such as the raw request, each bidder request and the final response (Prebid Server modules, accessed 9 November 2026).

    11 of 11 rows

    Columns (3)

    ORTB2 blocking

    Yes

    Yes

    51Degrees device detection

    Yes

    Yes

    WURFL device detection

    Yes

    Yes

    Rules engine

    Yes

    Yes

    Scope3 real-time data

    Yes (build tag scope3_rtd)

    No

    Confiant ad quality

    No

    Yes

    Greenbids real-time data

    No

    Yes

    Optable targeting

    No

    Yes

    Rich media filter

    No

    Yes

    Request correction, response correction

    No

    Yes

    LiveIntent omni-channel identity

    No

    Yes

    ORTB2 blocking

    PBS-Go

    Yes

    PBS-Java

    Yes

    51Degrees device detection

    PBS-Go

    Yes

    PBS-Java

    Yes

    WURFL device detection

    PBS-Go

    Yes

    PBS-Java

    Yes

    Rules engine

    PBS-Go

    Yes

    PBS-Java

    Yes

    Scope3 real-time data

    PBS-Go

    Yes (build tag scope3_rtd)

    PBS-Java

    No

    Confiant ad quality

    PBS-Go

    No

    PBS-Java

    Yes

    Greenbids real-time data

    PBS-Go

    No

    PBS-Java

    Yes

    Optable targeting

    PBS-Go

    No

    PBS-Java

    Yes

    Rich media filter

    PBS-Go

    No

    PBS-Java

    Yes

    Request correction, response correction

    PBS-Go

    No

    PBS-Java

    Yes

    LiveIntent omni-channel identity

    PBS-Go

    No

    PBS-Java

    Yes

    Download JSON

    Table by AdSovereign, CC BY 4.0.

    Sources: the Prebid modules index (last edited 14 January 2026) and the modules/ and extra/modules/ folders of the PBS-Go and PBS-Java repositories on 9 November 2026. PBS-Java packages modules in a separate "bundle" build and image; plain builds leave them out.

    Same intent, two configuration files

    The two builds express the same settings in different dialects. This is one production-style intent, written for each: listen on the default port, return 200 on /status (status.go), treat unknown requests as GDPR in scope, cap server-side time and enable PubMatic.

    # pbs.yaml (PBS-Go 4.11.x)
port: 8000
status_response: "ok"
gdpr:
  default_value: "1"
  host_vendor_id: 0                 # yours
auction_timeouts_ms:
  default: 0                        # 0 = use the request's tmax
  max: 1000
adapters:
  pubmatic:
    disabled: false                 # Go adapters are on unless disabled
    # prebid-config.yaml (PBS-Java 4.5.x)
server:
  http:
    port: 8080
status-response: "ok"
gdpr:
  default-value: "1"
  host-vendor-id: 0                 # yours
auction:
  biddertmax:
    max: 1000
adapters:
  pubmatic:
    enabled: true                   # Java adapters are off until enabled

    The keys come from each project's configuration source (PBS-Go config.go; PBS-Java application.yaml). The timeout settings are not exact equivalents: Go's auction_timeouts_ms.max caps the auction, while Java's biddertmax bounds the time given to bidders. Stored data formats also differ, as shown in Prebid Server stored requests.

    Performance: measure it yourself

    Neither Prebid.org nor the two repositories publish a speed or capacity comparison. The closest public number is AWS's measured PBS-Java startup time, 55.74 seconds on average and 69.54 seconds at p95, which affects autoscaling but not auction latency (AWS stack_constants.py). No comparable figure for PBS-Go is published.

    A fair test isolates the server from the bidders. Both builds support stored bid responses, which replay a canned bidder answer through the real adapter code without a network call to the bidder (auction endpoint docs).

    1. Use the same hardware. One container size, one region, one load generator.
    2. Use the same traffic. Replay a day's sample of real requests, with the same stored requests loaded in both builds.
    3. Remove bidder variance. Point each impression at a storedbidresponse for the bidders you use (stored responses).
    4. Ramp to your peak rate. Record p50, p95 and p99 latency, CPU, memory and error rate at each step.
    5. Repeat with real bidders. A short live test shows how each build's HTTP client handles slow partners.
    6. Compare cost per million auctions. Divide instance cost by sustained throughput at your latency target.

    Our QPS, latency and bid performance guide explains which percentiles matter, and the Prebid Server self-hosting guide turns the result into a cost estimate.

    Who runs which build

    Few hosts state their build publicly. Microsoft says its Prebid Server Premium runs "on open-source Prebid Server Go" with access to over 200 demand partners (company claim) (Microsoft Learn, 21 October 2025).

    AWS's reference deployment uses PBS-Java and says its infrastructure "has only been tested on Prebid Server Java" (AWS guidance README). For other managed hosts, such as the ones profiled at Magnite Prebid Server and PubMatic OpenWrap, the build is not always disclosed; we mark it n/d. Microsoft's service has its own profile at Microsoft Prebid Server Premium. The self-hosted path is profiled at self-hosted Prebid Server. Whichever build a host runs, the question of who controls that choice is the subject of our publisher independence hub.

    Upgrade burden: runtimes and major versions

    Both builds moved to a new major version in 2026, and the upgrades were different in kind. PBS-Go 4.0.0, on 6 March 2026, was mostly about behaviour: the video endpoint off by default, RFC 3986 query strings for the HTTP fetcher, embedded certificates deprecated and several adapters renamed or removed (v4.0.0). Its toolchain moved separately, from Go 1.24 to 1.26, in 4.6.0 on 24 June 2026 (v4.6.0).

    PBS-Java 4.0.0, on 6 August 2026, changed the platform under the code: Java 25, Spring Boot 4.0 and Vert.x 5.0. It also renamed modules and their hooks, which breaks existing execution plans, and switched URL macros to single braces (PBS-Java 4.0.0). A JVM shop can absorb that easily. A team that rarely touches Java will find it heavier.

    Both builds also needed an urgent patch in June 2026, when Prebid published critical request-forgery advisories for each. Plan for the cadence Prebid asks of every host: check for updates at least quarterly, because releases arrive "most every week" (Prebid Server hosting).

    Switching builds later

    Clients will not notice a switch. Prebid.js, the Prebid SDK and AMP pages call the same endpoints with the same OpenRTB, so the client side needs no change (Prebid Server FAQ).

    The server side is where the work is. Configuration must be rewritten key by key. Stored request queries change shape, because Java expects an account ID as the first column. Account settings move between a database query in Java and YAML, files or an HTTP API in Go (Prebid Server database).

    Cookie sync defaults differ, so match rates can shift for a few weeks; the settings are compared in Prebid Server cookie sync. Run both builds side by side behind one load balancer, move traffic by account, and compare metrics before you cut over. Container and metrics setup for that is in our AWS and Docker reference setup and analytics and debugging guide.

    Common mistakes

    1. Reading the feature index as current. The feature index was last edited in March 2025. Confirm features against release notes for the version you will run.
    2. Assuming the same bidder list. An adapter can exist in Go for months before its Java port, and bidder codes can differ, as with magnite and rubicon.
    3. Choosing Go for long-form video without checking the endpoint. Both 4.0 releases deprecated /openrtb2/video.
    4. Copying config keys across builds. adapters.pubmatic.disabled: false in Go and adapters.pubmatic.enabled: true in Java say the same thing in opposite ways.
    5. Benchmarking against live bidders only. Bidder latency hides server differences; use stored bid responses first.
    6. Ignoring team skills. A build your engineers cannot patch quickly is a risk. Both builds needed urgent upgrades in June 2026.

    FAQ

    Is Prebid Server Go faster than Prebid Server Java?
    There is no published head-to-head benchmark from Prebid.org or either repository (Prebid Server hosting). Measure both on your own traffic with stored bid responses, at your peak request rate, and compare p99 latency and cost per million auctions.
    Which Prebid Server version has more bidders?
    Go. On our count, PBS-Go had 281 core adapters and 116 aliases on 30 October 2026, against 266 adapter configs and 103 aliases in PBS-Java on 4 November 2026 (PBS-Go; PBS-Java).
    Do Prebid Server Go and Java have the same API?
    Yes. Prebid keeps the external APIs identical, so /openrtb2/auction, /openrtb2/amp, /cookie_sync, /setuid and /status behave the same for clients (Prebid Server FAQ).
    Can I switch from Prebid Server Go to Java later?
    Yes, without client changes. Budget for rewriting configuration, stored request queries and account data, and run both builds in parallel during the move.
    Which Prebid Server version supports US state privacy through GPP?
    Both read GPP strings, but only PBS-Java has the USGen and US custom logic modules that turn GPP sections 7 to 12 into allow or deny decisions (feature index).
    Which version do managed Prebid Server hosts use?
    It varies and is often not disclosed. Microsoft says its Prebid Server Premium runs on PBS-Go; AWS's reference deployment runs PBS-Java (Microsoft Learn; AWS guidance).

    How this works on owned infrastructure

    The Go-or-Java choice is easier to make, and to reverse, when the data around Prebid Server is yours. Stored requests, account settings and auction logs that live in your own database can be re-queried for either build; on a managed host they live in the vendor's schema and leave with the contract. AdSovereign runs the sell-side stack in an environment you control, keeping configuration and logs in stores you own, so a later move between builds is a configuration project rather than a vendor migration. The architecture page shows where those stores sit, and the TCO page sets out the staffing assumptions behind running either build in-house.

    Sources

    1. Prebid.org, "Prebid Server Code Bases" (accessed 9 November 2026). https://docs.prebid.org/prebid-server/versions/pbs-versions-overview.html
    2. Prebid.org, "Prebid Server FAQ" (accessed 9 November 2026). https://docs.prebid.org/faq/prebid-server-faq.html
    3. Prebid.org, "Prebid Server Features" (feature index, last edited 20 March 2025; accessed 9 November 2026). https://docs.prebid.org/prebid-server/features/pbs-feature-idx.html
    4. Prebid.org, "Prebid Server Modules" (last edited 14 January 2026; accessed 9 November 2026). https://docs.prebid.org/prebid-server/pbs-modules/
    5. Prebid.org, "Hosting a Prebid Server Cluster" and "Prebid Server Database" (accessed 9 November 2026). https://docs.prebid.org/prebid-server/hosting/pbs-hosting.html
    6. Prebid.org, "Prebid Server Endpoints: /openrtb2/auction" (accessed 9 November 2026). https://docs.prebid.org/prebid-server/endpoints/openrtb2/pbs-endpoint-auction.html
    7. GitHub, prebid/prebid-server, README, Dockerfile, config/config.go, endpoints/status.go, router/admin.go, static/bidder-info, modules/, analytics/ and releases v4.0.0, v4.6.0, v4.7.0, v4.11.1 (accessed 9 November 2026). https://github.com/prebid/prebid-server
    8. GitHub, prebid/prebid-server-java, README, docs/config-app.md, docs/admin-endpoints.md, src/main/resources/application.yaml, bidder-config, extra/modules/ and releases 4.0.0, 4.5.0 (accessed 9 November 2026). https://github.com/prebid/prebid-server-java
    9. GitHub Security Advisories GHSA-4p3g-4hcj-wpvx (PBS-Go) and GHSA-fr2c-g2f8-qchg (PBS-Java), 8 June 2026. https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx
    10. Microsoft Learn, "Prebid Server Premium" (21 October 2025). https://learn.microsoft.com/en-us/xandr/monetize/prebid-server-premium
    More sources (1)
    1. AWS, "Guidance for Deploying a Prebid Server on AWS", README and stack_constants.py (v1.4.0; accessed 9 November 2026). https://github.com/aws-solutions-library-samples/prebid-server-deployment-on-aws

    Author: Art Kukharenko, CEO, AdSovereign. Published: 10 November 2026. Last updated: 10 November 2026.