Prebid Server Self-Hosting Guide: AWS, On-Prem, Managed

Prebid Server is open-source, Apache-licensed server-side header bidding software in two implementations, Go and Java. Self-hosting means running it behind a load balancer with Prebid Cache, a stored-request database and metrics, in a region near your users. The software is free; you pay for compute, cache, egress and the engineers who keep it current, because releases arrive almost weekly.

This guide covers the decision (host, cloud or managed), the components, the configuration, a latency budget and a cost worksheet in which every price is sourced and every volume is an input you replace with your own.

Prebid.org's own guidance is to pick the language your team prefers if the feature set and adapters you need are present in both (PBS-Go versions page, accessed 17 October 2026). In practice the choice is driven by the Java-only list: if you need the USGen module for US state privacy, the circuit breaker or per-account stored requests, pick Java; if you need the legacy schain locations or geo-fencing, pick Go.

The host must handle production networking and monitoring, populate account and stored-request data, and "assess the legal implications of ad tech" in its market; no open-source tooling exists for the data pipeline that fills the stored-request database (Prebid Server hosting, accessed 17 October 2026). A multi-region deployment needs a global load balancer and a source database that replicates to each region (same). And the uids cookie that carries bidder IDs is set on the Prebid Server host's domain, so with a managed host the identity cookie belongs to the host's domain, not yours (Prebid Server cookie sync, accessed 17 October 2026).

Prebid Server. CPU and network bound; needs "a fair amount of memory" to cache stored requests and several GDPR vendor-list versions; can host geo lookup for GDPR scope (Prebid Server hosting). Endpoints: /openrtb2/auction, /openrtb2/amp, /openrtb2/video, /cookie_sync, /setuid, /getuids, /status, /version, /info (Prebid Server overview).

Prebid Cache. Stores VAST and bids for video and AMP; uses "very little CPU or memory" and translates between Prebid's protocol and the backend, which can be Redis, Aerospike, Cassandra or Apache Ignite; cluster size depends on traffic volume, mix and how long objects stay cached (Prebid Server hosting).

Stored requests. Blocks of OpenRTB stored server-side and merged into incoming requests, used for mobile app and AMP and for keeping ad-unit definitions out of tags. PBS-Go supports filesystem (stored_requests.filesystem.enabled: true, files under stored_requests/data/by_id/), Postgres (stored_requests.postgres with a query) and HTTP (stored_requests.http.endpoint), with an in-memory cache (in_memory_cache.ttl_seconds, request_cache_size_bytes, imp_cache_size_bytes) and an HTTP events feed for invalidation (http_events.refresh_rate_seconds) (stored requests, Go, accessed 17 October 2026). A request references a stored imp with imp[].ext.prebid.storedrequest.id; request values win on conflict (same).

// stored_requests/data/by_id/stored_imps/leaderboard-top.json
{
  "id": "leaderboard-top",                         // referenced by imp.ext.prebid.storedrequest.id
  "banner": { "format": [ { "w": 728, "h": 90 }, { "w": 970, "h": 250 } ] },
  "ext": { "prebid": { "bidder": {
      "magnite":  { "accountId": 0, "siteId": 0, "zoneId": 0 },   // your Magnite IDs
      "pubmatic": { "publisherId": "0", "adSlot": "leaderboard" } // your PubMatic IDs
  } } }
}

The bidder parameter names above follow the Prebid bidder docs for each adapter; the IDs are placeholders (Prebid bidder list).

Bidder adapters. Each adapter ships with a static/bidder-info/{bidder}.yaml declaring endpoint, maintainer.email, gvlVendorID (IAB Europe Global Vendor List ID), capabilities (app, site, dooh with banner, video, audio, native), userSync (iframe or redirect URL with a userMacro), openrtb.version (2.6 if supported), endpointCompression (gzip) and modifyingVastXmlAllowed (Prebid.org, adding a new bidder, Go, accessed 17 October 2026). In PBS-Java "by default all bidders are disabled" and are switched on per adapter with adapters.<bidder>.enabled (config-app.md, accessed 17 October 2026). Enable only the bidders you have contracts with; the uids cookie and the GVL ID govern what each may receive under TCF.

Cookie sync. Prebid.js sends the bidder list and privacy signals to /cookie_sync; if privacy rules allow, PBS returns sync pixels for bidders missing an ID; each bidder endpoint redirects to /setuid, which stores the bidder's ID in the uids cookie on the PBS host domain; later auctions place that ID in user.buyeruid for the bidder. userSyncLimit in s2sConfig caps syncs per call, coopSync (default true) lets PBS sync bidders not on the current page, and PBS checks TCF Purpose 1 on both /cookie_sync and /setuid (Prebid Server cookie sync; Prebid Server adapter docs; Prebid Server privacy; all accessed 17 October 2026).

Privacy. PBS enforces TCF 2.0 and 2.2 by purpose (Purpose 1 for cookie sync, Purpose 2 for the auction, Purposes 2 to 10 for passing user IDs, Purpose 7 for analytics, Special Feature 1 for precise geo), supports GPP unwrapping, the US Privacy string, COPPA (removes IDs and geo when regs.coppa is 1) and LMT, and passes Sec-GPC without acting on it by default; gdpr.enabled defaults to true and gdpr.default_value is required with no default (Prebid Server privacy; configuration.md). The EU side of this is covered in GDPR, ePrivacy and the bidstream.

Floors. Floor rules live in ext.prebid.floors on the request or stored request, or are fetched dynamically from a URL (fetch.enabled, fetch.url, fetch.period_sec default 3600, fetch.max_age_sec default 86400); enforcement rejects bids below the floor after currency and bid adjustments, and skipRate bypasses signalling for A/B tests (Prebid Server floors, accessed 17 October 2026).

The numbers that exist are Prebid.org's. Prebid.js sends Prebid Server a timeout of 75% of bidderTimeout or 750 ms, whichever is less, unless you set s2sConfig.timeout; the server timeout "should be approximately 200ms-300ms less than your Prebid.js timeout" (Prebid Server adapter docs, accessed 17 October 2026). On the server, PBS-Go's auction_timeouts_ms.default and .max both default to 0 (meaning use the request's tmax), and tmax_adjustments lets you reserve milliseconds for bidder network latency and response preparation (config.go, accessed 17 October 2026).

What this means for siting: the round trip from user to your PBS region plus the slowest bidder you wait for must fit inside the server timeout. Prebid.org's hosting page says a global load balancer is needed "if you serve more than one geographic region, so users reach the nearest cluster" (Prebid Server hosting). The engineering background on request rates and bid latency is in QPS, latency and bid performance, and the broader architecture in RTB architecture explained.

Prebid.org publishes no cost or capacity figures (Prebid Server hosting). The worksheet below therefore separates prices, which are sourced, from volumes, which are inputs you must measure in your own load test.

Sourced prices (US East, on demand, accessed 17 October 2026)

Inputs you supply (illustrative values, not benchmarks)

Formulas

• Prebid Server instances per region = ceil(R ÷ S × H). Example: ceil(2,000 ÷ 1,000 × 2) = 4.
• Monthly Prebid Server compute = instances × G × T × price. Example: 4 × 2 × 730 × $0.145 = $846.80 on demand, or 4 × 2 × 730 × $0.096 = $560.64 reserved (Vantage).
• Prebid Cache nodes = 2 per region as a minimum for availability (your policy). Example: 2 × 2 × 730 × $0.082 = $239.44 on demand (Vantage).
• Cache backend = nodes per region × G × T × price. Example: 2 × 2 × 730 × $0.1752 = $511.58 (AWS ElastiCache pricing).
• Load balancers = G × T × $0.0225 plus LCU-hours × $0.008. Example fixed part: 2 × 730 × $0.0225 = $32.85; the LCU part depends on your connection and byte volumes (AWS ELB pricing).
• Egress GB per month = R × 3,600 × T × E ÷ 1,048,576 at peak rate (an upper bound; use your actual request distribution). Example upper bound: 2,000 × 3,600 × 730 × 10 ÷ 1,048,576 ≈ 50,130 GB, of which the first 100 GB is free; multiply the remainder by the per-GB tier from the AWS page (AWS EC2 on-demand pricing).
• Staff = the fraction of an engineer who tracks weekly releases, quarterly updates at minimum, adapter changes and the stored-request pipeline (Prebid Server hosting).

The example infrastructure lines above sum to roughly $1,600 a month on demand before egress and the LCU component, with egress likely to be the largest single line at the example volumes. The point of the worksheet is that egress and staff, not compute, decide the comparison with a managed host, and that a managed host's revenue share should be compared against this total plus the value of owning the bid stream. A capacity-planning calculator that automates the formulas is planned at bidder capacity planner.

Keys below are from Prebid Server's configuration documentation and config.go; values marked "yours" are placeholders (configuration.md; config.go; stored requests, Go; all accessed 17 October 2026).

# pbs.yaml (PBS-Go). Equivalent env vars use the PBS_ prefix, e.g. PBS_PORT.
host: ""                       # listen on all addresses (default "")
port: 8000                     # default 8000
external_url: "https://pbs.example-publisher.com"   # public URL for user-sync callbacks and event URLs (yours)

auction_timeouts_ms:
  default: 0                   # 0 = use the request's tmax (default 0)
  max: 0                       # 0 = no cap (default 0); set e.g. 1000 to protect bidders

tmax_adjustments:
  enabled: false               # default false; enable to reserve ms for network and response prep
  bidder_network_latency_buffer_ms: 0
  pbs_response_preparation_duration_ms: 0

gdpr:
  enabled: true                # default true
  default_value: "1"           # REQUIRED, no default: "1" = treat requests without a GDPR flag as in scope (EU-safe)

ccpa:
  enforce: false               # default false; set true to honour US Privacy opt-outs

stored_requests:
  postgres:                    # or filesystem.enabled: true, or http.endpoint
    host: "db.internal"        # yours
    port: 5432
    user: "pbs"
    dbname: "pbs"
    query: "SELECT id, requestData, type FROM stored_requests WHERE id IN %REQUEST_ID_LIST% OR id IN %IMP_ID_LIST%"
  in_memory_cache:
    type: "lru"                # default none
    ttl_seconds: 3600          # default 0
    request_cache_size_bytes: 104857600   # default 0; 100 MB
    imp_cache_size_bytes: 104857600

cache:
  scheme: "https"
  host: "pbs-cache.example-publisher.com"   # Prebid Cache behind the /cache route (yours)
  query: "uuid=%PBS_CACHE_UUID%"
  expected_millis: 10          # default 10

metrics:
  prometheus:
    port: 9100                 # default 0 (disabled); expose to your scraper only

compression:
  request:
    enable_gzip: true          # default false; bidders with endpointCompression: gzip benefit
  response:
    enable_gzip: true          # default false

http_client:
  max_idle_connections: 400              # default 400
  max_idle_connections_per_host: 10      # default 10
  idle_connection_timeout_seconds: 60    # default 60

adapters:
  appnexus:
    disabled: false            # adapters are enabled unless disabled; bidder params come from stored requests
  magnite:
    disabled: false
  # Leave bidders you have no contract with disabled; the AdX adapter will be added by Google's release.

Two cautions. The Postgres query shape and the adapters.<bidder> keys follow the current documentation and defaults; confirm against the config/config.go structures for the version you deploy, because the docs say that file is the complete definition (configuration.md). And gdpr.default_value has no default on purpose; a missing value is a startup error, which is the safer failure.

• Health. /status returns 200 when the server is up (Java exposes it on 8080; Go on 8000) (prebid-server-java README; prebid-server README).
• Metrics. Export to Prometheus or InfluxDB (both implementations) or Graphite (Java) and hook both Prebid Server and Prebid Cache into the same monitoring (Prebid Server hosting). Track per-bidder timeout rate, bid rate, error rate and p95 adapter latency, plus stored-request cache hit rate and Prebid Cache write latency.
• Floors telemetry. Bids rejected by floors are reported to analytics and logged as a sampled metric (Prebid Server floors).
• Updates. Check at least quarterly; releases are almost weekly (Prebid Server hosting). Treat GO-2026-6139 as the model: PBS-Go v4.0.0 to v4.3.0 carried an SSRF alert, fixed from v4.4.0 (pkg.go.dev).
• Supply chain. Every bidder you enable is a seller relationship that must appear in ads.txt and, for your own seat, in your partners' sellers.json; validate with the ads.txt and sellers.json validator.
• Where it sits in the stack. The comparison between client-side, server-side and Open Bidding is in header bidding vs server-side bidding; the ad servers it can feed are in Google Ad Manager alternatives; the migration sequence that puts Prebid Server in before the ad server changes is in how to switch ad servers without losing AdX demand; and the hub is publisher independence.

Is Prebid Server free? The software is free under the Apache-2.0 license for both implementations (prebid-server README; prebid-server-java README). Running it is not: Prebid.org says it "is not a turn-key solution" and that the host must build its own data pipeline for accounts and stored requests (Prebid Server hosting). The worksheet above prices the infrastructure.

Should I choose Prebid Server Go or Java? Prebid.org says to pick the language your team prefers if the features and adapters you need exist in both (PBS-Go versions page). The feature index lists 16 Java-only features and 4 Go-only ones; US state privacy (USGen module), the circuit breaker and per-account stored requests are Java-only, while geo-fencing and legacy schain locations are Go-only (feature index). Microsoft runs its commercial service on Go (Microsoft Learn, 21 October 2025).

How much does it cost to run Prebid Server on AWS? It depends on request rate, regions and egress, none of which Prebid.org benchmarks. The sourced unit prices are $0.145 per hour for a c7g.xlarge and $0.082 per hour for an m7g.large on demand, $0.0225 per hour plus $0.008 per LCU-hour for an Application Load Balancer, and $0.1752 per node-hour for a cache.r7g.large in AWS's own example (Vantage; AWS ELB pricing; AWS ElastiCache pricing).

How many bidders does Prebid Server support? Prebid.org's overview says "230+" server-side adapters; the bidder list page carries 394 entries, some of which are aliases or duplicates (Prebid Server overview; bidder list). Each adapter declares its endpoint, GVL ID, media types and user-sync method in a bidder-info file (adding a new bidder, Go).

Do I need Prebid Server to get AdX bids after the Google ruling? Not necessarily, but it is one of the two court-ordered paths. Google must build an API so Prebid can solicit real-time AdX bids and a DFP-to-Prebid-Server link (Google's estimate 12 to 15 months from the Effective Date), and separately must send AdX bids to rival ad servers (6 or 12 months, disputed) (Memorandum Opinion, Dkt. 1858, p. 58; PPC Land, 6 October 2026). A Prebid Server you host, or one a managed host runs for you, is where the first path lands; open-web display only.

1. GitHub, prebid/prebid-server, README and Releases (accessed 17 October 2026). https://github.com/prebid/prebid-server and https://github.com/prebid/prebid-server/releases
2. GitHub, prebid/prebid-server-java, README and Releases (accessed 17 October 2026). https://github.com/prebid/prebid-server-java and https://github.com/prebid/prebid-server-java/releases
3. GitHub, prebid/prebid-server, docs/developers/configuration.md (accessed 17 October 2026). https://github.com/prebid/prebid-server/blob/master/docs/developers/configuration.md
4. GitHub, prebid/prebid-server, config/config.go defaults (accessed 17 October 2026). https://raw.githubusercontent.com/prebid/prebid-server/master/config/config.go
5. GitHub, prebid/prebid-server-java, docs/config-app.md (accessed 17 October 2026). https://github.com/prebid/prebid-server-java/blob/master/docs/config-app.md
6. pkg.go.dev, github.com/prebid/prebid-server/v4 versions, with GO-2026-6139 advisory (accessed 17 October 2026). https://pkg.go.dev/github.com/prebid/prebid-server/v4?tab=versions
7. Prebid.org, "Prebid Server overview" (accessed 17 October 2026). https://docs.prebid.org/prebid-server/overview/prebid-server-overview.html
8. Prebid.org, "Prebid Server hosting" (accessed 17 October 2026). https://docs.prebid.org/prebid-server/hosting/pbs-hosting.html
9. Prebid.org, "Prebid Server feature index" (accessed 17 October 2026). https://docs.prebid.org/prebid-server/features/pbs-feature-idx.html
10. Prebid.org, "Prebid Server bidder list" (accessed 17 October 2026). https://docs.prebid.org/dev-docs/pbs-bidders.html
11. Prebid.org, "Adding a new bidder (PBS-Go)" (accessed 17 October 2026). https://docs.prebid.org/prebid-server/developers/add-new-bidder-go.html
12. Prebid.org, "Stored requests (PBS-Go)" (accessed 17 October 2026). https://docs.prebid.org/prebid-server/features/pbs-storedreqs-go.html
13. Prebid.org, "Prebid Server cookie sync" (accessed 17 October 2026). https://docs.prebid.org/prebid-server/developers/pbs-cookie-sync.html
14. Prebid.org, "Prebid Server privacy features" (accessed 17 October 2026). https://docs.prebid.org/prebid-server/features/pbs-privacy.html
15. Prebid.org, "Prebid Server price floors" (accessed 17 October 2026). https://docs.prebid.org/prebid-server/features/pbs-floors.html
16. Prebid.org, "Prebid Server adapter (s2sConfig)" (accessed 17 October 2026). https://docs.prebid.org/dev-docs/modules/prebidServer.html
17. Prebid.org, "PBS-Go versions" (accessed 17 October 2026). https://docs.prebid.org/prebid-server/versions/pbs-versions-go.html
18. Prebid.org, "Managed services" (accessed 17 October 2026). https://prebid.org/managed-services/
19. Microsoft Learn, "Prebid Server Premium" (21 October 2025). https://learn.microsoft.com/en-us/xandr/monetize/prebid-server-premium
20. Vantage (EC2Instances.info), c7g.xlarge and m7g.large (updated 17 October 2026). https://instances.vantage.sh/aws/ec2/c7g.xlarge and https://instances.vantage.sh/aws/ec2/m7g.large
21. AWS, Elastic Load Balancing pricing (accessed 17 October 2026). https://aws.amazon.com/elasticloadbalancing/pricing/
22. AWS, ElastiCache pricing (accessed 17 October 2026). https://aws.amazon.com/elasticache/pricing/
23. AWS, EC2 on-demand pricing, data transfer section (accessed 17 October 2026). https://aws.amazon.com/ec2/pricing/on-demand/
24. United States v. Google LLC, No. 1:23-cv-00108 (E.D. Va.), Memorandum Opinion, Dkt. 1858 (2 September 2026). https://www.courthousenews.com/wp-content/uploads/2026/09/google-judge-memo.pdf
25. PPC Land, "DOJ seeks 6 months, Google 12, to open its ad exchange to rivals" (6 October 2026). https://ppc.land/doj-seeks-6-months-google-12-to-open-its-ad-exchange-to-rivals/