ads.cert

ads.cert is an IAB Tech Lab suite of cryptographic protocols that lets companies that trade programmatic ads prove who they are and detect tampering, by publishing public keys in DNS and signing their requests.

Supply chain files such as ads.txt and sellers.json say who may sell. They cannot prove that a given request really came from that seller or was not changed on the way. ads.cert fills that gap with cryptography.

The current version, ads.cert 2.0 from 2021, has two parts (IAB Tech Lab, accessed 9 November 2026). Call Signs let a business publish public keys and metadata in DNS records on its own domain, so any counterparty can find and verify it without a central authority. Authenticated Connections uses those keys to sign server-to-server HTTP requests, such as bid requests, creative fetches and impression pings. The receiver can then tie each request to a domain and see whether it was altered.

Protocols for signed bid parameters and device attestation are planned. IAB Tech Lab hosts open-source code for the protocols, built in Go, so firms do not have to build them from scratch. Version 2.0 replaced a 2018 design that only signed bid requests in OpenRTB 3.0. Consumer identifiers are out of scope: the protocol authenticates businesses, not users.

Example: An SSP publishes its ads.cert keys under its own domain. A DSP that receives a connected-TV bid request checks the signature against those keys before bidding, so a reseller that spoofs the SSP's name fails the check.

Related terms: ads.txt, sellers.json, SupplyChain object, app-ads.txt, IVT.

Authoritative source: IAB Tech Lab, "ads.cert" standard page (ads.cert 2.0, accessed 9 November 2026).