A bid request is a small JSON document, usually between two and eight kilobytes, and it is the only part of your page that most demand partners ever inspect. A buyer's decision engine reads it, prices it, and returns a bid or a no-bid inside a timeout window that header bidding typically caps between 1000 and 1500 milliseconds. The evaluation itself often happens in tens of milliseconds. Your design, your editorial standards and your audience loyalty reach the buyer only through the fields in that payload.
That asymmetry defines publisher-side programmatic work: you optimize a document you rarely see. This article walks through the request the way a buyer walks through it, in three passes: identity first, eligibility second, value third. It covers which fields carry pricing weight, which ones get you excluded, which ones you can change, and what we at WireAds do to the payload between your page and the demand stack.
What leaves your page in the first 100 milliseconds
When a user reaches an ad slot, your header bidding wrapper or SDK builds a request and fires it at every demand partner in the auction. Real-time bidding requests arrive as OpenRTB JSON or Protobuf over HTTP POST, and Google's Authorized Buyers guide to how bid requests work describes the same envelope that most demand partners consume. The root object carries an id, a tmax timeout, an at auction type, an imp array, and the context objects: site or app, device, user, regs and source.
The imp array does the heaviest lifting. Each impression object declares the media type, the banner sizes or the player parameters for video, the supported mime types, the API frameworks, and the floor price with its currency. A video request without protocols, playbackmethod, placement or startdelay tells the buyer almost nothing about how the creative will run, and many video buyers skip such requests rather than guess. A banner request whose declared sizes differ from the rendered slot creates a discrepancy that buyers' viewability models learn and price.
The site object carries your domain, the full page URL, the referrer, your IAB content categories and a content object with language and genre. The device object carries OS, make, model, screen dimensions, connection type, carrier, IP-derived geography and the limit-ad-tracking flag. The user object carries IDs and consent signals. The regs object marks regulated traffic, such as the COPPA flag that makes most open market demand disappear instantly.
The BidRequest object spec published by the IAB Tech Lab defines every one of these objects, and buyers build pricing and exclusion logic directly on those definitions. Missing fields do not trigger a question. They trigger a default assumption, usually the most conservative one, and a lower bid.
The fields buyers read before they price you
Buyers run a three step decision before any bid leaves their system. First they check eligibility: does the request violate a category exclusion, a brand safety list, a geo restriction or a domain blocklist? Then they check identity: is there a matchable user ID, and does the consent string permit personalization? Only then do they compute value.
Value is a prediction of outcomes: a click, an install, a view-through conversion, attention, or brand lift. Device and geography carry the most weight in open market demand. A request from a tier one market on a current device with a matched user ID can clear several times the CPM of an otherwise identical request from an unmatched user in a lower demand market, because advertisers pay for measurable reach.
Your own track record matters more than any single field. Buyers key reporting on your domain or app bundle, and they track win rate, view rate and post-click conversions per placement. A slot that historically converts earns systematic bid markups. A slot that wins auctions but never converts earns systematic shading, sometimes down to zero. Two sites with similar traffic can clear very different CPMs because the buyer's history with the inventory behaves like a field in the request.
Content signals come next. IAB categories, page URL, keywords and referrer feed contextual targeting and brand safety classifiers. A stripped or genericized URL removes the richest contextual signal in the payload, and buyers respond by bidding as if the page were unknown, which typically means lower.
Seller identity decides eligibility before price
Before a buyer prices anything, it verifies who sells it. Three files and one object do that work. ads.txt declares which accounts may resell your web inventory, app-ads.txt does the same for apps, and sellers.json tells the buyer whether each seller transacts directly with you or as an intermediary. The SupplyChain object travels inside the request itself and lists every node in the chain of custody, from your tag to the final exchange.
Buyers enforce these declarations mechanically. A request that arrives through an undeclared seller path gets dropped, not discounted. A chain with a missing or inconsistent node raises flags. Each intermediary hop adds opacity and a revenue share, and many buying platforms cap the price they will pay in proportion to that opacity.
Google MCM adds a further layer. Under Multiple Customer Management, your inventory transacts through a managing partner, and buyers see that relationship in the request. Publishers who run inventory through a parent partner should confirm that their ads.txt lines, their sellers.json entries and their MCM declarations agree, because mismatches read as risk, and risk reads as lower bids. The same logic applies to Authorized Buyers demand: the request must present a coherent story about who owns the impression.
Floor prices are a negotiation, not a setting
The bidfloor field looks like a minimum, but buyers treat it as information. A floor above the buyer's predicted value produces a no-bid, not a counteroffer. Set floors too high and bid rate collapses: fewer buyers respond, you collect less auction data, and you cannot tell whether the problem is the floor or the inventory. Set floors too low and first-price auctions clear at whatever the winner shades to.
In a first-price auction, buyers deliberately bid below their predicted value, and the floor anchors that shading. A floor of 0.30 on inventory that clears at 1.20 teaches buyers to bid 1.21. A floor of 1.00 on the same inventory often clears near 1.05, because the anchor moved. Floors therefore work as price discovery instruments, and they need scheduled testing rather than annual decisions. Test one variable at a time, on matched traffic, and give each test enough impressions to clear the noise.
Currency and structure matter too. A bidfloorcur mismatch makes some buyers drop out rather than compute. Multi-imp requests with different floors per impression are legitimate, but they require the buyer's auction logic to price each imp separately, and simpler integrations do not always bother.
Consent and privacy signals change bid density
Privacy fields now decide whether a buyer can personalize at all. A TCF consent string from IAB Europe tells the buyer which purposes and vendors the user authorized. A Global Privacy Control signal tells the buyer the user opted out of sale or sharing outright. US state privacy strings carry similar meaning for American traffic. When these signals block personalization, buyers split: some drop out entirely, some switch to contextual-only bidding at lower values.
The practical effect shows up as bid density. The same impression with full consent might draw bids from eight demand partners; without consent it draws bids from two, both contextual. Thinner auctions clear lower, which is why consent rates belong on the same dashboard as CPMs. Publishers who repair a broken consent flow often see revenue move before they change anything else, because they restore demand that never had a reason to leave.
The user object carries identity, and identity quality changes value. A request with a fresh, matchable user ID supports retargeting and lookalike demand, both of which pay premiums. A request with no user object supports contextual demand only. Server-side setups can lose browser-based match rates, which is one reason we treat identity as a curation problem rather than a plumbing detail.
Client-side and server-side requests are not the same product
Prebid.js runs in the browser. It calls adapters directly, it reads the same cookies the user's browser holds, and it gives you full visibility into every request and response. Its limits are latency and adapter count: every call adds time to the page, and enough parallel calls start eating the very viewability that buyers price.
Prebid Server moves the auction off the page. The documentation on how Prebid Server works describes the flow: the client sends a slim request that references a stored request ID, the server merges that reference with a full stored configuration, enriches the payload, and then calls adapters. Stored requests cut the wire payload to a fraction of full size, let you change demand configuration without touching your site, and make server-side demand reachable from apps and CTV devices that have no browser.
The tradeoff is identity. Server-side calls originate from datacenter IPs, not user browsers, so cookie-based match rates can drop unless you forward identity signals correctly. Hybrid setups keep some demand client-side for match quality and push the rest server-side for reach and speed. We run both, and we choose per demand source, because a Prebid.js adapter and a server-side adapter for the same exchange can behave differently on the same impression.
What you can change this quarter
Much of the request is context you cannot fake: device, geography, carrier, connection. A large share of what buyers weight sits under your direct control, and the list below reflects what moves revenue fastest in our experience, in rough order.
- Declare accurate IAB content categories. Buyers use them for both targeting and brand safety. Miscategorized pages lose the demand that wants them and attract the demand that does not.
- Pass the full page URL and referrer. URL stripping kills contextual targeting, and contextual bidding is the fallback for every privacy-constrained impression.
- Complete the video object. Mimes, protocols, playbackmethod, placement and startdelay decide whether video demand bids at all. VAST version support and skip settings belong in the request, not in a wiki page.
- Match declared sizes to rendered sizes. A 300x250 declared as 970x250 renders as a mismatch, buyers' viewability models learn it, and they price the discrepancy against you.
- Keep ads.txt and app-ads.txt current. Every new demand path needs a declared line, or the bids from that path stop at the verification step.
- Set test to 0 in production. Test traffic pollutes buyer reporting, and polluted reporting lowers your historical placement value.
Then measure. Bid rate, clear rate and revenue per placement tell you whether a change worked; CPM alone does not. Our analytics surfaces bid density per demand source, so you can see which partners respond to which changes. That visibility is the only honest way to run floor tests, because floors and demand changes interact.
A five-point audit you can run without an engineer
You do not need an engineer to check most of this. Five checks catch the majority of the problems we find when we onboard new publishers.
- Open your page with your wrapper's debug mode and read one real request. If the URL field is empty or generic, fix it first; it is the highest value field you own.
- Compare the imp object against the live slot: media type, sizes, and the full set of video parameters if the slot plays video.
- Fetch your ads.txt and app-ads.txt and compare them against every demand path your SSP reports. Remove dead lines, add missing ones.
- Inspect the consent string on a request from a regulated market. An empty string alongside real traffic usually means a broken integration, not a user base that refuses everything.
- Compare bid rate by demand source. A partner that never bids on your inventory is either mismatched or blocked, and both conditions are fixable.
Run the audit quarterly. Requests drift: tags get edited, consent tools update, demand paths change, and a field that was correct in January can misreport by April.
How WireAds curates the request before buyers see it
We sit between your inventory and the demand stack, and we treat the bid request as the product. WireAds SSP combines Prebid, OpenRTB, Google MCM, Google AdX demand and direct deals from global and local brand agencies, so every demand source bids against the same ad spaces. Our ad sources hold premium quality standards for brands, and we filter unwanted ads before they can reach your users.
On the request side, we normalize what your page sends: correct content categories, complete video parameters, consistent floors and currencies, accurate SupplyChain objects and clean sellers.json alignment. We run OpenRTB readiness checks at integration, so missing fields surface before demand does. We work CPM-based and pay Net 30, globally, across web, app and CTV/OTT, in every country that has Google monetization.
The point of curation is simple. Demand partners price what they can verify, and they verify what the request declares. A publisher with a clean, complete, honest bid request competes on inventory quality and audience. A publisher with a broken one competes on price alone, and loses.
