AudienceNetwork (S2S): add missing ext.security_app_id in OpenRTB requests to fix production auth failures #4196

PeakLee · 2025-09-19T08:26:48Z

In short:
AudienceNetwork (S2S): include ext.security_app_id in OpenRTB requests.
Fixes a production-only 400 ("Error validating authentication token") when test=0,
while test=1 works. Adds field wiring in AudienceNetworkExt and passes it through
AudienceNetworkBidder. Verified end-to-end with Meta Audience Network engineers.

Summary

This PR fixes a production-only failure in the Meta Audience Network (AN) S2S bidding integration within Prebid Server Java.
In production (test=0), AN requires ext.security_app_id alongside ext.authentication_id for request authentication. The field was not present in outgoing requests, leading to 400 responses (x-fb-an-errors: Error validating authentication token).
Adding ext.security_app_id resolves the issue. Test mode (test=1) remained unaffected, which masked the missing field during integration testing.

Problem Statement
# Observed:
• test=1 requests succeed end-to-end.
• test=0 requests fail with HTTP 400, headers include x-fb-an-errors=Error validating authentication token, often with empty body and standard Meta edge headers.
# Impact: Audience Network bidding seat is effectively disabled in production traffic, reducing competition and potential yield.

Copilot

Pull Request Overview

This PR fixes a production authentication failure in the Meta Audience Network S2S bidding integration by adding the missing ext.security_app_id field to OpenRTB requests. The issue was causing 400 errors with "Error validating authentication token" in production mode (test=0) while test mode (test=1) continued to work.

Added securityAppId field to AudienceNetworkExt class with proper JSON serialization
Updated AudienceNetworkBidder to pass the platform ID as the security app ID in OpenRTB requests

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
AudienceNetworkExt.java	Added securityAppId field with JsonProperty annotation for OpenRTB serialization
AudienceNetworkBidder.java	Modified request building to include platformId as the securityAppId parameter

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-09-19T08:27:11Z

src/main/java/org/prebid/server/bidder/audiencenetwork/AudienceNetworkBidder.java

                .app(makeApp(bidRequest.getApp(), publisherId))
                .ext(mapper.fillExtension(
-                        ExtRequest.empty(), AudienceNetworkExt.of(platformId, makeAuthId(bidRequest.getId()))))
+                        ExtRequest.empty(), AudienceNetworkExt.of(platformId, makeAuthId(bidRequest.getId()), platformId)))


The platformId parameter is passed twice - once for the platformid field and again for the securityAppId field. Consider extracting this to a variable or adding a comment explaining why the same value is used for both fields to improve code clarity.

PeakLee · 2025-09-19T09:32:29Z

@SerhiiNahornyi help to check it

osulzhenko · 2025-09-19T16:27:48Z

@PeakLee pls fix checkstyle

Error:  /home/runner/work/prebid-server-java/prebid-server-java/src/main/java/org/prebid/server/bidder/audiencenetwork/AudienceNetworkBidder.java:121: Line is longer than 120 characters (found 123). [LineLength]
Error:  /home/runner/work/prebid-server-java/prebid-server-java/src/main/java/org/prebid/server/bidder/audiencenetwork/proto/AudienceNetworkExt.java:6: Leave empty row after class/interface/enum definition! [RegexpMultiline]

…roperty annotation

PeakLee · 2025-09-20T08:51:02Z

@PeakLee pls fix checkstyle

Error:  /home/runner/work/prebid-server-java/prebid-server-java/src/main/java/org/prebid/server/bidder/audiencenetwork/AudienceNetworkBidder.java:121: Line is longer than 120 characters (found 123). [LineLength]
Error:  /home/runner/work/prebid-server-java/prebid-server-java/src/main/java/org/prebid/server/bidder/audiencenetwork/proto/AudienceNetworkExt.java:6: Leave empty row after class/interface/enum definition! [RegexpMultiline]

@osulzhenko please check it again, just fixed the checkstyle issue and import missed "JsonProperty" annotation

osulzhenko · 2025-09-22T07:37:30Z

@PeakLee it still has invalid code in tests. Please take a look when you have time

Error:  COMPILATION ERROR : 
[INFO] -------------------------------------------------------------
Error:  /home/runner/work/prebid-server-java/prebid-server-java/src/test/java/org/prebid/server/bidder/audiencenetwork/AudienceNetworkBidderTest.java:[484,43] method of in class org.prebid.server.bidder.audiencenetwork.proto.AudienceNetworkExt cannot be applied to given types;
  required: java.lang.String,java.lang.String,java.lang.String
  found:    java.lang.String,java.lang.String
  reason: actual and formal argument lists differ in length

…in expected output

PeakLee · 2025-09-22T07:58:37Z

really sorry, forget the testcase updated, but i hava just fixed the issue, please check it again @osulzhenko , really appreciated !

@PeakLee it still has invalid code in tests. Please take a look when you have time

Error:  COMPILATION ERROR : 
[INFO] -------------------------------------------------------------
Error:  /home/runner/work/prebid-server-java/prebid-server-java/src/test/java/org/prebid/server/bidder/audiencenetwork/AudienceNetworkBidderTest.java:[484,43] method of in class org.prebid.server.bidder.audiencenetwork.proto.AudienceNetworkExt cannot be applied to given types;
  required: java.lang.String,java.lang.String,java.lang.String
  found:    java.lang.String,java.lang.String
  reason: actual and formal argument lists differ in length

PeakLee · 2025-09-25T06:45:12Z

@AntoxaAntoxic please help to check this merge request, thanks a lot

AntoxaAntoxic

Here is a few comments.

And also a question: Is there the same PR for PBS Go? If yes, please link it here.

Thank you!

AntoxaAntoxic · 2025-09-25T11:17:59Z

src/main/java/org/prebid/server/bidder/audiencenetwork/proto/AudienceNetworkExt.java

+    @JsonProperty("authentication_id")
    String authenticationId;
+
+    @JsonProperty("security_app_id")


@JsonPropertys are redundant here, please remove

AntoxaAntoxic · 2025-09-25T11:18:53Z

src/main/java/org/prebid/server/bidder/audiencenetwork/AudienceNetworkBidder.java

+                .ext(mapper.fillExtension(ExtRequest.empty(),
+                        AudienceNetworkExt.of(platformId, makeAuthId(bidRequest.getId()),
+                                platformId)))


please fix formatting

.ext(mapper.fillExtension( ExtRequest.empty(), AudienceNetworkExt.of(platformId, makeAuthId(bidRequest.getId()), platformId)))

AntoxaAntoxic · 2025-09-25T11:23:29Z

...esources/org/prebid/server/it/openrtb2/audiencenetwork/test-audiencenetwork-bid-request.json

    "authentication_id": "48b7d18b921be9887a5351f31cc85f1326e3da1d8c402dec2bd338cf10bd6b43",
-    "platformid": "101"
+    "platformid": "101",
+    "security_app_id": "101"


May I ask you to change values of the properties to something more readable like

"authentication_id": "authentication_id", "platformid": "platformid", "security_app_id": "platformid"

It'll be much more readable

P.S. I'd nice if you do the same in the AudienceNetworkBidderTest

ok, thanks @AntoxaAntoxic

osulzhenko · 2025-10-23T15:50:14Z

@PeakLee any updates on this one?

PeakLee added 2 commits September 19, 2025 15:59

AudienceNetwork adapter optimize in production

ffb6697

AudienceNetwork adapter optimize in production

c021d3e

Copilot AI review requested due to automatic review settings September 19, 2025 08:26

Copilot AI reviewed Sep 19, 2025

View reviewed changes

AudienceNetwork adapter: fix checkstyle issue and import missed JsonP…

4ba4227

…roperty annotation

AudienceNetwork adapter: update test to include additional parameter …

6ee5138

…in expected output

AudienceNetwork adapter: add security_app_id to bid request JSON

740292a

osulzhenko requested a review from AntoxaAntoxic September 22, 2025 08:47

AntoxaAntoxic requested changes Sep 25, 2025

View reviewed changes

osulzhenko added the work in progress Signals not finished work label Oct 9, 2025

osulzhenko added the blocked label Nov 7, 2025

AudienceNetwork (S2S): add missing ext.security_app_id in OpenRTB requests to fix production auth failures #4196

Are you sure you want to change the base?

AudienceNetwork (S2S): add missing ext.security_app_id in OpenRTB requests to fix production auth failures #4196

Conversation

PeakLee commented Sep 19, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

PeakLee commented Sep 19, 2025

Uh oh!

osulzhenko commented Sep 19, 2025

Uh oh!

PeakLee commented Sep 20, 2025

Uh oh!

osulzhenko commented Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

PeakLee commented Sep 22, 2025

Uh oh!

PeakLee commented Sep 25, 2025

Uh oh!

AntoxaAntoxic left a comment

Choose a reason for hiding this comment

Uh oh!

AntoxaAntoxic Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

AntoxaAntoxic Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

AntoxaAntoxic Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

PeakLee Sep 29, 2025

Choose a reason for hiding this comment

Uh oh!

osulzhenko commented Oct 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

osulzhenko commented Sep 22, 2025 •

edited

Loading