Repository navigation
Add request signing and key publishing for downstream verification #69
Description
Implement JOSE-based request signing within Trusted Server so that any downstream buyer (e.g., DSP, ad-server, or verification partner) can verify the authenticity of a request without shared secrets or mTLS.
Trusted Server will sign each outgoing ad request (e.g., to Prebid Server or any downstream endpoint) using a detached JWS (Ed25519) signature and publish its corresponding public keys via a JWKS endpoint. This enables verifiers to validate integrity and origin at scale, with minimal operational overhead for key rotation.
Metadata
Metadata
Assignees
Labels
No labels
Activity
[-]Add request signing and key publishing for downstream DSP verification[/-][+]Add request signing and key publishing for downstream verification[/+]bmayd commentedon Nov 12, 2025
In the Tech Lab Data Deletion Request Framework we included a required file (dsrdelete.json) for configuration information (including the location of the JWKS) that was discoverable in the .well-known directory. You might consider including a similar configuration file for Trusted Server which points to your JWKS rather than including the JWKS itself in the .well-known directory. This would make it easier to organize and manage Trusted Server resources, allow for discovery of domains supporting Trusted Server and allow you to add additional configuration parameters.
jevansnyc commentedon Nov 13, 2025
Thanks Brian, we'll put this on the roadmap and I'll check with Rowena on the requirements.