Examples and local verification

Downloads

File	Purpose
banner-request.json	Single-impression Banner / App request
video-request.json	Single-impression Video / Site request
native-request.json	Serialized Native JSON request, using 1.2 as an example
bid-response.json	DSP gross bid correlated with the Banner example, not the final SSP net response
sign-request.mjs	Local Node.js metadata signing, with no network requests
signature-vector.json	Public test key, fixed inputs, canonical message, and expected signature

All domains, IDs, creative URLs, and notification URLs are illustrative. They do not represent configured partners or available advertising assets. JSON examples demonstrate protocol structure, not successful rendering or complete Native / VAST validation. Replace them with lawful, mutually agreed assets for actual rendering tests.

Run locally without credentials

Install Node.js 24 or later and download sign-request.mjs and signature-vector.json into the same directory. In a terminal without any of the G24_* inputs listed below, run:

node sign-request.mjs

Default mode prints an explicit PUBLIC TEST VECTOR ONLY warning. Standard output contains only the four authentication headers; standard error contains safety notices. It does not contact G24ad, store a private key, or prove production authentication. The vector’s fixed timestamp and nonce are unsuitable for live traffic.

Expected signature:

25c4e834eb439acc4a75b35fbbbb5fbb0dea3a90d0c7a79331c35325332e0539

The test key is 32 public bytes of 0x11. The canonical message contains eight fields, seven LF separators, and no trailing LF. CRLF or a final LF produces a different signature.

Real inputs, still no request

Supply the following environment variables to Node through a controlled credential-injection mechanism. Do not put a real secret in shell arguments, scripts, repositories, or chat. Do not send the printed authentication headers to public logs.

Variable	Required	Meaning
`G24_SECRET_BASE64`	Yes	Securely obtained canonical Base64 encoding of the 32-byte key
`G24_AUDIENCE`	Yes	Agreed audience
`G24_SSP_ID`	Yes	SSP ID
`G24_KEY_ID`	Yes	Key ID for this attempt
`G24_TIMESTAMP_MS`	No	Defaults to current Unix milliseconds; fixed values are for diagnostics
`G24_NONCE`	No	Defaults to 16 random bytes; never reuse a fixed value in live calls
`G24_REQUEST_PATH`	No	Defaults to the path constructed from SSP ID; if supplied must match exactly, without query

Partial environment configuration fails rather than falling back to the test key. Run the same node sign-request.mjs command; all command-line arguments are rejected. Environment mode also only calculates and prints headers without sending them anywhere. Environment variables are not a complete secret-management solution; protect the runtime and its output.

Import into client code

import { signRequest } from './sign-request.mjs';
import { randomBytes } from 'node:crypto';

const sspId = process.env.G24_SSP_ID;
const { headers } = signRequest({
  audience: process.env.G24_AUDIENCE,
  sspId,
  method: 'POST',
  path: `/openrtb/${sspId}`,
  keyId: process.env.G24_KEY_ID,
  timestampMs: String(Date.now()),
  nonce: randomBytes(16).toString('hex'),
  secretBase64: process.env.G24_SECRET_BASE64,
});
// Pass headers to a controlled client. This example deliberately sends nothing.

signRequest is a pure calculation: it does not read environment variables, generate time or nonce values, store replay state, or mutate its input. It validates necessary scalar and key formats but is not a production SDK. It does not establish server clock acceptance, credential activation, or absence of duplicate HTTP headers; the sender must set each returned header exactly once. It makes no guarantee of complete memory erasure or secret management.

Expected bid transformation

bid-response.json has gross 3.0 and unreplaced ${AUCTION_PRICE} macros. If the agreed margin is 10%, the final SSP response has net 2.700000, while price macros in notification URLs and adm use gross 3.000000. Actual configuration may differ; these values are not fixed commercial terms.

Next: HMAC authentication · Field reference · Launch checklist.

Protocol and implementation checked: 2026-09-21.