Server-side identity on every adapter #1558

Overview

Make Trusted Server's server-side identity work on every adapter, and make Axum deployable. That covers the Edge Cookie (EC) and its KV record, server-side ID providers, SharedID handled the way Prebid defines it, and identity written back as first-party cookies on the HTML document response.

Goals

1. Axum is deployable from main as a production service on AWS behind CloudFront and a load balancer.
2. Server-side identity works on Fastly, Axum, Cloudflare and Spin.
3. SharedID is read, stored and sent to bidders the way Prebid defines it, and shared state is passed through each adapter correctly.
4. Identity is written back as first-party cookies on the HTML document response.

Where it stands

Read at main 598a85170 on 2026-11-11.

• Only Fastly has server-side identity. Axum, Cloudflare and Spin build an EC context for consent only, with no record store.
• The identity logic is shared in core (KvIdentityGraph). The record backend is per adapter because EdgeZero's KvStore has no conditional writes or strong reads.
• Axum on main is a development server. The Axum RC tag v0.1.1-rc-axum.202611.2 runs the EC on DynamoDB for a demo, on an October base pinned to an EdgeZero RC tag.
• On main, the sharedId cookie path reads SharedID only from a cookie named sharedId and stores it under sharedid.org, and every request builder sends EIDs only in user.ext.eids. No server code writes it back to the browser.

Approach

• Land the async EC store (Make shared EC persistence awaitable #1526) and the EdgeZero PR 275 cutover (Cut Trusted Server over to EdgeZero PR 275 #1506), then the identity provider stack on top.
• Run the record on one EcKvStore over EdgeZero's KvStore once EdgeZero adds conditional writes and strong reads, and delete the per-adapter backends.
• Forward-port the Axum RC units to main instead of merging the RC.

Related

• EdgeZero epic: Platform capabilities for server-side identity on every adapter edgezero#468, the platform capabilities this needs.
• Make the Axum adapter production-ready for self-hosted deployments edgezero#391, Axum production readiness.
• Make the Axum adapter a supported self-hosted deployment target #1236, Axum self-hosting: a related epic. The two are not nested, and the Axum deployment tickets for this work are filed under this epic.
• Integrate Auctioneer into Trusted Server on EdgeZero PR 275 #1505 and Cut Trusted Server over to EdgeZero PR 275 #1506, the EdgeZero PR 275 cutover.
• Spec and plan: Add server-side identity on every adapter spec and plan #1559.
• ID5 support for data identity provider #90, the earlier SharedID epic, stays where it is and closes when Add identity providers for ID5, LiveIntent, LiveRamp, ConnectID and UID2 #1488 merges.

Done when

• Axum deploys from main with the EC, its record store, trusted client IP and geo, on released or explicitly approved EdgeZero revisions.
• One EC lifecycle and one record backend run on all four adapters, or an adapter rejects identity configuration at startup with a clear error.
• Server-side identity providers run on every adapter that has a record store.
• SharedID uses the publisher's Prebid storage name and source pubcid.org with atype 1, and bidders never receive the same ID twice.
• The SharedID and mirror cookies are written on the document response under the consent rules in the spec.
• Settings, registries, store clients and HTTP clients are built once per process or isolate, per-request state lives in the request, and no block_on runs inside async code.
• EIDs go out in OpenRTB 2.6 user.eids.
• Identify and batch sync are answered locally on every adapter.
• Provider lookups, batch sync, pull sync and record creation are rate limited, and record creation is refused for non-browser clients.
• An identity-only page script mode exists.
• The Axum production image is published and attested, and the reference infrastructure runs more than one task with dependency-aware readiness.