ads.txt is the publisher saying "these SSPs can sell me." But what stops an SSP from simply lying and claiming a publisher it does not represent? The SSP has to say it back, in its own public file. That two-way handshake is sellers.json.
Every SSP or exchange publishes a sellers.json at the root of its own domain, listing every seller account it represents and who they are. ads.txt is the publisher’s half of the declaration; sellers.json is the SSP’s half. Together they make the supply chain checkable from both ends.
A sellers.json entry
| Field | Meaning |
|---|---|
| seller_id | The account id the SSP uses for this seller. Must match the publisher account ID in ads.txt. |
| seller_type | PUBLISHER (sells its own inventory), INTERMEDIARY (resells others’), or BOTH. |
| name / domain | The seller’s business name and domain, unless withheld. |
| is_confidential | 1 means the SSP withholds the seller’s name and domain. |
| is_passthrough | 1 means the SSP is a conduit for inventory it has no direct relationship with. |
Key idea
The seller_type must agree with the ads.txt relationship. A DIRECT line should map to a PUBLISHER (or BOTH) seller; a RESELLER line to an INTERMEDIARY (or BOTH). A DIRECT line pointing at an INTERMEDIARY seller is a type mismatch: the two records disagree about what the relationship is.
Reciprocity, the core handshake
For a line to be genuinely authorized, the publisher account ID in ads.txt must appear as a `seller_id` in that SSP’s sellers.json. If it does not, the SSP is not actually representing that account, and the line is unauthorized. Neither party can forge the other’s file, which is what makes spoofing hard.
- 1Read the ads.txt line:
pubmatic.com, 156209, DIRECT. - 2Fetch
pubmatic.com/sellers.json. - 3Look up
seller_id156209. - 4Found, with a matching type? Authorized. Missing? Unauthorized. Found but wrong type? Type mismatch.
Quick check
An ads.txt line says `pubmatic.com, 999, DIRECT`, but seller_id 999 does not appear in pubmatic.com/sellers.json. Authorized or not?
Note
In the live engine this is exactly check A (authorized), B (type match), C (confidential), and E (passthrough). Run an audit and read those findings against a real publisher.