SharedID Edge

SharedID Edge is a small open-source edge worker that keeps the Prebid SharedID durable. It runs on a route of your own domain (www.example.com/_sid/*) on the CDN that already serves your site, and sets the SharedID as a server-set first-party cookie, so Safari doesn't cap it at 7 days.

It replaces the WordPress and Drupal SharedID plugins and the endpoint examples in the SharedID docs: it implements the same pixelUrl contract, so Prebid.js needs no code change. Unlike those, it answers at the CDN edge, so your origin sees no extra traffic.

It also has a module interface for IDs and signals that are best computed at the edge (connecting IP, geography, bot scores, device data), returned to the page in one JSON response. See the proposal for the background.

SharedID across Prebid.js

Of the Prebid.js sites running the User ID module, the share that also run SharedID.

66% run SharedID

• SharedID (sharedIdSystem)236,356
• Other User ID setups120,702
• All User ID module (userId)357,058

Data: OpenSincera by Sincera, part of The Trade Desk: detections of each Prebid.js module over the 90 days before November 12, 2026 (mapping_modules). Thanks to Sincera for the open data.

How it works

Browser (www.example.com)                       Your CDN, same host: www.example.com/_sid/*
 └─ Prebid.js sharedIdSystem ── pixelUrl ──►  /_sid/sync?id=pubcid:<id>
                                                 ├─ choose the ID (see below)
                                                 └─ Set-Cookie: _pubcid=<id>; Max-Age=31536000; Secure; SameSite=Lax
                                                    Set-Cookie: _pubcid_sv=<id>; …; HttpOnly   (recovery copy)

1. Prebid.js's sharedIdSystem calls pixelUrl with the ID it has (?id=pubcid:<id>), on the first visit and, with extend: true, on later ones.
2. The worker answers with a 1×1 GIF and sets the ID as a cookie with a one-year lifetime. Cookies set by a first-party server aren't subject to Safari's 7-day cap on cookies written by script.
3. Prebid.js reads the cookie back after the pixel loads, so the server's value wins.
4. The worker also sets an HttpOnly copy, _pubcid_sv. If Safari caps or clears the script-readable cookie and the page mints a new ID, the next sync restores the original from this copy.

The worker never replaces an existing ID: when you turn it on, it adopts the IDs your visitors already have. It answers only its own routes and never forwards them to your origin, and it never adds cookies to your cacheable pages.

Why it must run on your site's CDN: since Safari 16.4, cookies set by a server whose IP address doesn't match the website's are capped at 7 days too. A separate service behind a CNAME doesn't work; a route on the CDN that serves www.example.com does.

Pick your platform

Deploy on the platform that serves your site. Each guide works on its own, from prerequisites to verifying the deployment.

Platform	How it runs
Akamai EdgeWorkers	An EdgeWorker (responseProvider) on a /_sid/* rule of your site's Akamai property.
AWS (Lambda and CloudFront)	A Lambda function behind a /_sid/* behaviour of your site's CloudFront distribution.
Azure (Functions and Front Door)	An Azure Functions app behind a /_sid/* route of your site's Front Door profile.
Cloudflare Workers	A Worker on a route of your proxied Cloudflare zone (www.example.com/_sid/*).
Google Cloud (Cloud Run functions and Load Balancing)	A Cloud Run function behind a /_sid/* path rule of your site's external Application Load Balancer.
Node.js (self-hosted)	A Node.js server behind the web server or load balancer that serves your site.
Vercel	A Next.js route handler, or Routing Middleware, in your site's Vercel project.

Turn it on in Prebid.js

Build Prebid.js with userId and sharedIdSystem, and point pixelUrl at the sync route on your own host:

pbjs.setConfig({
  userSync: {
    userIds: [{
      name: 'sharedId',
      params: { pixelUrl: '/_sid/sync', extend: true },
      storage: { type: 'cookie', name: '_pubcid', expires: 365 }
    }]
  }
});

Configure Prebid.js explains each option, three Prebid.js issues fixed in 11.49.0, and how to pass the modules' output to the auction.

Modules

Modules are built in, and none runs until you list it in SID_MODULES. See Modules.

bot: bot and staff-traffic signals; geo: the visitor's location as device.geo; ip: the real client IP; reflect: keep other first-party cookies durable; ua: device data and the bot flag; dbip: DB-IP Lite country (vendor module, offline); ec: Trusted Server Edge Cookies (vendor module, offline; ⚠ IP-derived ID); maxmind: MaxMind GeoLite2 country (vendor module, offline; needs MAXMIND_ACCOUNT_ID, MAXMIND_LICENSE_KEY at build time).

Documentation

Also on the web at sharedid.dev.

• Configure Prebid.js
• Responses: every route's response, with real output
• Configuration reference: every SID_* setting
• Consent and opt-out: opt-out, GPC, COPPA and TCF
• Modules: choosing modules, /_sid/sync, the traffic signal, and the module index
• Migrate from the WordPress or Drupal plugin
• Troubleshooting
• Development: checks, conformance, adding a module or adapter, and the roadmap
• Specification, and the conformance suite that tests it

Contributing

Issues and pull requests are welcome. Read AGENTS.md and Development first: behaviour changes start in the specification, every change ships its docs, and npm run check runs what CI runs.

License

Apache-2.0