Skip to content

Server-Side Verification (SSV)

Server-side verification (SSV) callbacks confirm user rewards for ad engagement. They are requests sent by Google directly to your server when a user finishes watching a rewarded ad.

Note

Server-side verification is an optional feature. You can still use the standard client-side callback (on_user_earned_reward) to grant rewards.

Prerequisites

Client-Side Configuration

To pass custom data or a user identifier to your server-side callback, you must configure the verification options on the loaded rewarded ad before showing it.

# Create the verification options
var ssv_options := ServerSideVerificationOptions.new()
ssv_options.custom_data = "SAMPLE_CUSTOM_DATA_STRING"
ssv_options.user_id = "USER_ID_TO_REWARD"

# Set options on the loaded RewardedAd or RewardedInterstitialAd
rewarded_ad.set_server_side_verification_options(ssv_options)

// Create the verification options
var ssvOptions = new ServerSideVerificationOptions
{
    CustomData = "SAMPLE_CUSTOM_DATA_STRING",
    UserId = "USER_ID_TO_REWARD"
};

// Set options on the loaded RewardedAd or RewardedInterstitialAd
rewardedAd.SetServerSideVerificationOptions(ssvOptions);

Tip

The custom data string is percent-escaped in the URL and might require decoding when parsed by your server.

SSV Callback Parameters

Server-side verification callbacks contain query parameters that describe the rewarded ad interaction. Parameter names, descriptions, and example values are listed below (sent in alphabetical order):

Parameter Name Description Example value
ad_network Ad source identifier for the ad source that fulfilled this ad. 5450213213286189855
ad_unit AdMob ad unit ID that was used to request the rewarded ad. ca-app-pub-3940256099942544/5224354917
custom_data Custom data string provided by your app (e.g., SAMPLE_CUSTOM_DATA_STRING). SAMPLE_CUSTOM_DATA_STRING
key_id Key to be used to verify the SSV callback. This value maps to a public key provided by the AdMob key server. 1234567890
reward_amount Reward amount as specified in the ad unit settings. 10
reward_item Reward item as specified in the ad unit settings. coins
signature Signature for the SSV callback generated by AdMob. MEUCIQCLJS_s4ia...
timestamp Timestamp of when the user was rewarded as Epoch time in ms. 1507770365237823
transaction_id Unique hex-encoded identifier for each reward grant event. 18fa792de1bca816048293fc71035638
user_id User identifier as provided by your app (if set). 1234567

Verifying the Callback on Your Server

To verify that the callback is authentic and actually sent by Google, you must check the signature using AdMob's public keys.

1. Fetch Google's Public Keys

Download the trusted public keys JSON from the AdMob key server: https://gstatic.com/admob/reward/verifier-keys.json

2. Prepare the Content to Verify

The query parameters of the callback URL specify the content to be verified. The signature and key_id parameters are always the last parameters in the query string, in that order.

Extract the substring from the beginning of the query string up to (but not including) &signature=. The order of query parameters must not be changed.

For example, if your callback URL is: https://www.myserver.com/path?ad_network=54...&ad_unit=...&user_id=123&signature=ME...&key_id=1268

The content to verify is: ad_network=54...&ad_unit=...&user_id=123

3. Perform Signature Verification

  1. Parse the public keys JSON fetched in step 1.
  2. Find the public key matching the key_id query parameter value.
  3. Verify the signature (ECDSA SHA256 DER) against the prepared content string using the public key.

FAQ

Can I cache the public keys provided by the AdMob key server?

Yes, we recommend caching the public keys to reduce network requests. However, note that public keys are regularly rotated and should not be cached for longer than 24 hours.

What happens if my server cannot be reached?

Google expects an HTTP 200 OK success status response code. If your server cannot be reached or fails to return a success code, Google will retry sending the callback up to 5 times in 1-second intervals.

How can I verify that SSV callbacks originate from Google?

In addition to checking the signature, you can use reverse DNS lookup on the incoming IP address to verify that the request originates from Google.