app-ads.txt is a plain text file, published on an app developer's website, that lists every advertising system and account permitted to sell advertising inside that developer's apps. Its formal name is Authorized Sellers for Apps. It extends ads.txt, the web standard that lets site owners name their authorised sellers, to software distributed through mobile and connected television (CTV) app stores. It exists because an app has no web address on which to host such a list, while anyone can claim to sell a popular app's inventory in a bid request. By linking the app store listing to a domain the developer controls, the standard gives buyers a public record against which to check that claim.

How the file works

The chain starts in the app store. A developer must enter a website address in each store listing, and publishing that address is a precondition for taking part, according to the app-ads.txt specification maintained by the IAB Technology Laboratory (IAB Tech Lab). The file then sits at the root of that domain, at /app-ads.txt, rather than on the site's /ads.txt path, so that web and app authorisations are managed separately.

Each line of the file carries up to four comma-separated fields, inherited unchanged from ads.txt version 1.1:

  • Field one is the canonical domain of the advertising system, such as a supply-side platform (SSP) or exchange.
  • Field two is the publisher's account ID on that system, which must match the value sent in transactions, typically the publisher.id field in an OpenRTB bid request.
  • Field three is the relationship: DIRECT when the developer controls the account, RESELLER when another company controls it with the developer's permission.
  • Field four, optional, is a certification authority ID, in practice the identifier issued by the Trustworthy Accountability Group (TAG).

Google's AdMob documentation gives a typical line as google.com, pub-00000000000000, DIRECT, f08c47fec0942fa0, where the final string is Google's TAG identifier.

Verification runs the other way. An SSP sending a bid request must include the storeurl field, the address of the app's store listing, which TAG's Inventory Quality Guidelines already required. A buyer or seller platform acting as an authorised seller verifier reads that URL, crawls the listing to extract the developer website, bundle ID and store ID, and checks that the IDs match those in the bid request. It then reduces the developer address to a canonical domain, stripping "www." and "m." prefixes and keeping at most one subdomain, fetches /app-ads.txt over HTTPS, and checks whether the seller's domain and publisher.id appear. A request from an account that is not listed is unauthorised.

Verifiers should crawl each store listing no more than weekly, and only for apps sending them impressions. Under the ads.txt rules, cached files default to a seven-day expiry where no cache headers apply. A developer changing domains is advised to keep the old file live for about 30 days. A developer who wants no programmatic sellers at all publishes a single placeholder record, placeholder.example.com, placeholder, DIRECT, placeholder, so that an empty file is not mistaken for an error page.

Three variables have since been layered on. INVENTORYPARTNERDOMAIN points to the ads.txt file of a partner that also holds rights to sell ads within the app, a common arrangement in streaming. OWNERDOMAIN names the business that owns the app, and MANAGERDOMAIN names an exclusive monetisation partner, optionally per country.

Developers and publishers write the file, often by pasting lines supplied by their networks. SSPs and mediation platforms check it before accepting supply, and demand-side platforms (DSPs) check it before bidding.

From the web to app stores

ads.txt arrived in the spring of 2017; IAB Tech Lab dates version 1.0 to June 2017, while some trade reports give May. It targeted domain spoofing and unauthorised reselling on the web and, as the original ads.txt coverage on PPC Land noted, did not work in apps.

Mobile proposals circulated in July 2018. The IAB Tech Lab opened a beta on November 30, 2018, and the app-ads.txt beta release took public comment until February 4, 2019. Curtis Light of Google and Curt Larson of Sharethrough are listed as the specification's authors. "The beta release of app-ads.txt addresses an important gap in eradicating fraudulent inventory," Dennis Buchheim, then senior vice president and general manager of IAB Tech Lab, said at the time.

The final version was released on March 13, 2019, with no changes to publisher instructions, according to IAB Tech Lab. PubMatic said it would enforce the standard from May 1, 2019, according to Marketing Dive. Google followed in stages: it announced plans for Display & Video 360 (DV360) in May 2019, the same week it made authorised-only web buying the DV360 default, blocked unauthorised app inventory in AdMob and Ad Manager from August 27, 2019, and DV360 began enforcement that September.

Adoption was quick from a low base. Pixalate counted growth of 5,550% in 2019, with more than 110,000 apps carrying a valid file. In May 2020 Google let Ad Manager publishers manually recrawl their files, surfacing errors such as a developer site blocked by robots.txt.

CTV forced the next revision. Streaming programmers often share ad slots with distributors, and each party once had to copy the other's full seller roster. Version 1.0.3, opened for comment in December 2020 and finalised in March 2021, added INVENTORYPARTNERDOMAIN; Neal Richter, then chief scientist at SpotX, wrote that the change "returns control to the media owner", according to IAB Tech Lab. Version 1.1, final in July 2022, added OWNERDOMAIN and MANAGERDOMAIN.

Why buyers and developers care

For advertisers, the file is the first filter between a budget and counterfeit supply. DV360 added reporting dimensions separating authorised direct sellers, authorised resellers, ineligible sources and non-participating publishers, so an agency can see where its spend went. Google advised publishers in May 2022 to set up files for every relevant CTV store before buyers began enforcing.

For developers, the file is becoming mandatory. AdMob required app-ads.txt verification for new apps from January 2025, extending it to existing apps through the year.

Coverage is still uneven. HUMAN Security found in May 2023 that 25% of CTV and app bid requests came from apps without a known app-ads.txt file, against 3% on the web, and that 58% of app and CTV requests lacked an OWNERDOMAIN declaration.

Where it fails

The specification is candid about its limits. It "cannot stop an unscrupulous ad platform from misrepresenting an unauthorized publisher ID as an authorized one", and it states that authorised inventory "must still be screened and monitored for invalid traffic". The file confirms that an account may sell, not that a real person saw the ad.

Spoofing exploits that gap. The bundle ID in a bid request is self-declared, so a fraudster can borrow a legitimate app's identity and its authorised publisher ID, a weakness detailed in PPC Land's app bundle ID explainer. In the Konfety case, HUMAN found more than 250 Google Play decoy apps whose malicious twins spoofed the originals' package names and publisher IDs, peaking at 10 billion requests a day. Pixalate reported in March 2024 that 52% of traffic claiming to come from Roku devices originated elsewhere; that figure comes from a vendor selling detection services.

The design also depends on app stores publishing developer URLs, bundle IDs and store IDs in standard HTML meta tags, and crawling every store is costly. IAB Tech Lab runs an aggregator for that reason; only in December 2023 did it add Samsung, Vizio and LG, charging API subscribers $2,500 for members and $4,500 for non-members.

Granularity is another complaint: one file covers every app on a domain. Brian O'Kelley, chief executive of Scope3, argued in March 2026 that ads.txt cannot express which property, placement, country or dates an authorisation covers, and proposed adagents.json as a replacement. Neal Richter, now at Amazon, defended the original design while welcoming its evolution.

Not the same as

  • ads.txt covers websites and sits on the site's own domain. app-ads.txt uses identical syntax but is reached through an app store listing, ignores the SUBDOMAIN directive and lives at a different path.
  • sellers.json is published by the SSP or exchange, not the developer. It identifies who owns each seller account, so a buyer can match an app-ads.txt line to a named business.
  • The SupplyChain object travels inside each bid request and records every intermediary that handled it. app-ads.txt is a static list; schain is per-transaction.
  • An app bundle ID identifies the app itself. It is the key a verifier uses to find the right file, not an authorisation.

Recent developments

IAB Europe's April 2026 guide to programmatic CTV expects publishers to maintain app-ads.txt alongside sellers.json and schain, reporting that 73% of European publishers had adopted supply chain standards as of August 2025, while flagging gaps in CTV store coverage.

DoubleVerify reported in May 2026 that fraudulent CTV apps detected in 2025 numbered ten times the 2024 count. In July 2026 HUMAN disrupted NewsJunkie, which spoofed device, app and IP details through server-side ad insertion at close to two billion requests a day per seller.

The industry response pairs the file with device-level proof. Version 11.0 of the Trustworthy Accountability Group's certification, released in July 2026, requires direct sellers to publish app-ads.txt for every monetised app with TAG IDs for each intermediary, and requires sellers of their own apps in Apple's App Store and Amazon's Fire TV store to support device attestation. As of October 2026, the IAB Tech Lab has moved the app-ads.txt, ads.txt and sellers.json specifications to GitHub, with app-ads.txt itself still at version 1.0.

Timeline

  • Spring 2017 - IAB Tech Lab releases ads.txt for websites (version 1.0 dated June 2017 by IAB Tech Lab; some reports say May).
  • July 2018 - Mobile proposals for an app version of ads.txt circulate.
  • November 30, 2018 - app-ads.txt beta opens for implementation and comment.
  • February 4, 2019 - Public comment period closes.
  • March 13, 2019 - Final app-ads.txt 1.0 released alongside ads.txt 1.0.2.
  • May 1, 2019 - PubMatic begins enforcement.
  • August 27, 2019 - Google blocks unauthorised app inventory in AdMob and Ad Manager.
  • September 2019 - DV360 stops bidding on unauthorised app inventory.
  • December 20, 2019 - IAB Tech Lab publishes CTV guidance on app identification.
  • May 2020 - Google adds manual app-ads.txt recrawl in Ad Manager.
  • March 2021 - ads.txt 1.0.3 adds INVENTORYPARTNERDOMAIN for shared CTV inventory.
  • May 2022 - Google advises publishers to cover all CTV app stores.
  • July 2022 - ads.txt 1.1 adds OWNERDOMAIN and MANAGERDOMAIN.
  • May 10, 2023 - HUMAN reports 25% of app and CTV bid requests lack a known file.
  • December 2023 - IAB Tech Lab adds Samsung, Vizio and LG to its aggregator.
  • January 2025 - AdMob requires app-ads.txt verification for new apps.
  • March 30, 2026 - Brian O'Kelley proposes adagents.json as an ads.txt successor.
  • April 4, 2026 - IAB Europe publishes its programmatic CTV guide.
  • July 2026 - TAG certification 11.0 adds device attestation requirements.
  • September 14, 2026 - IAB Tech Lab's ads.txt page last updated, pointing to GitHub-hosted specifications.

Summary

Who: App developers and CTV programmers publish app-ads.txt files. SSPs, ad networks, mediation platforms and DSPs such as DV360 read and enforce them. The IAB Tech Lab maintains the standard, written by Curtis Light of Google and Curt Larson of Sharethrough with the OpenRTB working group.

What: A plain text file at the root of a developer's website listing each authorised advertising system, account ID and relationship type, found by following the developer URL in an app store listing and checked against the publisher ID in bid requests.

When: Released in beta on November 30, 2018 and finalised on March 13, 2019. Google enforced it from August 2019, the CTV inventory partner directive arrived in March 2021, and AdMob made verification mandatory for new apps from January 2025.

Where: At /app-ads.txt on the developer's canonical domain, for apps in mobile stores such as Google Play and the Apple App Store and CTV stores including Roku, Amazon Fire TV, Samsung, Vizio and LG.

Why: Apps have no web domain of their own, so buyers had no way to check whether a seller claiming an app's inventory was authorised. The file closes that gap, but it cannot prove that an impression reached a real device, which is why spoofing and CTV fraud keep pushing the industry towards attestation and richer formats.