diff --git a/AUCTION_ORCHESTRATION_FLOW.md b/AUCTION_ORCHESTRATION_FLOW.md
new file mode 100644
index 0000000..4e7dda6
--- /dev/null
+++ b/AUCTION_ORCHESTRATION_FLOW.md
@@ -0,0 +1,242 @@
+# 🎯 Auction Orchestration Flow
+
+## 🔄 System Flow Diagram
+
+```mermaid
+%%{init: {
+  "theme": "base",
+  "themeVariables": {
+    "background": "#ffffff",
+    "primaryColor": "#dbeafe",
+    "primaryTextColor": "#1e3a8a",
+    "primaryBorderColor": "#2563eb",
+    "lineColor": "#334155",
+    "secondaryColor": "#fef3c7",
+    "tertiaryColor": "#d1fae5",
+    "actorBkg": "#eff6ff",
+    "actorBorderColor": "#3b82f6",
+    "actorTextColor": "#1e40af",
+    "actorLineColor": "#64748b",
+    "signalColor": "#1e293b",
+    "signalTextColor": "#0f172a",
+    "labelBoxBkgColor": "#f1f5f9",
+    "labelBoxBorderColor": "#cbd5e1",
+    "labelTextColor": "#1e293b",
+    "loopTextColor": "#1e293b",
+    "noteBkgColor": "#fef3c7",
+    "noteBorderColor": "#d97706",
+    "noteTextColor": "#78350f",
+    "activationBorderColor": "#059669",
+    "activationBkgColor": "#d1fae5",
+    "sequenceNumberColor": "#0f172a"
+  },
+  "themeCSS": ".sequenceNumber{font-size:26px!important;font-weight:900!important;fill:#ffffff!important;paint-order:stroke fill;stroke:#1e293b;stroke-width:1px;} .sequenceNumber circle{r:32px!important;stroke-width:3px!important;stroke:#1e293b!important;fill:#2563eb!important;} .mermaid svg{background:#ffffff!important;border-radius:8px;box-shadow:0 2px 4px rgba(0,0,0,0.06);} .actor{font-weight:600!important;} .messageText{font-weight:600!important;font-size:16px!important;} .activation0{stroke-width:3px!important;} .messageLine0,.messageLine1{stroke-width:3px!important;} .messageText tspan{font-size:16px!important;} path.messageLine0,path.messageLine1{stroke-width:3px!important;} marker#arrowhead path,marker#crosshead path{stroke-width:2px!important;}"
+}}%%
+sequenceDiagram
+  autonumber
+
+  participant Client as 🌐 Browser/TSJS
+  participant TS as 🛡️ Trusted Server
+  participant Orch as 🎯 Orchestrator
+  participant APS as 📦 APS Provider
+  participant Prebid as 🎰 Prebid Provider
+  participant Med as ⚖️ AdServer Mediator
+  participant Mock as 🎭 Mocktioneer
+
+  %% === Auction Request Initiation ===
+  rect rgb(243,244,246)
+    Note over Client,Mock: 🚀 Auction Request Initiation
+    activate Client
+    activate TS
+    Client->>TS: POST /auction<br/>AdRequest with adUnits[]
+    Note right of Client: { "adUnits": [{ "code": "header-banner",<br/>  "mediaTypes": { "banner": { "sizes": [[728,90]] } } }] }
+    
+    TS->>TS: 🔧 Parse AdRequest<br/>🔄 Transform to AuctionRequest<br/>🆔 Generate user IDs<br/>📊 Build context
+    deactivate Client
+    deactivate TS
+  end
+
+  %% === Orchestrator Strategy Detection ===
+  rect rgb(239,246,255)
+    Note over Client,Mock: 🧠 Auction Strategy Detection
+    activate TS
+    activate Orch
+    TS->>Orch: orchestrator.run_auction()
+    Orch->>Orch: 🔍 Detect strategy<br/>mediator? parallel_mediation : parallel_only
+    deactivate TS
+    
+    Note over Orch: Strategy determined by config:<br/>[auction]<br/>mediator = "adserver_mock" → parallel_mediation<br/>No mediator → parallel_only
+  end
+
+  %% === Parallel Provider Execution ===
+  rect rgb(243,232,255)
+    Note over Client,Mock: 🔄 Parallel Provider Execution
+    activate APS
+    activate Prebid
+    activate Mock
+    
+    par Parallel Provider Calls
+      Orch->>APS: POST /e/dtb/bid<br/>APS TAM format
+      Note right of Orch: { "pubId": "5128",<br/>  "slots": [{ "slotID": "header-banner",<br/>    "sizes": [[728,90]] }] }
+      
+      APS->>Mock: APS TAM request
+      Mock-->>APS: APS bid response<br/>(encoded prices, no creative)
+      Note right of Mock: { "contextual": { "slots": [{<br/>  "slotID": "header-banner",<br/>  "amznbid": "Mi41MA==", // "2.50"<br/>  "fif": "1" }] } }
+      
+      APS-->>Orch: AuctionResponse<br/>(APS bids)
+    and
+      Orch->>Prebid: POST /openrtb2/auction<br/>OpenRTB 2.x format
+      Note right of Orch: { "id": "request",<br/>  "imp": [{ "id": "header-banner",<br/>    "banner": { "w": 728, "h": 90 } }] }
+      
+      Prebid->>Mock: OpenRTB request
+      Mock-->>Prebid: OpenRTB response<br/>(clear prices, with creative)
+      Note right of Mock: { "seatbid": [{ "seat": "prebid",<br/>  "bid": [{ "price": 2.00, "adm": "<html>..." }] }] }
+      
+      Prebid-->>Orch: AuctionResponse<br/>(Prebid bids)
+    end
+    
+    Note over Orch: 📊 Collected bids from all providers<br/>APS: encoded prices, no creative<br/>Prebid: clear prices, with creative
+    deactivate Mock
+    deactivate APS
+    deactivate Prebid
+  end
+
+  %% === Winner Selection Strategy ===
+  alt Mediator Configured (parallel_mediation)
+    rect rgb(236,253,245)
+      Note over Client,Mock: ⚖️ Mediation Flow
+      activate Med
+      Orch->>Med: POST /adserver/mediate<br/>All bids for final selection
+      Note right of Orch: { "id": "auction-123",<br/>  "imp": [...],<br/>  "ext": { "bidder_responses": [<br/>    { "bidder": "amazon-aps",<br/>      "bids": [{ "encoded_price": "Mi41MA==" }] },<br/>    { "bidder": "prebid",<br/>      "bids": [{ "price": 2.00 }] }] } }
+      
+      Med->>Med: 🔓 Decode APS encoded prices<br/>📏 Apply floor prices<br/>🏆 Select highest CPM per slot
+      Note right of Med: Base64 decode: "Mi41MA==" → "2.50"<br/>Winner: APS at $2.50 vs Prebid at $2.00
+      
+      Med-->>Orch: OpenRTB response with winners
+      Note right of Med: { "seatbid": [{ "seat": "amazon-aps",<br/>  "bid": [{ "price": 2.50, "impid": "header-banner" }] }] }
+      deactivate Med
+    end
+  else No Mediator (parallel_only)
+    rect rgb(253,243,235)
+      Note over Client,Mock: 🏆 Direct Winner Selection
+      Orch->>Orch: 📏 Compare clear prices only<br/>⚠️  Skip APS (encoded prices)<br/>🏆 Select highest CPM
+      Note right of Orch: APS bids skipped (encoded prices)<br/>Winner: Prebid at $2.00 (only clear price)
+      
+      Note over Orch: 📝 Results: Limited winner selection<br/>Cannot compare encoded APS prices<br/>Prebid wins by default
+    end
+  end
+
+  %% === Response Assembly ===
+  rect rgb(243,244,246)
+    Note over Client,Mock: 📦 Response Assembly
+    activate TS
+    activate Client
+    Orch->>Orch: 🔄 Transform to OpenRTB response<br/>🖼️ Generate iframe creatives<br/>🔏 Rewrite creative URLs<br/>📊 Add orchestrator metadata
+    
+    Orch-->>TS: OpenRTB BidResponse
+    Note right of Orch: { "id": "auction-response",<br/>  "seatbid": [{ "seat": "amazon-aps",<br/>    "bid": [{ "price": 2.50,<br/>      "adm": "<iframe src=\"/first-party/proxy?tsurl=...\">",<br/>      "w": 728, "h": 90 }] }] }<br/>  "ext": { "orchestrator": {<br/>    "strategy": "parallel_mediation",<br/>    "bidders": 2, "time_ms": 150 } }
+    
+    TS-->>Client: 200 OpenRTB response<br/>with winning creative
+    deactivate Orch
+    deactivate TS
+  end
+
+  %% === Creative Rendering ===
+  rect rgb(239,246,255)
+    Note over Client,Mock: 🖼️ Creative Rendering
+    Client->>Client: 💉 Inject winning creative<br/>🖼️ Render iframe<br/>🌐 Load creative through proxy
+    Note right of Client: iframe src="/first-party/proxy?tsurl=...&tstoken=sig"<br/>Ensures first-party serving<br/>Maintains privacy & security
+    deactivate Client
+  end
+
+```
+
+## 📋 Flow Summary
+
+### **Phase 1: Request Initiation**
+- **Browser** sends `POST /auction` with ad units in Prebid.js format
+- **Trusted Server** parses and transforms to internal `AuctionRequest`
+- Generates user IDs (persistent + fresh) and builds auction context
+
+### **Phase 2: Strategy Detection**
+- **Orchestrator** checks configuration for mediator
+- **With mediator** → `parallel_mediation` strategy
+- **Without mediator** → `parallel_only` strategy
+
+### **Phase 3: Parallel Execution**
+- **APS Provider** receives APS TAM format request
+  - Mocktioneer returns APS response with **encoded prices** (`amznbid: "Mi41MA=="`)
+  - **No creative HTML** provided (typical for real APS)
+- **Prebid Provider** receives OpenRTB 2.x request  
+  - Mocktioneer returns OpenRTB response with **clear prices**
+  - **Includes creative HTML** in `adm` field
+
+### **Phase 4: Winner Selection**
+
+#### **🔄 With Mediator (Recommended)**
+1. **AdServer Mediator** receives all bids
+2. **Decodes APS prices** (base64 → actual CPM)
+3. **Applies floor prices** and selects highest CPM per slot
+4. **Returns OpenRTB response** with proper winner selection
+
+#### **⚡ Without Mediator (Limited)**
+1. **Orchestrator** compares only clear prices
+2. **APS bids skipped** (encoded prices can't be compared)
+3. **Prebid wins by default** if no other clear-price bidders
+
+### **Phase 5: Response Assembly**
+- **Creative HTML** rewritten with first-party proxy URLs
+- **Orchestrator metadata** added (strategy, timing, bid counts)
+- **OpenRTB response** returned to browser
+
+### **Phase 6: Creative Rendering**
+- **Winning creative** injected into iframe
+- **Resources proxied** through first-party domain
+- **Privacy & security** maintained throughout
+
+## 🔑 Key Technical Details
+
+### **Price Encoding**
+- **APS Mock**: Uses base64 encoding (`"Mi41MA=="` → `"2.50"`)
+- **Real APS**: Uses proprietary encoding (only Amazon/GAM can decode)
+- **Prebid**: Uses clear decimal prices (`2.50`)
+
+### **Request Formats**
+- **APS TAM**: `{ "pubId": "...", "slots": [...] }`
+- **OpenRTB 2.x**: `{ "imp": [...] }` 
+- **AdRequest**: `{ "adUnits": [...] }`
+
+### **Response Formats**
+- **APS**: `{ "contextual": { "slots": [...] } }` (no `adm`)
+- **OpenRTB**: `{ "seatbid": [{ "seat": "...", "bid": [...] }] }`
+
+### **Configuration Examples**
+
+#### **Parallel Mediation**
+```toml
+[auction]
+enabled = true
+providers = ["prebid", "aps"]
+mediator = "adserver_mock"  # ← Enables mediation
+timeout_ms = 2000
+```
+
+#### **Parallel Only**
+```toml
+[auction]
+enabled = true
+providers = ["prebid", "aps"]
+# No mediator = direct comparison
+timeout_ms = 2000
+```
+
+### **Advantages of Mediation**
+- ✅ **Proper APS integration** - Can decode and compare APS bids
+- ✅ **Fair competition** - All bidders compete on equal footing
+- ✅ **Floor pricing** - Configurable minimum bid thresholds
+- ✅ **Flexibility** - Easy to add new providers
+
+### **Limitations Without Mediation**
+- ❌ **APS bids ignored** - Can't compare encoded prices
+- ❌ **Unfair competition** - Only clear-price bidders compete
+- ❌ **Reduced revenue** - May miss higher APS bids
\ No newline at end of file
diff --git a/README.md b/README.md
index 49f1dc8..b86f36c 100644
--- a/README.md
+++ b/README.md
@@ -214,7 +214,7 @@ Once configured, the following endpoints are available:
 
 - `/first-party/ad` (GET): returns HTML for a single slot (`slot`, `w`, `h` query params). The server inspects returned creative HTML and rewrites:
 - All absolute images and iframes to `/first-party/proxy?tsurl=<base-url>&<original-query-params>&tstoken=<sig>` (1×1 pixels are detected server‑side heuristically for logging). The `tstoken` is derived from encrypting the full target URL and hashing it.
-- `/third-party/ad` (POST): accepts tsjs ad units and proxies to Prebid Server.
+- `/auction` (POST): accepts tsjs ad units and runs the auction orchestrator.
 - `/first-party/proxy` (GET): unified proxy for resources referenced by creatives.
   - Query params:
     - `tsurl`: Target URL without query (base URL) — required
diff --git a/SEQUENCE.md b/SEQUENCE.md
index 235ef0e..210bb45 100644
--- a/SEQUENCE.md
+++ b/SEQUENCE.md
@@ -130,7 +130,7 @@ sequenceDiagram
 ## Notes
 - TSJS
   - Served first-party at `/static/tsjs-core.min.js` (and `/static/tsjs-ext.min.js` if prebid auto-config is enabled).
-  - Discovers ad units and renders placeholders; either uses slot-level HTML (`/first-party/ad`) or JSON auction (`/third-party/ad`).
+  - Discovers ad units and renders placeholders; either uses slot-level HTML (`/first-party/ad`) or JSON auction (`/auction`).
 - Publisher HTML Rewriting
   - Injects TSJS loader and rewrites absolute URLs from origin domain to first-party domain during streaming.
 - Creative HTML Rewriting
diff --git a/TESTING.md b/TESTING.md
new file mode 100644
index 0000000..e1ac1c3
--- /dev/null
+++ b/TESTING.md
@@ -0,0 +1,181 @@
+# Testing the Auction Orchestration System
+
+## Quick Test Summary
+
+The auction orchestration system has been integrated into the existing Prebid endpoints. You can test it right away using the Fastly local server!
+
+## How to Test
+
+### 1. Start the Local Server
+
+```bash
+fastly compute serve
+```
+
+### 2. Test with Existing Endpoint
+
+The `/auction` endpoint now uses the orchestrator when `auction.enabled = true` in config.
+
+**Test Request:**
+```bash
+curl -X POST http://localhost:7676/auction \
+  -H "Content-Type: application/json" \
+  -d '{
+    "adUnits": [
+      {
+        "code": "header-banner",
+        "mediaTypes": {
+          "banner": {
+            "sizes": [[728, 90], [970, 250]]
+          }
+        }
+      },
+      {
+        "code": "sidebar",
+        "mediaTypes": {
+          "banner": {
+            "sizes": [[300, 250], [300, 600]]
+          }
+        }
+      }
+    ]
+  }'
+```
+
+### 3. What You'll See
+
+**With Orchestrator Enabled** (`auction.enabled = true`):
+- Logs showing: `"Using auction orchestrator"`
+- Parallel execution of APS (mocked) and Prebid (real)
+- GAM mediation (mocked) selecting winning bids
+- Final response with winning creatives
+
+**With Orchestrator Disabled** (`auction.enabled = false`):
+- Logs showing: `"Using legacy Prebid flow"`
+- Direct Prebid Server call (backward compatible)
+
+##Configuration
+
+Edit `trusted-server.toml` to customize the auction:
+
+```toml
+# Enable/disable orchestrator
+[auction]
+enabled = true
+providers = ["prebid", "aps"]
+mediator = "adserver_mock"  # If set: mediation, if omitted: highest bid wins
+timeout_ms = 2000
+
+# Mock provider configs
+[integrations.aps]
+enabled = true
+mock = true
+mock_price = 2.50
+
+[integrations.adserver_mock]
+enabled = true
+endpoint = "http://localhost:6767/adserver/mediate"
+timeout_ms = 500
+```
+
+## Test Scenarios
+
+### Scenario 1: Parallel + Mediation (Default)
+**Config:**
+```toml
+[auction]
+enabled = true
+providers = ["prebid", "aps"]
+mediator = "adserver_mock"  # Mediator configured = parallel mediation strategy
+```
+
+**Expected Flow:**
+1. Prebid queries real SSPs
+2. APS returns mock bids ($2.50 CPM)
+3. AdServer Mock mediates between all bids
+4. Winning creative returned
+
+### Scenario 2: Parallel Only (No Mediation)
+**Config:**
+```toml
+[auction]
+enabled = true
+providers = ["prebid", "aps"]
+# No mediator = parallel only strategy
+```
+
+**Expected Flow:**
+1. Prebid and APS run in parallel
+2. Highest bid wins automatically
+3. No mediation
+
+### Scenario 3: Legacy Mode (Backward Compatible)
+**Config:**
+```toml
+[auction]
+enabled = false
+```
+
+**Expected Flow:**
+- Original Prebid-only behavior
+- No orchestration overhead
+
+## Debugging
+
+### Check Logs
+The orchestrator logs extensively:
+```
+INFO: Using auction orchestrator
+INFO: Running auction with strategy: parallel_mediation
+INFO: Running 2 bidders in parallel
+INFO: Requesting bids from: prebid
+INFO: Prebid returned 2 bids (time: 120ms)
+INFO: Requesting bids from: aps
+INFO: APS (MOCK): returning 2 bids in 80ms
+INFO: GAM mediation: slot 'header-banner' won by 'amazon-aps' at $2.50 CPM
+```
+
+### Verify Provider Registration
+Look for these log messages on startup:
+```
+INFO: Registering auction provider: prebid
+INFO: Registering auction provider: aps
+INFO: Registering auction provider: adserver_mock
+```
+
+### Common Issues
+
+**Issue:** `"Provider 'aps' not registered"`
+**Fix:** Make sure `[integrations.aps]` is configured in `trusted-server.toml`
+
+**Issue:** `"No providers configured"`
+**Fix:** Make sure `providers = ["prebid", "aps"]` is set in `[auction]`
+
+**Issue:** Tests fail with WASM errors
+**Explanation:** Async tests don't work in WASM test environment. Integration tests via HTTP work fine!
+
+## Next Steps
+
+1. **Test with real Prebid Server** - Verify Prebid bids work correctly
+2. **Implement real APS** - Replace mock with actual Amazon TAM API calls
+3. **Implement real GAM** - Add Google Ad Manager API integration
+4. **Add metrics** - Track bid rates, win rates, latency per provider
+
+## Mock Provider Behavior
+
+### APS (Amazon)
+- Returns bids for all slots
+- Default mock price: $2.50 CPM
+- Always returns 2 bids
+- Response time: ~80ms (simulated)
+
+### AdServer Mock
+- Acts as mediator by calling mocktioneer's mediation endpoint
+- Selects winning bids based on highest CPM
+- Response time varies based on mocktioneer instance
+
+### Prebid
+- **Real implementation** - makes actual HTTP calls
+- Queries configured SSPs
+- Returns real bids from real bidders
+- Response time: varies (network dependent)
diff --git a/crates/common/build.rs b/crates/common/build.rs
index d7b020b..a97734b 100644
--- a/crates/common/build.rs
+++ b/crates/common/build.rs
@@ -1,6 +1,9 @@
 #[path = "src/error.rs"]
 mod error;
 
+#[path = "src/auction_config_types.rs"]
+mod auction_config_types;
+
 #[path = "src/settings.rs"]
 mod settings;
 
diff --git a/crates/common/src/auction/README.md b/crates/common/src/auction/README.md
new file mode 100644
index 0000000..6943a70
--- /dev/null
+++ b/crates/common/src/auction/README.md
@@ -0,0 +1,558 @@
+# Auction Orchestration System
+
+A flexible, extensible framework for managing multi-provider header bidding auctions with support for parallel execution and mediation.
+
+## Overview
+
+The auction orchestration system allows you to:
+- Run multiple auction providers (Prebid, Amazon APS, etc.) in parallel or sequentially
+- Implement mediation strategies where a primary ad server makes the final decision
+- Configure different auction flows for different scenarios
+- Easily add new auction providers
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────┐
+│                  Auction Orchestrator                   │
+│  - Manages auction workflow & sequencing                │
+│  - Combines bids from multiple sources                  │
+│  - Applies business logic                               │
+└─────────────────────────────────────────────────────────┘
+                          │
+                          │ uses
+                          ▼
+┌─────────────────────────────────────────────────────────┐
+│              AuctionProvider Trait                       │
+│  - request_bids()                                        │
+│  - provider_name()                                       │
+│  - timeout_ms()                                          │
+│  - is_enabled()                                          │
+└─────────────────────────────────────────────────────────┘
+                          │
+        ┌─────────────────┼─────────────────┐
+        │                 │                 │
+        ▼                 ▼                 ▼
+  ┌──────────┐      ┌──────────┐     ┌──────────┐
+  │  Prebid  │      │ Amazon   │     │ AdServer │
+  │ Provider │      │   APS    │     │   Mock   │
+  └──────────┘      └──────────┘     └──────────┘
+```
+
+## Request Flow
+
+When a request arrives at the `/auction` endpoint, it goes through the following steps:
+
+```
+┌──────────────────────────────────────────────────────────────────────┐
+│  1. HTTP POST /auction                                               │
+│     - Body: AdRequest (Prebid.js/tsjs format)                        │
+│     - Headers: User-Agent, cookies, etc.                             │
+└──────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌──────────────────────────────────────────────────────────────────────┐
+│  2. Route Matching (crates/fastly/src/main.rs:84)                    │
+│     - Pattern: (Method::POST, "/auction")                            │
+│     - Handler: handle_auction(settings, &orchestrator, &storage, req)│
+└──────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌──────────────────────────────────────────────────────────────────────┐
+│  3. Parse Request Body (mod.rs:149)                                  │
+│     - Deserialize JSON → AdRequest struct                            │
+│     - Extract ad units with media types                              │
+└──────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌──────────────────────────────────────────────────────────────────────┐
+│  4. Generate User IDs (mod.rs:206-214)                               │
+│     - Create/retrieve synthetic ID (persistent)                      │
+│     - Generate fresh ID (per-request)                                │
+└──────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌──────────────────────────────────────────────────────────────────────┐
+│  5. Transform Request Format (mod.rs:216-240)                        │
+│     - AdRequest → AuctionRequest                                     │
+│     - AdUnit.code → AdSlot.id                                        │
+│     - mediaTypes.banner.sizes → AdFormat[]                           │
+│     - Build PublisherInfo, UserInfo, DeviceInfo                      │
+└──────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌──────────────────────────────────────────────────────────────────────┐
+│  6. Use Provided Orchestrator (mod.rs:150)                           │
+│     - Reused across requests from startup construction               │
+│     - Contains all registered providers (APS, Prebid, etc.)          │
+└──────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌──────────────────────────────────────────────────────────────────────┐
+│  7. Create Auction Context (mod.rs:172-176)                          │
+│     - Attach settings                                                │
+│     - Attach original request                                        │
+│     - Set timeout from config                                        │
+└──────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌──────────────────────────────────────────────────────────────────────┐
+│  8. Run Auction Strategy (orchestrator.rs:42)                        │
+│     ┌────────────────────────────────────────────────────────────┐   │
+│     │  Strategy: parallel_only                                   │   │
+│     │  1. Launch all bidders concurrently                        │   │
+│     │  2. Wait for all responses                                 │   │
+│     │  3. Select highest bid per slot                            │   │
+│     └────────────────────────────────────────────────────────────┘   │
+│     ┌────────────────────────────────────────────────────────────┐   │
+│     │  Strategy: parallel_mediation                              │   │
+│     │  1. Launch all bidders concurrently                        │   │
+│     │  2. Collect all bids                                       │   │
+│     │  3. Send to mediator for final decision                    │   │
+│     └────────────────────────────────────────────────────────────┘   │
+└──────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌──────────────────────────────────────────────────────────────────────┐
+│  9. Each Provider Processes Request                                  │
+│     - Transform AuctionRequest → Provider format (e.g., APS TAM)     │
+│     - Send HTTP request to provider endpoint                         │
+│     - Parse provider response                                        │
+│     - Transform → AuctionResponse with Bid[]                         │
+│     - Return to orchestrator                                         │
+└──────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌──────────────────────────────────────────────────────────────────────┐
+│  10. Select Winning Bids (orchestrator.rs:363-385)                   │
+│      - For each slot, find highest CPM bid                           │
+│      - Create HashMap<slot_id, Bid>                                  │
+│      - Log winning selections                                        │
+└──────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌──────────────────────────────────────────────────────────────────────┐
+│  11. Transform to OpenRTB Response (mod.rs:274-322)                  │
+│      - Build seatbid array (one per winning bid)                     │
+│      - Rewrite creative HTML for first-party proxy                   │
+│      - Add orchestrator metadata (timing, strategy, bid count)       │
+└──────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌──────────────────────────────────────────────────────────────────────┐
+│  12. Return HTTP Response                                            │
+│      - Status: 200 OK                                                │
+│      - Content-Type: application/json                                │
+│      - Body: OpenRTB BidResponse                                     │
+└──────────────────────────────────────────────────────────────────────┘
+```
+
+### Step-by-Step Breakdown
+
+#### 1. Request Arrival
+Client (browser, Prebid.js, tsjs) sends a POST request to `/auction` with ad unit definitions:
+
+```json
+{
+  "adUnits": [
+    {
+      "code": "header-banner",
+      "mediaTypes": {
+        "banner": {
+          "sizes": [[728, 90], [970, 250]]
+        }
+      }
+    }
+  ]
+}
+```
+
+#### 2. Format Transformation
+The system transforms the Prebid.js format into an internal `AuctionRequest`:
+
+```rust
+// From: AdUnit with sizes [[728, 90], [970, 250]]
+// To:   AdSlot with formats
+AdSlot {
+    id: "header-banner",
+    formats: vec![
+        AdFormat { width: 728, height: 90, media_type: Banner },
+        AdFormat { width: 970, height: 250, media_type: Banner },
+    ],
+    floor_price: None,
+    targeting: HashMap::new(),
+}
+```
+
+#### 3. Provider Execution
+Each registered provider (APS, Prebid, etc.) receives the `AuctionRequest` and:
+- Transforms it to their specific format (e.g., APS TAM, OpenRTB)
+- Makes HTTP request to their endpoint
+- Parses the response
+- Returns `AuctionResponse` with `Bid[]`
+
+For example, APS provider:
+```rust
+// Transform AuctionRequest → ApsBidRequest
+let aps_request = ApsBidRequest {
+    pub_id: "5128",
+    slots: vec![
+        ApsSlot {
+            slot_id: "header-banner",
+            sizes: vec![[728, 90], [970, 250]],
+            slot_name: Some("header-banner"),
+        }
+    ],
+    page_url: Some("https://example.com"),
+    ua: Some("Mozilla/5.0..."),
+    timeout: Some(800),
+};
+
+// HTTP POST to http://localhost:6767/e/dtb/bid
+// Parse response → AuctionResponse
+```
+
+#### 4. Response Assembly
+The orchestrator collects all bids and creates an OpenRTB response:
+
+```json
+{
+  "id": "auction-response",
+  "seatbid": [
+    {
+      "seat": "amazon-aps",
+      "bid": [
+        {
+          "id": "amazon-aps-header-banner",
+          "impid": "header-banner",
+          "price": 2.5,
+          "adm": "<iframe src=\"/first-party/proxy?tsurl=...\">",
+          "w": 728,
+          "h": 90,
+          "crid": "amazon-aps-creative",
+          "adomain": ["amazon.com"]
+        }
+      ]
+    }
+  ],
+  "ext": {
+    "orchestrator": {
+      "strategy": "parallel_only",
+      "bidders": 1,
+      "total_bids": 1,
+      "time_ms": 5
+    }
+  }
+}
+```
+
+Note that creative HTML is rewritten to use the first-party proxy (`/first-party/proxy`) for privacy and security.
+
+## Route Registration & Endpoints
+
+### Auction-Related Routes
+
+The trusted-server handles several types of routes defined in `crates/fastly/src/main.rs`:
+
+| Route                     | Method | Handler                        | Purpose                                          | Line |
+|---------------------------|--------|--------------------------------|--------------------------------------------------|------|
+| `/auction`                | POST   | `handle_auction()`             | Main auction endpoint (Prebid.js/tsjs format)    | 84   |
+| `/first-party/proxy`      | GET    | `handle_first_party_proxy()`   | Proxy creatives through first-party domain       | 84   |
+| `/first-party/click`      | GET    | `handle_first_party_click()`   | Track clicks on ads                              | 85   |
+| `/first-party/sign`       | GET/POST | `handle_first_party_proxy_sign()` | Generate signed URLs for creatives            | 86   |
+| `/first-party/proxy-rebuild` | POST | `handle_first_party_proxy_rebuild()` | Rebuild creative HTML with new settings     | 89   |
+| `/static/tsjs=*`          | GET    | `handle_tsjs_dynamic()`        | Serve tsjs library (Prebid.js alternative)       | 66   |
+| `/.well-known/ts.jwks.json` | GET  | `handle_jwks_endpoint()`       | Public key distribution for request signing      | 71   |
+| `/verify-signature`       | POST   | `handle_verify_signature()`    | Verify signed requests                           | 74   |
+| `/admin/keys/rotate`      | POST   | `handle_rotate_key()`          | Rotate signing keys (admin only)                 | 77   |
+| `/admin/keys/deactivate`  | POST   | `handle_deactivate_key()`      | Deactivate signing keys (admin only)             | 78   |
+| `/integrations/*`         | *      | Integration Registry           | Provider-specific endpoints (Prebid, etc.)       | 92   |
+| `*` (fallback)            | *      | `handle_publisher_request()`   | Proxy to publisher origin                        | 108  |
+
+### How Routing Works
+
+#### 1. Main Router (main.rs)
+The Fastly Compute entrypoint uses pattern matching on `(Method, path)` tuples:
+
+```rust
+let result = match (method, path.as_str()) {
+    // Auction endpoint
+    (Method::POST, "/auction") => handle_auction(&settings, req).await,
+    
+    // First-party endpoints
+    (Method::GET, "/first-party/proxy") => handle_first_party_proxy(&settings, req).await,
+    
+    // Integration registry (dynamic routes)
+    (m, path) if integration_registry.has_route(&m, path) => {
+        integration_registry.handle_proxy(&m, path, &settings, req).await
+    },
+    
+    // Fallback to publisher origin
+    _ => handle_publisher_request(&settings, &integration_registry, req),
+}
+```
+
+#### 2. Integration Registry (Dynamic Routes)
+Some integrations register their own routes dynamically. For example, Prebid registers `/integrations/prebid/auction`:
+
+```rust
+// In integrations/prebid.rs
+impl Integration for PrebidIntegration {
+    fn routes(&self) -> Vec<IntegrationRoute> {
+        vec![
+            IntegrationRoute {
+                path: "/integrations/prebid/auction",
+                method: Method::POST,
+                handler: handle_prebid_auction,
+            }
+        ]
+    }
+}
+```
+
+The integration registry checks if a route matches any registered integration routes before falling back to the publisher origin.
+
+#### 3. Route Priority
+Routes are matched in this order:
+1. **Exact top-level routes** (`/auction`, `/first-party/proxy`, etc.)
+2. **Admin routes** (`/admin/*`)
+3. **Integration routes** (`/integrations/*`)
+4. **Fallback to publisher origin** (all other paths)
+
+This ensures auction and first-party endpoints take precedence over publisher content.
+
+### Auction Endpoint Deep Dive
+
+The `/auction` endpoint is the primary entry point for auctions:
+
+**Input Format (Prebid.js compatible):**
+```json
+{
+  "adUnits": [
+    {
+      "code": "div-id",
+      "mediaTypes": {
+        "banner": {
+          "sizes": [[300, 250], [728, 90]]
+        }
+      }
+    }
+  ],
+  "config": { /* optional Prebid.js config */ }
+}
+```
+
+**Output Format (OpenRTB 2.x):**
+```json
+{
+  "id": "auction-response",
+  "seatbid": [
+    {
+      "seat": "bidder-name",
+      "bid": [
+        {
+          "id": "bid-id",
+          "impid": "div-id",
+          "price": 2.5,
+          "adm": "<creative-html>",
+          "w": 300,
+          "h": 250
+        }
+      ]
+    }
+  ],
+  "ext": {
+    "orchestrator": {
+      "strategy": "parallel_only",
+      "bidders": 2,
+      "total_bids": 3,
+      "time_ms": 150
+    }
+  }
+}
+```
+
+**Key Transformations:**
+- `adUnits[].code` → `seatbid[].bid[].impid` (slot identifier)
+- `mediaTypes.banner.sizes` → evaluated by providers, winning size in `bid.w` and `bid.h`
+- Creative HTML is rewritten to use `/first-party/proxy` URLs
+- Multiple bids per slot become separate `seatbid` entries
+- Orchestrator metadata added in `ext.orchestrator`
+
+## Key Concepts
+
+### Auction Provider
+Implements the `AuctionProvider` trait to integrate with a specific SSP/ad exchange.
+
+### Auction Flow
+A named configuration that defines:
+- Which providers participate
+- Execution strategy (parallel mediation or parallel only)
+- Timeout settings
+- Optional mediator
+
+### Orchestrator
+Manages the execution of an auction flow, coordinates providers, and collects results.
+
+## Auction Strategies
+
+### 1. Parallel + Mediation (Recommended)
+**Use case:** Header bidding with ad server mediation
+
+```toml
+[auction]
+enabled = true
+providers = ["prebid", "aps"]
+mediator = "adserver_mock"  # Setting mediator enables parallel mediation strategy
+timeout_ms = 2000
+```
+
+**Flow:**
+1. Prebid and APS run in parallel
+2. Both return their bids simultaneously
+3. Bids are sent to the mediator for final decision
+4. Mediator competes house inventory and returns winning creative
+
+### 2. Parallel Only
+**Use case:** Client-side auction, no mediation
+
+```toml
+[auction]
+enabled = true
+providers = ["prebid", "aps"]
+# No mediator = parallel only strategy (highest CPM wins)
+timeout_ms = 2000
+```
+
+**Flow:**
+1. All providers run in parallel
+2. Highest bid wins
+3. No mediation server involved
+
+## Configuration
+
+### Configuration
+
+All auction settings are configured directly under `[auction]`:
+
+```toml
+[auction]
+enabled = true                      # Enable/disable auction orchestration
+providers = ["prebid", "aps"]        # List of bidder providers
+mediator = "adserver_mock"          # Optional: if set, uses mediation; if omitted, highest bid wins
+timeout_ms = 2000                   # Overall auction timeout
+```
+
+**Strategy Auto-Detection:**
+- When `mediator` is configured → Runs **parallel mediation** (providers in parallel, mediator decides winner)
+- When `mediator` is omitted → Runs **parallel only** (providers in parallel, highest CPM wins)
+
+### Provider Configuration
+
+Each provider has its own configuration section:
+
+```toml
+[integrations.prebid]
+enabled = true
+server_url = "https://prebid-server.example.com"
+timeout_ms = 1000
+
+[integrations.aps]
+enabled = true
+mock = true  # Set to false for real integration
+timeout_ms = 800
+
+[integrations.adserver_mock]
+enabled = true
+endpoint = "http://localhost:6767/adserver/mediate"
+timeout_ms = 500
+```
+
+## Adding a New Provider
+
+1. Create a new file in `src/auction/providers/your_provider.rs`
+
+```rust
+use async_trait::async_trait;
+use crate::auction::provider::AuctionProvider;
+use crate::auction::types::{AuctionContext, AuctionRequest, AuctionResponse};
+
+pub struct YourAuctionProvider {
+    config: YourConfig,
+}
+
+#[async_trait(?Send)]
+impl AuctionProvider for YourAuctionProvider {
+    fn provider_name(&self) -> &'static str {
+        "your_provider"
+    }
+
+    async fn request_bids(
+        &self,
+        request: &AuctionRequest,
+        _context: &AuctionContext<'_>,
+    ) -> Result<AuctionResponse, Report<TrustedServerError>> {
+        // 1. Transform AuctionRequest to your provider's format
+        // 2. Make HTTP request to your provider
+        // 3. Parse response
+        // 4. Return AuctionResponse with bids
+        todo!()
+    }
+
+    fn timeout_ms(&self) -> u32 {
+        self.config.timeout_ms
+    }
+
+    fn is_enabled(&self) -> bool {
+        self.config.enabled
+    }
+}
+```
+
+2. Register the provider in `src/auction/providers/mod.rs`
+
+3. Configure it in `trusted-server.toml`
+
+## Testing
+
+### Mock Providers
+
+APS and adserver_mock providers are used for testing the orchestration pattern:
+
+- **APS Mock**: Returns synthetic bids with Amazon branding
+- **AdServer Mock**: Acts as mediator by calling mocktioneer's mediation endpoint, selects winning bids based on highest CPM
+
+Set `mock = false` in APS config when real APS integration is ready.
+
+### Example Test Flow
+
+```rust
+let orchestrator = AuctionOrchestrator::new(config);
+orchestrator.register_provider(Arc::new(PrebidAuctionProvider::new(prebid_config)));
+orchestrator.register_provider(Arc::new(ApsAuctionProvider::new(aps_config)));
+
+let result = orchestrator.run_auction(&request, &context).await?;
+
+// Check results
+assert_eq!(result.winning_bids.len(), 2);
+assert!(result.total_time_ms < 2000);
+```
+
+## Performance Considerations
+
+- **Parallel Execution**: Currently runs sequentially in Fastly Compute (no tokio runtime), but structured for easy parallelization
+- **Timeouts**: Each provider has independent timeout; global timeout enforced at flow level
+- **Error Handling**: Provider failures don't fail entire auction; partial results returned
+
+## Related Files
+
+- `src/auction/mod.rs` - Module exports
+- `src/auction/types.rs` - Core auction types
+- `src/auction/provider.rs` - Provider trait definition
+- `src/auction/orchestrator.rs` - Orchestration logic
+- `src/auction/config.rs` - Configuration types
+- `src/auction/providers/` - Provider implementations
+
+## Questions?
+
+See the main project [README](../../../../README.md) or [integration guide](../../../../docs/integration_guide.md).
diff --git a/crates/common/src/auction/config.rs b/crates/common/src/auction/config.rs
new file mode 100644
index 0000000..8ffe5a5
--- /dev/null
+++ b/crates/common/src/auction/config.rs
@@ -0,0 +1,6 @@
+//! Configuration structures for auction orchestration.
+//!
+//! The base types are defined in auction_config_types.rs to avoid circular dependencies
+//! with build.rs. This module re-exports them.
+
+pub use crate::auction_config_types::AuctionConfig;
diff --git a/crates/common/src/auction/endpoints.rs b/crates/common/src/auction/endpoints.rs
new file mode 100644
index 0000000..29aa18b
--- /dev/null
+++ b/crates/common/src/auction/endpoints.rs
@@ -0,0 +1,64 @@
+//! HTTP endpoint handlers for auction requests.
+
+use error_stack::{Report, ResultExt};
+use fastly::{Request, Response};
+
+use crate::auction::formats::AdRequest;
+use crate::error::TrustedServerError;
+use crate::settings::Settings;
+
+use super::formats::{convert_to_openrtb_response, convert_tsjs_to_auction_request};
+use super::types::AuctionContext;
+use super::AuctionOrchestrator;
+
+/// Handle auction request from /auction endpoint.
+///
+/// This is the main entry point for running header bidding auctions.
+/// It orchestrates bids from multiple providers (Prebid, APS, GAM, etc.) and returns
+/// the winning bids in OpenRTB format with creative HTML inline in the `adm` field.
+pub async fn handle_auction(
+    settings: &Settings,
+    orchestrator: &AuctionOrchestrator,
+    mut req: Request,
+) -> Result<Response, Report<TrustedServerError>> {
+    // Parse request body
+    let body: AdRequest = serde_json::from_slice(&req.take_body_bytes()).change_context(
+        TrustedServerError::Auction {
+            message: "Failed to parse auction request body".to_string(),
+        },
+    )?;
+
+    log::info!(
+        "Auction request received for {} ad units",
+        body.ad_units.len()
+    );
+
+    // Convert tsjs request format to auction request
+    let auction_request = convert_tsjs_to_auction_request(&body, settings, &req)?;
+
+    // Create auction context
+    let context = AuctionContext {
+        settings,
+        request: &req,
+        timeout_ms: settings.auction.timeout_ms,
+        provider_responses: None,
+    };
+
+    // Run the auction
+    let result = orchestrator
+        .run_auction(&auction_request, &context)
+        .await
+        .change_context(TrustedServerError::Auction {
+            message: "Auction orchestration failed".to_string(),
+        })?;
+
+    log::info!(
+        "Auction completed: {} providers, {} winning bids, {}ms total",
+        result.provider_responses.len(),
+        result.winning_bids.len(),
+        result.total_time_ms
+    );
+
+    // Convert to OpenRTB response format with inline creative HTML
+    convert_to_openrtb_response(&result, settings, &auction_request)
+}
diff --git a/crates/common/src/auction/formats.rs b/crates/common/src/auction/formats.rs
new file mode 100644
index 0000000..c90308c
--- /dev/null
+++ b/crates/common/src/auction/formats.rs
@@ -0,0 +1,224 @@
+//! Auction request/response format conversions.
+//!
+//! This module handles:
+//! - Parsing incoming tsjs/Prebid.js format requests
+//! - Converting internal auction results to OpenRTB 2.x responses
+
+use error_stack::{ensure, Report, ResultExt};
+use fastly::http::{header, StatusCode};
+use fastly::{Request, Response};
+use serde::Deserialize;
+use serde_json::Value as JsonValue;
+use std::collections::HashMap;
+use uuid::Uuid;
+
+use crate::auction::types::OrchestratorExt;
+use crate::creative;
+use crate::error::TrustedServerError;
+use crate::geo::GeoInfo;
+use crate::openrtb::{OpenRtbBid, OpenRtbResponse, ResponseExt, SeatBid};
+use crate::settings::Settings;
+use crate::synthetic::{generate_synthetic_id, get_or_generate_synthetic_id};
+
+use super::orchestrator::OrchestrationResult;
+use super::types::{
+    AdFormat, AdSlot, AuctionRequest, DeviceInfo, MediaType, PublisherInfo, SiteInfo, UserInfo,
+};
+
+/// Request body format for auction endpoints (tsjs/Prebid.js format).
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AdRequest {
+    pub ad_units: Vec<AdUnit>,
+    #[allow(dead_code)]
+    pub config: Option<JsonValue>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AdUnit {
+    pub code: String,
+    pub media_types: Option<MediaTypes>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct MediaTypes {
+    pub banner: Option<BannerUnit>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct BannerUnit {
+    pub sizes: Vec<Vec<u32>>,
+}
+
+/// Convert tsjs/Prebid.js request format to internal AuctionRequest.
+pub fn convert_tsjs_to_auction_request(
+    body: &AdRequest,
+    settings: &Settings,
+    req: &Request,
+) -> Result<AuctionRequest, Report<TrustedServerError>> {
+    // Generate synthetic ID
+    let synthetic_id = get_or_generate_synthetic_id(settings, req).change_context(
+        TrustedServerError::Auction {
+            message: "Failed to generate synthetic ID".to_string(),
+        },
+    )?;
+    let fresh_id =
+        generate_synthetic_id(settings, req).change_context(TrustedServerError::Auction {
+            message: "Failed to generate fresh ID".to_string(),
+        })?;
+
+    // Convert ad units to slots
+    let mut slots = Vec::new();
+    for unit in &body.ad_units {
+        if let Some(media_types) = &unit.media_types {
+            if let Some(banner) = &media_types.banner {
+                let mut formats = Vec::new();
+                for size in &banner.sizes {
+                    ensure!(
+                        size.len() == 2,
+                        TrustedServerError::BadRequest {
+                            message: "Invalid banner size; expected [width, height]".to_string(),
+                        }
+                    );
+
+                    formats.push(AdFormat {
+                        width: size[0],
+                        height: size[1],
+                        media_type: MediaType::Banner,
+                    });
+                }
+
+                slots.push(AdSlot {
+                    id: unit.code.clone(),
+                    formats,
+                    floor_price: None,
+                    targeting: std::collections::HashMap::new(),
+                });
+            }
+        }
+    }
+
+    // Get geo info if available
+    let device = GeoInfo::from_request(req).map(|geo| DeviceInfo {
+        user_agent: req.get_header_str("user-agent").map(|s| s.to_string()),
+        ip: req.get_client_ip_addr().map(|ip| ip.to_string()),
+        geo: Some(geo),
+    });
+
+    Ok(AuctionRequest {
+        id: Uuid::new_v4().to_string(),
+        slots,
+        publisher: PublisherInfo {
+            domain: settings.publisher.domain.clone(),
+            page_url: Some(format!("https://{}", settings.publisher.domain)),
+        },
+        user: UserInfo {
+            id: synthetic_id,
+            fresh_id,
+            consent: None,
+        },
+        device,
+        site: Some(SiteInfo {
+            domain: settings.publisher.domain.clone(),
+            page: format!("https://{}", settings.publisher.domain),
+        }),
+        context: HashMap::new(),
+    })
+}
+
+/// Convert OrchestrationResult to OpenRTB response format.
+///
+/// Returns rewritten creative HTML directly in the `adm` field for inline delivery.
+pub fn convert_to_openrtb_response(
+    result: &OrchestrationResult,
+    settings: &Settings,
+    auction_request: &AuctionRequest,
+) -> Result<Response, Report<TrustedServerError>> {
+    // Build OpenRTB-style seatbid array
+    let mut seatbids = Vec::new();
+
+    for (slot_id, bid) in &result.winning_bids {
+        let price = bid.price.ok_or_else(|| {
+            Report::new(TrustedServerError::Auction {
+                message: format!(
+                    "Winning bid for slot '{}' from '{}' has no decoded price",
+                    slot_id, bid.bidder
+                ),
+            })
+        })?;
+
+        // Process creative HTML if present - rewrite URLs and return inline
+        let creative_html = if let Some(ref raw_creative) = bid.creative {
+            // Rewrite creative HTML with proxy URLs for first-party delivery
+            let rewritten = creative::rewrite_creative_html(raw_creative, settings);
+
+            log::debug!(
+                "Rewritten creative for auction {} slot {} ({} bytes)",
+                auction_request.id,
+                slot_id,
+                rewritten.len()
+            );
+
+            rewritten
+        } else {
+            // No creative provided (e.g., from mediation layer that returns iframe URLs)
+            log::warn!(
+                "No creative HTML for auction {} slot {} - mediation should have provided creative",
+                auction_request.id,
+                slot_id
+            );
+            String::new()
+        };
+
+        let openrtb_bid = OpenRtbBid {
+            id: format!("{}-{}", bid.bidder, slot_id),
+            impid: slot_id.to_string(),
+            price,
+            adm: Some(creative_html),
+            crid: Some(format!("{}-creative", bid.bidder)),
+            w: Some(bid.width),
+            h: Some(bid.height),
+            adomain: Some(bid.adomain.clone().unwrap_or_default()),
+        };
+
+        seatbids.push(SeatBid {
+            seat: Some(bid.bidder.clone()),
+            bid: vec![openrtb_bid],
+        });
+    }
+
+    // Determine strategy name for response metadata
+    let strategy_name = if settings.auction.has_mediator() {
+        "parallel_mediation"
+    } else {
+        "parallel_only"
+    };
+
+    let response_body = OpenRtbResponse {
+        id: auction_request.id.to_string(),
+        seatbid: seatbids,
+        ext: Some(ResponseExt {
+            orchestrator: OrchestratorExt {
+                strategy: strategy_name.to_string(),
+                providers: result.provider_responses.len(),
+                total_bids: result.total_bids(),
+                time_ms: result.total_time_ms,
+            },
+        }),
+    };
+
+    let body_bytes =
+        serde_json::to_vec(&response_body).change_context(TrustedServerError::Auction {
+            message: "Failed to serialize auction response".to_string(),
+        })?;
+
+    Ok(Response::from_status(StatusCode::OK)
+        .with_header(header::CONTENT_TYPE, "application/json")
+        .with_header("X-Synthetic-ID", &auction_request.user.id)
+        .with_header("X-Synthetic-Fresh", &auction_request.user.fresh_id)
+        .with_header("X-Synthetic-Trusted-Server", &auction_request.user.id)
+        .with_body(body_bytes))
+}
diff --git a/crates/common/src/auction/mod.rs b/crates/common/src/auction/mod.rs
new file mode 100644
index 0000000..3618786
--- /dev/null
+++ b/crates/common/src/auction/mod.rs
@@ -0,0 +1,68 @@
+//! Auction orchestration module for managing multi-provider bidding.
+//!
+//! This module provides an extensible framework for running auctions across
+//! multiple providers (Prebid, Amazon APS, Google GAM, etc.) with support for
+//! parallel execution and mediation strategies.
+//!
+//! Note: Individual auction providers are located in the `integrations` module
+//! (e.g., `crate::integrations::aps`, `crate::integrations::prebid`).
+
+use crate::settings::Settings;
+use std::sync::Arc;
+
+pub mod config;
+pub mod endpoints;
+pub mod formats;
+pub mod orchestrator;
+pub mod provider;
+pub mod types;
+
+pub use config::AuctionConfig;
+pub use orchestrator::AuctionOrchestrator;
+pub use provider::AuctionProvider;
+pub use types::{
+    AdFormat, AuctionContext, AuctionRequest, AuctionResponse, Bid, BidStatus, MediaType,
+};
+
+/// Type alias for provider builder functions.
+type ProviderBuilder = fn(&Settings) -> Vec<Arc<dyn AuctionProvider>>;
+
+/// Returns the list of all available provider builder functions.
+///
+/// This list is used to auto-discover and register auction providers from settings.
+/// Each builder function checks the settings for its specific provider configuration
+/// and returns any enabled providers.
+fn provider_builders() -> &'static [ProviderBuilder] {
+    &[
+        crate::integrations::prebid::register_auction_provider,
+        crate::integrations::aps::register_providers,
+        crate::integrations::adserver_mock::register_providers,
+    ]
+}
+
+/// Build a new auction orchestrator for the current settings.
+///
+/// This constructor registers all auction providers discovered from the provided settings.
+/// Callers can reuse the returned [`AuctionOrchestrator`] across requests.
+///
+/// # Arguments
+/// * `settings` - Application settings used to configure the orchestrator and providers
+pub fn build_orchestrator(settings: &Settings) -> AuctionOrchestrator {
+    log::info!("Building auction orchestrator");
+
+    let mut orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+
+    // Auto-discover and register all auction providers from settings
+    for builder in provider_builders() {
+        for provider in builder(settings) {
+            orchestrator.register_provider(provider);
+        }
+    }
+
+    log::info!(
+        "Auction orchestrator built with {} providers",
+        orchestrator.provider_count()
+    );
+
+    orchestrator
+}
diff --git a/crates/common/src/auction/orchestrator.rs b/crates/common/src/auction/orchestrator.rs
new file mode 100644
index 0000000..2677d6f
--- /dev/null
+++ b/crates/common/src/auction/orchestrator.rs
@@ -0,0 +1,719 @@
+//! Auction orchestrator for managing multi-provider auctions.
+
+use error_stack::{Report, ResultExt};
+use fastly::http::request::{select, PendingRequest};
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::Instant;
+
+use crate::error::TrustedServerError;
+
+use super::config::AuctionConfig;
+use super::provider::AuctionProvider;
+use super::types::{AuctionContext, AuctionRequest, AuctionResponse, Bid, BidStatus};
+
+/// Manages auction execution across multiple providers.
+pub struct AuctionOrchestrator {
+    config: AuctionConfig,
+    providers: HashMap<String, Arc<dyn AuctionProvider>>,
+}
+
+impl AuctionOrchestrator {
+    /// Create a new orchestrator with the given configuration.
+    pub fn new(config: AuctionConfig) -> Self {
+        Self {
+            config,
+            providers: HashMap::new(),
+        }
+    }
+
+    /// Register an auction provider.
+    pub fn register_provider(&mut self, provider: Arc<dyn AuctionProvider>) {
+        let name = provider.provider_name().to_string();
+        log::info!("Registering auction provider: {}", name);
+        self.providers.insert(name, provider);
+    }
+
+    /// Get the number of registered providers.
+    pub fn provider_count(&self) -> usize {
+        self.providers.len()
+    }
+
+    /// Execute an auction using the auto-detected strategy.
+    ///
+    /// Strategy is determined by mediator configuration:
+    /// - If mediator is configured: runs parallel mediation (bidders → mediator decides)
+    /// - If no mediator: runs parallel only (bidders → highest CPM wins)
+    pub async fn run_auction(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+    ) -> Result<OrchestrationResult, Report<TrustedServerError>> {
+        let start_time = Instant::now();
+
+        // Auto-detect strategy based on mediator configuration
+        let (strategy_name, result) = if self.config.has_mediator() {
+            (
+                "parallel_mediation",
+                self.run_parallel_mediation(request, context).await?,
+            )
+        } else {
+            (
+                "parallel_only",
+                self.run_parallel_only(request, context).await?,
+            )
+        };
+
+        log::info!(
+            "Running auction with strategy: {} (auto-detected from mediator config)",
+            strategy_name
+        );
+
+        Ok(OrchestrationResult {
+            total_time_ms: start_time.elapsed().as_millis() as u64,
+            ..result
+        })
+    }
+
+    /// Run auction with parallel bidding + mediation.
+    ///
+    /// Flow:
+    /// 1. Run all bidders in parallel
+    /// 2. Collect bids from all bidders
+    /// 3. Send combined bids to mediator for final decision
+    async fn run_parallel_mediation(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+    ) -> Result<OrchestrationResult, Report<TrustedServerError>> {
+        let provider_responses = self.run_providers_parallel(request, context).await?;
+
+        let floor_prices = self.floor_prices_by_slot(request);
+        let (mediator_response, winning_bids) = if self.config.has_mediator() {
+            let mediator_name = self.config.mediator.as_ref().unwrap();
+            let mediator = self.get_provider(mediator_name)?;
+
+            log::info!(
+                "Sending {} provider responses to mediator: {}",
+                provider_responses.len(),
+                mediator.provider_name()
+            );
+
+            // Create a context with provider responses for the mediator
+            let mediator_context = AuctionContext {
+                settings: context.settings,
+                request: context.request,
+                timeout_ms: context.timeout_ms,
+                provider_responses: Some(&provider_responses),
+            };
+
+            let start_time = Instant::now();
+            let pending = mediator
+                .request_bids(request, &mediator_context)
+                .change_context(TrustedServerError::Auction {
+                    message: format!("Mediator {} failed to launch", mediator.provider_name()),
+                })?;
+
+            let backend_response = pending.wait().change_context(TrustedServerError::Auction {
+                message: format!("Mediator {} request failed", mediator.provider_name()),
+            })?;
+
+            let response_time_ms = start_time.elapsed().as_millis() as u64;
+            let mediator_resp = mediator
+                .parse_response(backend_response, response_time_ms)
+                .change_context(TrustedServerError::Auction {
+                    message: format!("Mediator {} parse failed", mediator.provider_name()),
+                })?;
+
+            // Extract winning bids from mediator response
+            // Filter out bids without decoded prices - mediator should have decoded all prices
+            let winning = mediator_resp
+                .bids
+                .iter()
+                .filter_map(|bid| {
+                    if bid.price.is_none() {
+                        log::warn!(
+                            "Mediator '{}' returned bid for slot '{}' without decoded price - skipping. \
+                             Mediator should decode all prices including APS bids.",
+                            mediator.provider_name(),
+                            bid.slot_id
+                        );
+                        None
+                    } else {
+                        Some((bid.slot_id.clone(), bid.clone()))
+                    }
+                })
+                .collect();
+
+            (
+                Some(mediator_resp),
+                self.apply_floor_prices(winning, &floor_prices),
+            )
+        } else {
+            // No mediator - select best bid per slot from bidder responses
+            let winning = self.select_winning_bids(&provider_responses, &floor_prices);
+            (None, winning)
+        };
+
+        Ok(OrchestrationResult {
+            provider_responses,
+            mediator_response,
+            winning_bids,
+            total_time_ms: 0, // Will be set by caller
+            metadata: HashMap::new(),
+        })
+    }
+
+    /// Run auction with only parallel bidding (no mediation).
+    async fn run_parallel_only(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+    ) -> Result<OrchestrationResult, Report<TrustedServerError>> {
+        let provider_responses = self.run_providers_parallel(request, context).await?;
+        let floor_prices = self.floor_prices_by_slot(request);
+        let winning_bids = self.select_winning_bids(&provider_responses, &floor_prices);
+
+        Ok(OrchestrationResult {
+            provider_responses,
+            mediator_response: None,
+            winning_bids,
+            total_time_ms: 0,
+            metadata: HashMap::new(),
+        })
+    }
+
+    /// Run all providers in parallel and collect responses.
+    ///
+    /// Uses `fastly::http::request::select()` to process responses as they
+    /// become ready, rather than waiting for each response sequentially.
+    async fn run_providers_parallel(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+    ) -> Result<Vec<AuctionResponse>, Report<TrustedServerError>> {
+        let provider_names = self.config.provider_names();
+
+        if provider_names.is_empty() {
+            return Err(Report::new(TrustedServerError::Auction {
+                message: "No providers configured".to_string(),
+            }));
+        }
+
+        log::info!(
+            "Running {} providers in parallel using select",
+            provider_names.len()
+        );
+
+        // Phase 1: Launch all requests concurrently and build mapping
+        // Maps backend_name -> (provider_name, start_time, provider)
+        let mut backend_to_provider: HashMap<String, (&str, Instant, &dyn AuctionProvider)> =
+            HashMap::new();
+        let mut pending_requests: Vec<PendingRequest> = Vec::new();
+
+        for provider_name in provider_names {
+            let provider = match self.providers.get(provider_name) {
+                Some(p) => p,
+                None => {
+                    log::warn!("Provider '{}' not registered, skipping", provider_name);
+                    continue;
+                }
+            };
+
+            if !provider.is_enabled() {
+                log::debug!(
+                    "Provider '{}' is disabled, skipping",
+                    provider.provider_name()
+                );
+                continue;
+            }
+
+            // Get the backend name for this provider to map responses back
+            let backend_name = match provider.backend_name() {
+                Some(name) => name,
+                None => {
+                    log::warn!(
+                        "Provider '{}' has no backend_name, skipping",
+                        provider.provider_name()
+                    );
+                    continue;
+                }
+            };
+
+            log::info!(
+                "Launching bid request to: {} (backend: {})",
+                provider.provider_name(),
+                backend_name
+            );
+
+            let start_time = Instant::now();
+            match provider.request_bids(request, context) {
+                Ok(pending) => {
+                    backend_to_provider.insert(
+                        backend_name,
+                        (provider.provider_name(), start_time, provider.as_ref()),
+                    );
+                    pending_requests.push(pending);
+                    log::debug!(
+                        "Request to '{}' launched successfully",
+                        provider.provider_name()
+                    );
+                }
+                Err(e) => {
+                    log::warn!(
+                        "Provider '{}' failed to launch request: {:?}",
+                        provider.provider_name(),
+                        e
+                    );
+                }
+            }
+        }
+
+        log::info!(
+            "Launched {} concurrent requests, waiting for responses using select...",
+            pending_requests.len()
+        );
+
+        // Phase 2: Wait for responses using select() to process as they become ready
+        let mut responses = Vec::new();
+        let mut remaining = pending_requests;
+
+        while !remaining.is_empty() {
+            let (result, rest) = select(remaining);
+            remaining = rest;
+
+            match result {
+                Ok(response) => {
+                    // Identify the provider from the backend name
+                    let backend_name = response.get_backend_name().unwrap_or_default().to_string();
+
+                    if let Some((provider_name, start_time, provider)) =
+                        backend_to_provider.remove(&backend_name)
+                    {
+                        let response_time_ms = start_time.elapsed().as_millis() as u64;
+
+                        match provider.parse_response(response, response_time_ms) {
+                            Ok(auction_response) => {
+                                log::info!(
+                                    "Provider '{}' returned {} bids (status: {:?}, time: {}ms)",
+                                    auction_response.provider,
+                                    auction_response.bids.len(),
+                                    auction_response.status,
+                                    auction_response.response_time_ms
+                                );
+                                responses.push(auction_response);
+                            }
+                            Err(e) => {
+                                log::warn!(
+                                    "Provider '{}' failed to parse response: {:?}",
+                                    provider_name,
+                                    e
+                                );
+                                responses
+                                    .push(AuctionResponse::error(provider_name, response_time_ms));
+                            }
+                        }
+                    } else {
+                        log::warn!(
+                            "Received response from unknown backend '{}', ignoring",
+                            backend_name
+                        );
+                    }
+                }
+                Err(e) => {
+                    // When select() returns an error, we can't easily identify which
+                    // provider failed since the PendingRequest is consumed
+                    log::warn!("A provider request failed: {:?}", e);
+                }
+            }
+        }
+
+        Ok(responses)
+    }
+
+    /// Select the best bid for each slot from all responses.
+    /// Note: Bids with None price (e.g., APS bids with encoded prices) are skipped
+    /// when no mediator is configured, as we cannot compare them without decoding.
+    fn select_winning_bids(
+        &self,
+        responses: &[AuctionResponse],
+        floor_prices: &HashMap<String, f64>,
+    ) -> HashMap<String, Bid> {
+        let mut winning_bids: HashMap<String, Bid> = HashMap::new();
+
+        for response in responses {
+            if response.status != BidStatus::Success {
+                continue;
+            }
+
+            for bid in &response.bids {
+                // Skip bids without decoded prices (e.g., APS bids)
+                // These require mediation layer to decode
+                let bid_price = match bid.price {
+                    Some(p) => p,
+                    None => {
+                        log::debug!(
+                            "Skipping bid for slot '{}' from '{}' - price requires mediation to decode",
+                            bid.slot_id,
+                            bid.bidder
+                        );
+                        continue;
+                    }
+                };
+
+                let should_replace = match winning_bids.get(&bid.slot_id) {
+                    Some(current_winner) => current_winner
+                        .price
+                        .is_none_or(|current_price| bid_price > current_price),
+                    None => true,
+                };
+
+                if should_replace {
+                    winning_bids.insert(bid.slot_id.clone(), bid.clone());
+                }
+            }
+        }
+
+        self.apply_floor_prices(winning_bids, floor_prices)
+    }
+
+    fn apply_floor_prices(
+        &self,
+        mut winning_bids: HashMap<String, Bid>,
+        floor_prices: &HashMap<String, f64>,
+    ) -> HashMap<String, Bid> {
+        if floor_prices.is_empty() {
+            log::info!("Selected {} winning bids", winning_bids.len());
+            return winning_bids;
+        }
+
+        let starting_count = winning_bids.len();
+        winning_bids.retain(|slot_id, bid| match floor_prices.get(slot_id) {
+            Some(floor) => {
+                // Bids without price (e.g., APS) pass through - floor checked in mediation
+                match bid.price {
+                    Some(price) if price >= *floor => true,
+                    Some(_) => {
+                        log::info!(
+                            "Dropping winning bid below floor price for slot '{}'",
+                            slot_id
+                        );
+                        false
+                    }
+                    None => {
+                        log::debug!(
+                            "Passing bid with encoded price for slot '{}' - floor check deferred to mediation",
+                            slot_id
+                        );
+                        true
+                    }
+                }
+            }
+            None => true,
+        });
+
+        if winning_bids.len() != starting_count {
+            log::info!(
+                "Filtered winning bids by floor price: {} -> {}",
+                starting_count,
+                winning_bids.len()
+            );
+        }
+
+        log::info!("Selected {} winning bids", winning_bids.len());
+        winning_bids
+    }
+
+    fn floor_prices_by_slot(&self, request: &AuctionRequest) -> HashMap<String, f64> {
+        request
+            .slots
+            .iter()
+            .filter_map(|slot| slot.floor_price.map(|price| (slot.id.clone(), price)))
+            .collect()
+    }
+
+    /// Get a provider by name.
+    fn get_provider(
+        &self,
+        name: &str,
+    ) -> Result<&Arc<dyn AuctionProvider>, Report<TrustedServerError>> {
+        self.providers.get(name).ok_or_else(|| {
+            log::warn!(
+                "Provider '{}' configured but not registered. Available providers: {:?}",
+                name,
+                self.providers.keys().collect::<Vec<_>>()
+            );
+            Report::new(TrustedServerError::Auction {
+                message: format!("Provider '{}' not registered", name),
+            })
+        })
+    }
+
+    /// Check if orchestrator is enabled.
+    pub fn is_enabled(&self) -> bool {
+        self.config.enabled
+    }
+}
+
+/// Result of an orchestrated auction.
+#[derive(Debug, Clone)]
+pub struct OrchestrationResult {
+    /// All responses from providers
+    pub provider_responses: Vec<AuctionResponse>,
+    /// Final response from mediator (if used)
+    pub mediator_response: Option<AuctionResponse>,
+    /// Winning bids per slot
+    pub winning_bids: HashMap<String, Bid>,
+    /// Total orchestration time in milliseconds
+    pub total_time_ms: u64,
+    /// Metadata about the auction
+    pub metadata: HashMap<String, serde_json::Value>,
+}
+
+impl OrchestrationResult {
+    /// Get the winning bid for a specific slot.
+    pub fn get_winning_bid(&self, slot_id: &str) -> Option<&Bid> {
+        self.winning_bids.get(slot_id)
+    }
+
+    /// Get all bids from all providers for a specific slot.
+    pub fn get_all_bids_for_slot(&self, slot_id: &str) -> Vec<&Bid> {
+        self.provider_responses
+            .iter()
+            .flat_map(|response| &response.bids)
+            .filter(|bid| bid.slot_id == slot_id)
+            .collect()
+    }
+
+    /// Get the total number of bids received.
+    pub fn total_bids(&self) -> usize {
+        self.provider_responses.iter().map(|r| r.bids.len()).sum()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::auction::config::AuctionConfig;
+    use crate::auction::types::{
+        AdFormat, AdSlot, AuctionContext, AuctionRequest, Bid, MediaType, PublisherInfo, UserInfo,
+    };
+    use crate::test_support::tests::crate_test_settings_str;
+    use fastly::Request;
+    use std::collections::HashMap;
+
+    use super::AuctionOrchestrator;
+
+    fn create_test_auction_request() -> AuctionRequest {
+        AuctionRequest {
+            id: "test-auction-123".to_string(),
+            slots: vec![
+                AdSlot {
+                    id: "header-banner".to_string(),
+                    formats: vec![AdFormat {
+                        media_type: MediaType::Banner,
+                        width: 728,
+                        height: 90,
+                    }],
+                    floor_price: Some(1.50),
+                    targeting: HashMap::new(),
+                },
+                AdSlot {
+                    id: "sidebar".to_string(),
+                    formats: vec![AdFormat {
+                        media_type: MediaType::Banner,
+                        width: 300,
+                        height: 250,
+                    }],
+                    floor_price: Some(1.00),
+                    targeting: HashMap::new(),
+                },
+            ],
+            publisher: PublisherInfo {
+                domain: "test.com".to_string(),
+                page_url: Some("https://test.com/article".to_string()),
+            },
+            user: UserInfo {
+                id: "user-123".to_string(),
+                fresh_id: "fresh-456".to_string(),
+                consent: None,
+            },
+            device: None,
+            site: None,
+            context: HashMap::new(),
+        }
+    }
+
+    fn create_test_settings() -> crate::settings::Settings {
+        let settings_str = crate_test_settings_str();
+        crate::settings::Settings::from_toml(&settings_str).expect("should parse test settings")
+    }
+
+    fn create_test_context<'a>(
+        settings: &'a crate::settings::Settings,
+        req: &'a Request,
+    ) -> AuctionContext<'a> {
+        AuctionContext {
+            settings,
+            request: req,
+            timeout_ms: 2000,
+            provider_responses: None,
+        }
+    }
+
+    #[test]
+    fn filters_winning_bids_below_floor() {
+        let orchestrator = AuctionOrchestrator::new(AuctionConfig::default());
+        let mut floor_prices = HashMap::new();
+        floor_prices.insert("slot-1".to_string(), 1.00);
+        floor_prices.insert("slot-2".to_string(), 2.00);
+
+        // Arrange winning bids with one below floor.
+        let mut winning_bids = HashMap::new();
+        winning_bids.insert(
+            "slot-1".to_string(),
+            Bid {
+                slot_id: "slot-1".to_string(),
+                price: Some(0.50),
+                currency: "USD".to_string(),
+                creative: Some("<div>Ad</div>".to_string()),
+                adomain: None,
+                bidder: "test-bidder".to_string(),
+                width: 300,
+                height: 250,
+                nurl: None,
+                burl: None,
+                metadata: HashMap::new(),
+            },
+        );
+        winning_bids.insert(
+            "slot-2".to_string(),
+            Bid {
+                slot_id: "slot-2".to_string(),
+                price: Some(2.00),
+                currency: "USD".to_string(),
+                creative: Some("<div>Ad</div>".to_string()),
+                adomain: None,
+                bidder: "test-bidder".to_string(),
+                width: 300,
+                height: 250,
+                nurl: None,
+                burl: None,
+                metadata: HashMap::new(),
+            },
+        );
+
+        // Apply floor pricing and validate the results.
+        let filtered = orchestrator.apply_floor_prices(winning_bids, &floor_prices);
+
+        assert_eq!(
+            filtered.len(),
+            1,
+            "Filtered bids should keep only those meeting floor price"
+        );
+        assert!(
+            filtered.contains_key("slot-2"),
+            "Filtered bids should include slot-2 winner"
+        );
+    }
+
+    // TODO: Re-enable these tests after implementing mock provider support for send_async()
+    // Mock providers currently don't work with concurrent requests because they can't
+    // create PendingRequest without real backends configured in Fastly.
+    //
+    // Options to fix:
+    // 1. Configure dummy backends in fastly.toml for testing
+    // 2. Refactor mock providers to use a different pattern
+    // 3. Create a test-only mock backend server
+
+    #[tokio::test]
+    async fn test_no_providers_configured() {
+        let config = AuctionConfig {
+            enabled: true,
+            providers: vec![],
+            mediator: None,
+            timeout_ms: 2000,
+            creative_store: "creative_store".to_string(),
+        };
+
+        let orchestrator = AuctionOrchestrator::new(config);
+
+        let request = create_test_auction_request();
+        let settings = create_test_settings();
+        let req = Request::get("https://test.com/test");
+        let context = create_test_context(&settings, &req);
+
+        let result = orchestrator.run_auction(&request, &context).await;
+
+        assert!(result.is_err());
+        let err = result.unwrap_err();
+        assert!(format!("{}", err).contains("No providers configured"));
+    }
+
+    #[test]
+    fn test_orchestrator_is_enabled() {
+        let config = AuctionConfig {
+            enabled: true,
+            ..Default::default()
+        };
+        let orchestrator = AuctionOrchestrator::new(config);
+        assert!(orchestrator.is_enabled());
+
+        let config = AuctionConfig {
+            enabled: false,
+            ..Default::default()
+        };
+        let orchestrator = AuctionOrchestrator::new(config);
+        assert!(!orchestrator.is_enabled());
+    }
+
+    #[test]
+    fn test_apply_floor_prices_allows_none_prices_for_encoded_bids() {
+        // Test that bids with None prices (APS-style) pass through floor pricing
+        // This is correct behavior for parallel-only strategy where mediation happens later
+        let orchestrator = AuctionOrchestrator::new(AuctionConfig::default());
+        let mut floor_prices = HashMap::new();
+        floor_prices.insert("slot-1".to_string(), 1.00);
+
+        let mut winning_bids = HashMap::new();
+        winning_bids.insert(
+            "slot-1".to_string(),
+            Bid {
+                slot_id: "slot-1".to_string(),
+                price: None, // APS bid with encoded price
+                currency: "USD".to_string(),
+                creative: Some("<div>Ad</div>".to_string()),
+                adomain: None,
+                bidder: "aps".to_string(),
+                width: 300,
+                height: 250,
+                nurl: None,
+                burl: None,
+                metadata: {
+                    let mut m = HashMap::new();
+                    m.insert(
+                        "amznbid".to_string(),
+                        serde_json::json!("encoded_price_data"),
+                    );
+                    m
+                },
+            },
+        );
+
+        // Apply floor pricing - should pass through with None price
+        let filtered = orchestrator.apply_floor_prices(winning_bids, &floor_prices);
+
+        assert_eq!(
+            filtered.len(),
+            1,
+            "APS bid with None price should pass through floor check"
+        );
+        assert!(
+            filtered.contains_key("slot-1"),
+            "Slot-1 should still be present"
+        );
+        assert!(
+            filtered.get("slot-1").unwrap().price.is_none(),
+            "Price should still be None (not decoded yet)"
+        );
+    }
+}
diff --git a/crates/common/src/auction/provider.rs b/crates/common/src/auction/provider.rs
new file mode 100644
index 0000000..3c7b790
--- /dev/null
+++ b/crates/common/src/auction/provider.rs
@@ -0,0 +1,61 @@
+//! Trait definition for auction providers.
+
+use error_stack::Report;
+use fastly::http::request::PendingRequest;
+
+use crate::error::TrustedServerError;
+
+use super::types::{AuctionContext, AuctionRequest, AuctionResponse};
+
+/// Trait implemented by all auction providers (Prebid, APS, GAM, etc.).
+pub trait AuctionProvider: Send + Sync {
+    /// Unique identifier for this provider (e.g., "prebid", "aps", "gam").
+    fn provider_name(&self) -> &'static str;
+
+    /// Submit a bid request to this provider and return a pending request.
+    ///
+    /// Implementations should:
+    /// - Transform AuctionRequest to provider-specific format
+    /// - Make HTTP call to provider endpoint using send_async()
+    /// - Return PendingRequest for orchestrator to await
+    ///
+    /// The orchestrator will handle waiting for responses and parsing them.
+    fn request_bids(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+    ) -> Result<PendingRequest, Report<TrustedServerError>>;
+
+    /// Parse the response from the provider into an AuctionResponse.
+    ///
+    /// Called by the orchestrator after the PendingRequest completes.
+    fn parse_response(
+        &self,
+        response: fastly::Response,
+        response_time_ms: u64,
+    ) -> Result<AuctionResponse, Report<TrustedServerError>>;
+
+    /// Check if this provider supports a specific media type.
+    fn supports_media_type(&self, media_type: &super::types::MediaType) -> bool {
+        // By default, support banner ads
+        matches!(media_type, super::types::MediaType::Banner)
+    }
+
+    /// Get the configured timeout for this provider in milliseconds.
+    fn timeout_ms(&self) -> u32;
+
+    /// Check if this provider is enabled.
+    fn is_enabled(&self) -> bool {
+        true
+    }
+
+    /// Return the backend name used by this provider for request routing.
+    ///
+    /// This is used by the orchestrator to correlate responses with providers
+    /// when using `select()` to wait for multiple concurrent requests.
+    /// The backend name should match what `ensure_backend_from_url()` returns
+    /// for this provider's endpoint.
+    fn backend_name(&self) -> Option<String> {
+        None
+    }
+}
diff --git a/crates/common/src/auction/types.rs b/crates/common/src/auction/types.rs
new file mode 100644
index 0000000..84eb4cb
--- /dev/null
+++ b/crates/common/src/auction/types.rs
@@ -0,0 +1,209 @@
+//! Core types for auction requests and responses.
+
+use fastly::Request;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+use crate::geo::GeoInfo;
+use crate::settings::Settings;
+
+/// Represents a unified auction request across all providers.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AuctionRequest {
+    /// Unique auction ID
+    pub id: String,
+    /// Ad slots/impressions being auctioned
+    pub slots: Vec<AdSlot>,
+    /// Publisher information
+    pub publisher: PublisherInfo,
+    /// User information (privacy-preserving)
+    pub user: UserInfo,
+    /// Device information
+    pub device: Option<DeviceInfo>,
+    /// Site information
+    pub site: Option<SiteInfo>,
+    /// Additional context
+    pub context: HashMap<String, serde_json::Value>,
+}
+
+/// Represents a single ad slot/impression.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AdSlot {
+    /// Slot identifier (e.g., "header-banner")
+    pub id: String,
+    /// Media types and formats supported
+    pub formats: Vec<AdFormat>,
+    /// Floor price if any
+    pub floor_price: Option<f64>,
+    /// Slot-specific targeting
+    pub targeting: HashMap<String, serde_json::Value>,
+}
+
+/// Ad format specification.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct AdFormat {
+    pub media_type: MediaType,
+    pub width: u32,
+    pub height: u32,
+}
+
+/// Media type enumeration.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum MediaType {
+    Banner,
+    Video,
+    Native,
+}
+
+/// Publisher information.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PublisherInfo {
+    pub domain: String,
+    pub page_url: Option<String>,
+}
+
+/// Privacy-preserving user information.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct UserInfo {
+    /// Synthetic/hashed user ID
+    pub id: String,
+    /// Fresh ID for this session
+    pub fresh_id: String,
+    /// GDPR consent string if applicable
+    pub consent: Option<String>,
+}
+
+/// Device information from request.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DeviceInfo {
+    pub user_agent: Option<String>,
+    pub ip: Option<String>,
+    pub geo: Option<GeoInfo>,
+}
+
+/// Site information.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SiteInfo {
+    pub domain: String,
+    pub page: String,
+}
+
+/// Context passed to auction providers.
+pub struct AuctionContext<'a> {
+    pub settings: &'a Settings,
+    pub request: &'a Request,
+    pub timeout_ms: u32,
+    /// Provider responses from the bidding phase, used by mediators.
+    /// This is `None` for regular bidders and `Some` when calling a mediator.
+    pub provider_responses: Option<&'a [AuctionResponse]>,
+}
+
+/// Response from a single auction provider.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AuctionResponse {
+    /// Provider that generated this response
+    pub provider: String,
+    /// Bids returned
+    pub bids: Vec<Bid>,
+    /// Status of the auction
+    pub status: BidStatus,
+    /// Response time in milliseconds
+    pub response_time_ms: u64,
+    /// Provider-specific metadata
+    pub metadata: HashMap<String, serde_json::Value>,
+}
+
+/// Individual bid from a provider.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Bid {
+    /// Slot this bid is for
+    pub slot_id: String,
+    /// Bid price in CPM
+    /// None for APS bids where price is encoded and must be decoded by mediation layer
+    pub price: Option<f64>,
+    /// Currency code (e.g., "USD")
+    pub currency: String,
+    /// Creative markup (HTML/VAST)
+    /// None when the bidder doesn't provide creative HTML (e.g., APS/TAM)
+    pub creative: Option<String>,
+    /// Advertiser domain
+    pub adomain: Option<Vec<String>>,
+    /// Bidder/seat identifier
+    pub bidder: String,
+    /// Width of creative
+    pub width: u32,
+    /// Height of creative
+    pub height: u32,
+    /// Win notification URL
+    pub nurl: Option<String>,
+    /// Billing notification URL
+    pub burl: Option<String>,
+    /// Provider-specific bid metadata
+    /// For APS bids, contains encoded price in "amznbid" field
+    pub metadata: HashMap<String, serde_json::Value>,
+}
+
+/// OpenRTB response metadata for the orchestrator.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct OrchestratorExt {
+    pub strategy: String,
+    pub providers: usize,
+    pub total_bids: usize,
+    pub time_ms: u64,
+}
+
+/// Status of bid response.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum BidStatus {
+    /// Auction completed successfully
+    Success,
+    /// No bids returned
+    NoBid,
+    /// Auction failed/timed out
+    Error,
+    /// Auction still in progress
+    Pending,
+}
+
+impl AuctionResponse {
+    /// Create a new successful auction response.
+    pub fn success(provider: impl Into<String>, bids: Vec<Bid>, response_time_ms: u64) -> Self {
+        Self {
+            provider: provider.into(),
+            bids,
+            status: BidStatus::Success,
+            response_time_ms,
+            metadata: HashMap::new(),
+        }
+    }
+
+    /// Create a no-bid response.
+    pub fn no_bid(provider: impl Into<String>, response_time_ms: u64) -> Self {
+        Self {
+            provider: provider.into(),
+            bids: Vec::new(),
+            status: BidStatus::NoBid,
+            response_time_ms,
+            metadata: HashMap::new(),
+        }
+    }
+
+    /// Create an error response.
+    pub fn error(provider: impl Into<String>, response_time_ms: u64) -> Self {
+        Self {
+            provider: provider.into(),
+            bids: Vec::new(),
+            status: BidStatus::Error,
+            response_time_ms,
+            metadata: HashMap::new(),
+        }
+    }
+
+    /// Add metadata to the response.
+    pub fn with_metadata(mut self, key: impl Into<String>, value: serde_json::Value) -> Self {
+        self.metadata.insert(key.into(), value);
+        self
+    }
+}
diff --git a/crates/common/src/auction_config_types.rs b/crates/common/src/auction_config_types.rs
new file mode 100644
index 0000000..e1cabd7
--- /dev/null
+++ b/crates/common/src/auction_config_types.rs
@@ -0,0 +1,50 @@
+//! Auction configuration types (separated to avoid circular deps in build.rs).
+
+use serde::{Deserialize, Serialize};
+
+/// Auction orchestration configuration.
+#[derive(Debug, Clone, Deserialize, Serialize, Default)]
+pub struct AuctionConfig {
+    /// Enable the auction orchestrator
+    #[serde(default)]
+    pub enabled: bool,
+
+    /// Provider names that participate in bidding
+    /// Simply list the provider names (e.g., ["prebid", "aps"])
+    #[serde(default, deserialize_with = "crate::settings::vec_from_seq_or_map")]
+    pub providers: Vec<String>,
+
+    /// Optional mediator provider name (e.g., "gam")
+    /// When set, runs parallel mediation strategy (bidders in parallel, then mediator decides)
+    /// When omitted, runs parallel only strategy (bidders in parallel, highest CPM wins)
+    pub mediator: Option<String>,
+
+    /// Timeout in milliseconds
+    #[serde(default = "default_timeout")]
+    pub timeout_ms: u32,
+
+    /// KV store name for creative storage (deprecated: creatives are now delivered inline)
+    #[serde(default = "default_creative_store")]
+    pub creative_store: String,
+}
+
+fn default_timeout() -> u32 {
+    2000
+}
+
+fn default_creative_store() -> String {
+    "creative_store".to_string()
+}
+
+#[allow(dead_code)] // Methods used in runtime but not in build script
+impl AuctionConfig {
+    /// Get all provider names.
+    pub fn provider_names(&self) -> &[String] {
+        &self.providers
+    }
+
+    /// Check if this config has a mediator configured.
+    pub fn has_mediator(&self) -> bool {
+        self.mediator.is_some()
+    }
+}
diff --git a/crates/common/src/error.rs b/crates/common/src/error.rs
index b57bc5d..c5964cf 100644
--- a/crates/common/src/error.rs
+++ b/crates/common/src/error.rs
@@ -22,6 +22,10 @@ pub enum TrustedServerError {
     #[display("Configuration error: {message}")]
     Configuration { message: String },
 
+    /// Auction orchestration error.
+    #[display("Auction error: {message}")]
+    Auction { message: String },
+
     /// GAM (Google Ad Manager) integration error.
     #[display("GAM error: {message}")]
     Gam { message: String },
@@ -89,6 +93,7 @@ pub trait IntoHttpResponse {
 impl IntoHttpResponse for TrustedServerError {
     fn status_code(&self) -> StatusCode {
         match self {
+            Self::Auction { .. } => StatusCode::BAD_GATEWAY,
             Self::BadRequest { .. } => StatusCode::BAD_REQUEST,
             Self::Configuration { .. } | Self::Settings { .. } => StatusCode::INTERNAL_SERVER_ERROR,
             Self::Gam { .. } => StatusCode::BAD_GATEWAY,
diff --git a/crates/common/src/geo.rs b/crates/common/src/geo.rs
index f3af042..dff097d 100644
--- a/crates/common/src/geo.rs
+++ b/crates/common/src/geo.rs
@@ -15,7 +15,7 @@ use crate::constants::{
 ///
 /// Contains all available geographic data from Fastly's geolocation service,
 /// including city, country, continent, coordinates, and DMA/metro code.
-#[derive(Debug, Clone, serde::Serialize)]
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
 pub struct GeoInfo {
     /// City name
     pub city: String,
diff --git a/crates/common/src/integrations/adserver_mock.rs b/crates/common/src/integrations/adserver_mock.rs
new file mode 100644
index 0000000..5c759f4
--- /dev/null
+++ b/crates/common/src/integrations/adserver_mock.rs
@@ -0,0 +1,706 @@
+//! Mock Ad Server Integration
+//!
+//! Provides a mock ad server mediator that calls mocktioneer's mediation endpoint.
+//! This integration acts as a mediator in the auction flow, selecting winning bids
+//! based on price (highest price wins).
+
+use error_stack::{Report, ResultExt};
+use fastly::http::Method;
+use fastly::Request;
+use serde::{Deserialize, Serialize};
+use serde_json::{json, Value as Json};
+use std::collections::HashMap;
+use std::sync::Arc;
+use validator::Validate;
+
+use crate::auction::provider::AuctionProvider;
+use crate::auction::types::{
+    AuctionContext, AuctionRequest, AuctionResponse, Bid, BidStatus, MediaType,
+};
+use crate::backend::ensure_backend_from_url;
+use crate::error::TrustedServerError;
+use crate::settings::{IntegrationConfig, Settings};
+
+// ============================================================================
+// Configuration
+// ============================================================================
+
+/// Configuration for mock ad server integration.
+#[derive(Debug, Clone, Deserialize, Serialize, Validate)]
+pub struct AdServerMockConfig {
+    /// Whether this integration is enabled
+    #[serde(default = "default_enabled")]
+    pub enabled: bool,
+
+    /// Mediation endpoint URL
+    pub endpoint: String,
+
+    /// Timeout in milliseconds
+    #[serde(default = "default_timeout_ms")]
+    pub timeout_ms: u32,
+
+    /// Optional price floor (minimum acceptable CPM)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub price_floor: Option<f64>,
+}
+
+fn default_enabled() -> bool {
+    false
+}
+
+fn default_timeout_ms() -> u32 {
+    500
+}
+
+impl Default for AdServerMockConfig {
+    fn default() -> Self {
+        Self {
+            enabled: default_enabled(),
+            endpoint: "http://localhost:6767/adserver/mediate".to_string(),
+            timeout_ms: default_timeout_ms(),
+            price_floor: None,
+        }
+    }
+}
+
+impl IntegrationConfig for AdServerMockConfig {
+    fn is_enabled(&self) -> bool {
+        self.enabled
+    }
+}
+
+// ============================================================================
+// Provider
+// ============================================================================
+
+/// Mock ad server mediator provider.
+pub struct AdServerMockProvider {
+    config: AdServerMockConfig,
+}
+
+impl AdServerMockProvider {
+    /// Create a new mock ad server provider.
+    pub fn new(config: AdServerMockConfig) -> Self {
+        Self { config }
+    }
+
+    /// Build mediation request from auction request and bidder responses.
+    ///
+    /// Handles both:
+    /// - Regular bids with decoded prices (price field set)
+    /// - APS-style bids with encoded prices (price=None, encoded price in metadata)
+    fn build_mediation_request(
+        &self,
+        request: &AuctionRequest,
+        bidder_responses: &[AuctionResponse],
+    ) -> Result<Json, Report<TrustedServerError>> {
+        // Convert bidder responses to mediation format
+        let bidder_responses_json: Vec<Json> = bidder_responses
+            .iter()
+            .filter(|r| r.status == BidStatus::Success)
+            .map(|response| {
+                let bids: Vec<Json> = response
+                    .bids
+                    .iter()
+                    .map(|bid| {
+                        // Check if this is an APS bid with encoded price (inferred from amznbid in metadata)
+                        let encoded_price = bid
+                            .metadata
+                            .get("amznbid")
+                            .and_then(|v| v.as_str())
+                            .map(String::from);
+
+                        if encoded_price.is_some() {
+                            // APS bid - send encoded price for mediation to decode
+                            json!({
+                                "imp_id": bid.slot_id,
+                                "encoded_price": encoded_price,
+                                "adm": bid.creative,
+                                "w": bid.width,
+                                "h": bid.height,
+                                "crid": format!("{}-creative", bid.bidder),
+                                "adomain": bid.adomain,
+                            })
+                        } else {
+                            // Regular bid with decoded price
+                            json!({
+                                "imp_id": bid.slot_id,
+                                "price": bid.price,
+                                "adm": bid.creative,
+                                "w": bid.width,
+                                "h": bid.height,
+                                "crid": format!("{}-creative", bid.bidder),
+                                "adomain": bid.adomain,
+                            })
+                        }
+                    })
+                    .collect();
+
+                json!({
+                    "bidder": response.provider,
+                    "bids": bids,
+                })
+            })
+            .collect();
+
+        // Build impressions from request slots
+        let imps: Vec<Json> = request
+            .slots
+            .iter()
+            .map(|slot| {
+                let banner_format = slot
+                    .formats
+                    .iter()
+                    .find(|f| f.media_type == MediaType::Banner);
+
+                json!({
+                    "id": slot.id,
+                    "banner": banner_format.map(|f| json!({
+                        "w": f.width,
+                        "h": f.height,
+                    })),
+                })
+            })
+            .collect();
+
+        // Build mediation config
+        let config_json = if self.config.price_floor.is_some() {
+            json!({
+                "price_floor": self.config.price_floor,
+            })
+        } else {
+            json!(null)
+        };
+
+        // Build full mediation request
+        Ok(json!({
+            "id": request.id,
+            "imp": imps,
+            "ext": {
+                "bidder_responses": bidder_responses_json,
+                "config": config_json,
+            },
+        }))
+    }
+
+    /// Parse OpenRTB response from mediation endpoint.
+    /// Mediation returns decoded prices for all bids (including APS bids that were encoded).
+    fn parse_mediation_response(&self, json: &Json, response_time_ms: u64) -> AuctionResponse {
+        // Parse OpenRTB response
+        let empty_array = vec![];
+        let seatbid = json["seatbid"].as_array().unwrap_or(&empty_array);
+
+        let mut all_bids = Vec::new();
+
+        for seat in seatbid {
+            let seat_name = seat["seat"].as_str().unwrap_or("unknown");
+            let empty_bids = vec![];
+            let bids = seat["bid"].as_array().unwrap_or(&empty_bids);
+
+            for bid in bids {
+                // Mediation layer returns decoded prices for all bids
+                all_bids.push(Bid {
+                    slot_id: bid["impid"].as_str().unwrap_or("").to_string(),
+                    price: bid["price"].as_f64(), // Now properly decoded by mediation
+                    currency: "USD".to_string(),
+                    creative: bid["adm"].as_str().map(String::from),
+                    width: bid["w"].as_u64().unwrap_or(0) as u32,
+                    height: bid["h"].as_u64().unwrap_or(0) as u32,
+                    bidder: seat_name.to_string(),
+                    adomain: bid["adomain"].as_array().map(|arr| {
+                        arr.iter()
+                            .filter_map(|v| v.as_str().map(String::from))
+                            .collect()
+                    }),
+                    nurl: None,
+                    burl: None,
+                    metadata: HashMap::new(),
+                });
+            }
+        }
+
+        if all_bids.is_empty() {
+            AuctionResponse::no_bid("adserver_mock", response_time_ms)
+        } else {
+            AuctionResponse::success("adserver_mock", all_bids, response_time_ms)
+        }
+    }
+}
+
+impl AuctionProvider for AdServerMockProvider {
+    fn provider_name(&self) -> &'static str {
+        "adserver_mock"
+    }
+
+    fn request_bids(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+    ) -> Result<fastly::http::request::PendingRequest, Report<TrustedServerError>> {
+        // Get bidder responses from context (passed by orchestrator for mediation)
+        let bidder_responses = context.provider_responses.unwrap_or(&[]);
+
+        log::info!(
+            "AdServer Mock: mediating {} slots with {} bidder responses",
+            request.slots.len(),
+            bidder_responses.len()
+        );
+
+        // Build mediation request
+        let mediation_req = self
+            .build_mediation_request(request, bidder_responses)
+            .change_context(TrustedServerError::Auction {
+                message: "Failed to build mediation request".to_string(),
+            })?;
+
+        log::debug!("AdServer Mock: mediation request: {:?}", mediation_req);
+
+        // Create HTTP POST request
+        let mut req = Request::new(Method::POST, &self.config.endpoint);
+
+        // Set Host header with port to ensure mocktioneer generates correct iframe URLs
+        if let Ok(url) = url::Url::parse(&self.config.endpoint) {
+            if let Some(host) = url.host_str() {
+                let host_with_port = if let Some(port) = url.port() {
+                    format!("{}:{}", host, port)
+                } else {
+                    host.to_string()
+                };
+                req.set_header("Host", &host_with_port);
+            }
+        }
+
+        req.set_body_json(&mediation_req)
+            .change_context(TrustedServerError::Auction {
+                message: "Failed to set mediation request body".to_string(),
+            })?;
+
+        // Send async
+        let backend_name = ensure_backend_from_url(&self.config.endpoint).change_context(
+            TrustedServerError::Auction {
+                message: format!(
+                    "Failed to resolve backend for mediation endpoint: {}",
+                    self.config.endpoint
+                ),
+            },
+        )?;
+
+        let pending = req
+            .send_async(backend_name)
+            .change_context(TrustedServerError::Auction {
+                message: "Failed to send mediation request".to_string(),
+            })?;
+
+        Ok(pending)
+    }
+
+    fn parse_response(
+        &self,
+        mut response: fastly::Response,
+        response_time_ms: u64,
+    ) -> Result<AuctionResponse, Report<TrustedServerError>> {
+        if !response.get_status().is_success() {
+            log::warn!(
+                "AdServer Mock returned non-success: {}",
+                response.get_status()
+            );
+            return Ok(AuctionResponse::error("adserver_mock", response_time_ms));
+        }
+
+        let body_bytes = response.take_body_bytes();
+        let response_json: Json =
+            serde_json::from_slice(&body_bytes).change_context(TrustedServerError::Auction {
+                message: "Failed to parse mediation response".to_string(),
+            })?;
+
+        log::debug!("AdServer Mock response: {:?}", response_json);
+
+        let auction_response = self.parse_mediation_response(&response_json, response_time_ms);
+
+        log::info!(
+            "AdServer Mock returned {} bids in {}ms",
+            auction_response.bids.len(),
+            response_time_ms
+        );
+
+        Ok(auction_response)
+    }
+
+    fn supports_media_type(&self, media_type: &MediaType) -> bool {
+        matches!(media_type, MediaType::Banner)
+    }
+
+    fn timeout_ms(&self) -> u32 {
+        self.config.timeout_ms
+    }
+
+    fn is_enabled(&self) -> bool {
+        self.config.enabled
+    }
+
+    fn backend_name(&self) -> Option<String> {
+        ensure_backend_from_url(&self.config.endpoint).ok()
+    }
+}
+
+// ============================================================================
+// Auto-Registration
+// ============================================================================
+
+/// Auto-register ad server mock provider based on settings configuration.
+pub fn register_providers(settings: &Settings) -> Vec<Arc<dyn AuctionProvider>> {
+    let mut providers: Vec<Arc<dyn AuctionProvider>> = Vec::new();
+
+    match settings.integration_config::<AdServerMockConfig>("adserver_mock") {
+        Ok(Some(config)) => {
+            log::info!(
+                "Registering AdServer Mock mediator (endpoint: {})",
+                config.endpoint
+            );
+            providers.push(Arc::new(AdServerMockProvider::new(config)));
+        }
+        Ok(None) => {
+            log::debug!("AdServer Mock config found but is disabled");
+        }
+        Err(e) => {
+            log::error!("Failed to load AdServer Mock config: {:?}", e);
+        }
+    }
+
+    providers
+}
+
+// ============================================================================
+// Tests
+// ============================================================================
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::auction::types::*;
+
+    fn create_test_auction_request() -> AuctionRequest {
+        AuctionRequest {
+            id: "test-auction-123".to_string(),
+            slots: vec![AdSlot {
+                id: "header-banner".to_string(),
+                formats: vec![AdFormat {
+                    media_type: MediaType::Banner,
+                    width: 728,
+                    height: 90,
+                }],
+                floor_price: Some(1.50),
+                targeting: HashMap::new(),
+            }],
+            publisher: PublisherInfo {
+                domain: "test.com".to_string(),
+                page_url: Some("https://test.com/article".to_string()),
+            },
+            user: UserInfo {
+                id: "user-123".to_string(),
+                fresh_id: "fresh-456".to_string(),
+                consent: None,
+            },
+            device: Some(DeviceInfo {
+                user_agent: Some("Mozilla/5.0".to_string()),
+                ip: Some("192.168.1.1".to_string()),
+                geo: None,
+            }),
+            site: None,
+            context: HashMap::new(),
+        }
+    }
+
+    #[test]
+    fn test_build_mediation_request() {
+        let config = AdServerMockConfig {
+            enabled: true,
+            endpoint: "http://localhost:6767/adserver/mediate".to_string(),
+            timeout_ms: 500,
+            price_floor: Some(1.00),
+        };
+
+        let provider = AdServerMockProvider::new(config);
+        let mut auction_request = create_test_auction_request();
+
+        // Add bidder responses to context
+        let bidder_responses = vec![
+            AuctionResponse {
+                provider: "amazon-aps".to_string(),
+                status: BidStatus::Success,
+                bids: vec![Bid {
+                    slot_id: "header-banner".to_string(),
+                    price: Some(3.00),
+                    currency: "USD".to_string(),
+                    creative: Some("<div>APS Ad</div>".to_string()),
+                    width: 728,
+                    height: 90,
+                    bidder: "amazon-aps".to_string(),
+                    adomain: Some(vec!["amazon.com".to_string()]),
+                    nurl: None,
+                    burl: None,
+                    metadata: HashMap::new(),
+                }],
+                response_time_ms: 150,
+                metadata: HashMap::new(),
+            },
+            AuctionResponse {
+                provider: "test-bidder".to_string(),
+                status: BidStatus::Success,
+                bids: vec![Bid {
+                    slot_id: "header-banner".to_string(),
+                    price: Some(3.50),
+                    currency: "USD".to_string(),
+                    creative: Some("<div>Test Ad</div>".to_string()),
+                    width: 728,
+                    height: 90,
+                    bidder: "test-bidder".to_string(),
+                    adomain: None,
+                    nurl: None,
+                    burl: None,
+                    metadata: HashMap::new(),
+                }],
+                response_time_ms: 120,
+                metadata: HashMap::new(),
+            },
+        ];
+
+        auction_request.context.insert(
+            "provider_responses".to_string(),
+            serde_json::to_value(&bidder_responses).unwrap(),
+        );
+
+        let mediation_req = provider
+            .build_mediation_request(&auction_request, &bidder_responses)
+            .unwrap();
+
+        // Verify structure
+        assert_eq!(mediation_req["id"], "test-auction-123");
+        assert_eq!(mediation_req["imp"].as_array().unwrap().len(), 1);
+        assert_eq!(
+            mediation_req["ext"]["bidder_responses"]
+                .as_array()
+                .unwrap()
+                .len(),
+            2
+        );
+        assert_eq!(mediation_req["ext"]["config"]["price_floor"], 1.00);
+    }
+
+    #[test]
+    fn test_parse_mediation_response() {
+        let config = AdServerMockConfig::default();
+        let provider = AdServerMockProvider::new(config);
+
+        let mediation_response = json!({
+            "id": "test-auction-123",
+            "seatbid": [
+                {
+                    "seat": "test-bidder",
+                    "bid": [
+                        {
+                            "id": "bid-001",
+                            "impid": "header-banner",
+                            "price": 3.50,
+                            "adm": "<div>Test Ad</div>",
+                            "w": 728,
+                            "h": 90,
+                            "crid": "test-creative",
+                            "adomain": ["test.com"]
+                        }
+                    ]
+                }
+            ],
+            "cur": "USD"
+        });
+
+        let auction_response = provider.parse_mediation_response(&mediation_response, 200);
+
+        assert_eq!(auction_response.provider, "adserver_mock");
+        assert_eq!(auction_response.status, BidStatus::Success);
+        assert_eq!(auction_response.bids.len(), 1);
+        assert_eq!(auction_response.response_time_ms, 200);
+
+        let bid = &auction_response.bids[0];
+        assert_eq!(bid.slot_id, "header-banner");
+        assert_eq!(bid.price, Some(3.50)); // Mediation returns decoded price
+        assert_eq!(bid.bidder, "test-bidder");
+        assert_eq!(bid.width, 728);
+        assert_eq!(bid.height, 90);
+    }
+
+    #[test]
+    fn test_parse_empty_mediation_response() {
+        let config = AdServerMockConfig::default();
+        let provider = AdServerMockProvider::new(config);
+
+        let mediation_response = json!({
+            "id": "test-auction-123",
+            "seatbid": [],
+            "cur": "USD"
+        });
+
+        let auction_response = provider.parse_mediation_response(&mediation_response, 100);
+
+        assert_eq!(auction_response.status, BidStatus::NoBid);
+        assert_eq!(auction_response.bids.len(), 0);
+    }
+
+    #[test]
+    fn test_mediation_request_handles_none_creative() {
+        // Test that bids without creative HTML (e.g., APS) are properly sent to mediation
+        let config = AdServerMockConfig::default();
+        let provider = AdServerMockProvider::new(config);
+
+        let auction_request = AuctionRequest {
+            id: "test-auction".to_string(),
+            slots: vec![AdSlot {
+                id: "slot-1".to_string(),
+                formats: vec![AdFormat {
+                    media_type: MediaType::Banner,
+                    width: 300,
+                    height: 250,
+                }],
+                floor_price: None,
+                targeting: HashMap::new(),
+            }],
+            publisher: PublisherInfo {
+                domain: "test.com".to_string(),
+                page_url: None,
+            },
+            user: UserInfo {
+                id: "user-1".to_string(),
+                fresh_id: "fresh-1".to_string(),
+                consent: None,
+            },
+            device: None,
+            site: None,
+            context: HashMap::new(),
+        };
+
+        // APS bid with encoded price (price=None, amznbid in metadata)
+        let mut aps_metadata = HashMap::new();
+        aps_metadata.insert("amznbid".to_string(), json!("encoded-price-value"));
+
+        let bidder_responses = vec![AuctionResponse {
+            provider: "aps".to_string(),
+            status: BidStatus::Success,
+            bids: vec![Bid {
+                slot_id: "slot-1".to_string(),
+                price: None, // APS bids have no decoded price
+                currency: "USD".to_string(),
+                creative: None, // APS doesn't provide creative
+                width: 300,
+                height: 250,
+                bidder: "amazon-aps".to_string(),
+                adomain: Some(vec!["amazon.com".to_string()]),
+                nurl: None,
+                burl: None,
+                metadata: aps_metadata,
+            }],
+            response_time_ms: 100,
+            metadata: HashMap::new(),
+        }];
+
+        let mediation_req = provider
+            .build_mediation_request(&auction_request, &bidder_responses)
+            .expect("should build request");
+
+        // Verify the mediation request structure
+        assert_eq!(mediation_req["id"], "test-auction");
+
+        // Check that the bid was included with encoded_price
+        let bidder_resp = &mediation_req["ext"]["bidder_responses"][0];
+        assert_eq!(bidder_resp["bidder"], "aps");
+
+        let bid = &bidder_resp["bids"][0];
+        assert_eq!(bid["imp_id"], "slot-1");
+
+        // Key assertions for APS-style encoded price bids:
+        // 1. Should NOT have "price" field (or it should be null)
+        assert!(
+            bid["price"].is_null(),
+            "APS bids should not have decoded price, got: {:?}",
+            bid["price"]
+        );
+        // 2. Should have "encoded_price" field
+        assert_eq!(
+            bid["encoded_price"].as_str(),
+            Some("encoded-price-value"),
+            "APS bids should have encoded_price from metadata"
+        );
+        // 3. adm should be null (not a string)
+        assert!(
+            bid["adm"].is_null(),
+            "Creative-less bids should have null adm, got: {:?}",
+            bid["adm"]
+        );
+    }
+
+    #[test]
+    fn test_provider_metadata() {
+        let config = AdServerMockConfig::default();
+        let provider = AdServerMockProvider::new(config);
+
+        assert_eq!(provider.provider_name(), "adserver_mock");
+        assert!(!provider.is_enabled()); // Default is disabled
+        assert_eq!(provider.timeout_ms(), 500);
+        assert!(provider.supports_media_type(&MediaType::Banner));
+        assert!(!provider.supports_media_type(&MediaType::Video));
+        assert!(!provider.supports_media_type(&MediaType::Native));
+    }
+
+    #[test]
+    fn test_parse_mediation_response_with_missing_prices() {
+        // Test that mediator response with missing price fields returns None prices
+        // This tests the scenario where mediation failed to decode APS prices
+        let config = AdServerMockConfig::default();
+        let provider = AdServerMockProvider::new(config);
+
+        let mediation_response = json!({
+            "id": "test-auction-123",
+            "seatbid": [
+                {
+                    "seat": "test-bidder",
+                    "bid": [
+                        {
+                            "id": "bid-001",
+                            "impid": "header-banner",
+                            "price": 3.50,
+                            "adm": "<div>Valid Ad</div>",
+                            "w": 728,
+                            "h": 90,
+                        },
+                        {
+                            "id": "bid-002",
+                            "impid": "sidebar",
+                            // Note: No "price" field - mediation failed to decode
+                            "adm": "<div>Failed decode</div>",
+                            "w": 300,
+                            "h": 250,
+                        }
+                    ]
+                }
+            ],
+            "cur": "USD"
+        });
+
+        let auction_response = provider.parse_mediation_response(&mediation_response, 200);
+
+        assert_eq!(auction_response.status, BidStatus::Success);
+        assert_eq!(auction_response.bids.len(), 2);
+
+        // First bid should have decoded price
+        let bid1 = &auction_response.bids[0];
+        assert_eq!(bid1.slot_id, "header-banner");
+        assert_eq!(bid1.price, Some(3.50));
+
+        // Second bid should have None price (failed decode)
+        let bid2 = &auction_response.bids[1];
+        assert_eq!(bid2.slot_id, "sidebar");
+        assert_eq!(
+            bid2.price, None,
+            "Bid without price field should have None price"
+        );
+    }
+}
diff --git a/crates/common/src/integrations/aps.rs b/crates/common/src/integrations/aps.rs
new file mode 100644
index 0000000..26c5a09
--- /dev/null
+++ b/crates/common/src/integrations/aps.rs
@@ -0,0 +1,910 @@
+//! Amazon Publisher Services (APS/TAM) integration.
+//!
+//! This module provides the APS auction provider for server-side bidding.
+
+use error_stack::{Report, ResultExt};
+use fastly::http::Method;
+use fastly::Request;
+use serde::{Deserialize, Serialize};
+use serde_json::{json, Value as Json};
+use std::collections::HashMap;
+use validator::Validate;
+
+use crate::auction::provider::AuctionProvider;
+use crate::auction::types::{AuctionContext, AuctionRequest, AuctionResponse, Bid, MediaType};
+use crate::backend::ensure_backend_from_url;
+use crate::error::TrustedServerError;
+use crate::settings::IntegrationConfig;
+
+// ============================================================================
+// APS TAM API Types
+// ============================================================================
+
+/// APS TAM bid request format based on /e/dtb/bid endpoint.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct ApsBidRequest {
+    /// Publisher ID
+    #[serde(rename = "pubId")]
+    pub_id: String,
+
+    /// Slot configurations
+    slots: Vec<ApsSlot>,
+
+    /// Page URL
+    #[serde(rename = "pageUrl", skip_serializing_if = "Option::is_none")]
+    page_url: Option<String>,
+
+    /// User agent
+    #[serde(rename = "ua", skip_serializing_if = "Option::is_none")]
+    user_agent: Option<String>,
+
+    /// Timeout in milliseconds
+    #[serde(skip_serializing_if = "Option::is_none")]
+    timeout: Option<u32>,
+}
+
+/// APS slot configuration.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct ApsSlot {
+    /// Slot identifier
+    #[serde(rename = "slotID")]
+    slot_id: String,
+
+    /// Ad sizes [[width, height], ...]
+    sizes: Vec<[u32; 2]>,
+
+    /// Slot name (optional)
+    #[serde(rename = "slotName", skip_serializing_if = "Option::is_none")]
+    slot_name: Option<String>,
+}
+
+/// APS TAM bid response format matching real Amazon API.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct ApsBidResponse {
+    /// Contextual wrapper containing all response data
+    contextual: ApsContextual,
+}
+
+/// APS Contextual response containing slots and metadata.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct ApsContextual {
+    /// Array of slot responses (one per requested slot)
+    #[serde(default)]
+    slots: Vec<ApsSlotResponse>,
+
+    /// Event tracking host
+    #[serde(skip_serializing_if = "Option::is_none")]
+    host: Option<String>,
+
+    /// Response status ("ok", "error", etc.)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    status: Option<String>,
+
+    /// Client-side feature enablement flag
+    #[serde(skip_serializing_if = "Option::is_none")]
+    cfe: Option<bool>,
+
+    /// Event tracking enabled
+    #[serde(skip_serializing_if = "Option::is_none")]
+    ev: Option<bool>,
+
+    /// Client feature name (CSM script path)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    cfn: Option<String>,
+
+    /// Callback version
+    #[serde(skip_serializing_if = "Option::is_none")]
+    cb: Option<String>,
+
+    /// Campaign tracking URL
+    #[serde(skip_serializing_if = "Option::is_none")]
+    cmp: Option<String>,
+}
+
+/// Individual APS slot response matching real Amazon format.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct ApsSlotResponse {
+    /// Slot ID this response is for
+    #[serde(rename = "slotID")]
+    slot_id: String,
+
+    /// Creative size (e.g., "300x250")
+    size: String,
+
+    /// Creative ID
+    #[serde(skip_serializing_if = "Option::is_none")]
+    crid: Option<String>,
+
+    /// Media type ("d" for display, "v" for video)
+    #[serde(rename = "mediaType", skip_serializing_if = "Option::is_none")]
+    media_type: Option<String>,
+
+    /// Fill indicator flag ("1" = filled, "0" = no fill)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    fif: Option<String>,
+
+    /// List of targeting key names that are set on this slot
+    #[serde(default)]
+    targeting: Vec<String>,
+
+    /// List of metadata field names
+    #[serde(default)]
+    meta: Vec<String>,
+
+    // Targeting key-value pairs (returned as flat fields)
+    /// Amazon impression ID (unique identifier for this bid)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    amzniid: Option<String>,
+
+    /// Amazon encoded bid price
+    #[serde(skip_serializing_if = "Option::is_none")]
+    amznbid: Option<String>,
+
+    /// Amazon encoded price (alternative encoding)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    amznp: Option<String>,
+
+    /// Amazon size in WxH format (e.g., "300x250")
+    #[serde(skip_serializing_if = "Option::is_none")]
+    amznsz: Option<String>,
+
+    /// Amazon auction context type ("OPEN", "PRIVATE", etc.)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    amznactt: Option<String>,
+}
+
+// ============================================================================
+// Real APS Provider
+// ============================================================================
+
+/// Configuration for APS integration.
+#[derive(Debug, Clone, Deserialize, Serialize, Validate)]
+pub struct ApsConfig {
+    /// Whether APS integration is enabled
+    #[serde(default = "default_enabled")]
+    pub enabled: bool,
+
+    /// APS publisher ID (accepts both string and integer from config)
+    #[serde(deserialize_with = "deserialize_pub_id")]
+    pub pub_id: String,
+
+    /// APS API endpoint
+    #[serde(default = "default_endpoint")]
+    pub endpoint: String,
+
+    /// Timeout in milliseconds
+    #[serde(default = "default_timeout_ms")]
+    pub timeout_ms: u32,
+}
+
+/// Custom deserializer for pub_id that accepts both string and integer
+fn deserialize_pub_id<'de, D>(deserializer: D) -> Result<String, D::Error>
+where
+    D: serde::Deserializer<'de>,
+{
+    use serde::de::{self, Visitor};
+    use std::fmt;
+
+    struct PubIdVisitor;
+
+    impl<'de> Visitor<'de> for PubIdVisitor {
+        type Value = String;
+
+        fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
+            formatter.write_str("a string or integer for pub_id")
+        }
+
+        fn visit_str<E>(self, value: &str) -> Result<String, E>
+        where
+            E: de::Error,
+        {
+            Ok(value.to_string())
+        }
+
+        fn visit_string<E>(self, value: String) -> Result<String, E>
+        where
+            E: de::Error,
+        {
+            Ok(value)
+        }
+
+        fn visit_i64<E>(self, value: i64) -> Result<String, E>
+        where
+            E: de::Error,
+        {
+            Ok(value.to_string())
+        }
+
+        fn visit_u64<E>(self, value: u64) -> Result<String, E>
+        where
+            E: de::Error,
+        {
+            Ok(value.to_string())
+        }
+    }
+
+    deserializer.deserialize_any(PubIdVisitor)
+}
+
+fn default_enabled() -> bool {
+    false
+}
+
+fn default_endpoint() -> String {
+    "https://aax.amazon-adsystem.com/e/dtb/bid".to_string()
+}
+
+fn default_timeout_ms() -> u32 {
+    800
+}
+
+impl Default for ApsConfig {
+    fn default() -> Self {
+        Self {
+            enabled: default_enabled(),
+            pub_id: String::new(),
+            endpoint: default_endpoint(),
+            timeout_ms: default_timeout_ms(),
+        }
+    }
+}
+
+impl IntegrationConfig for ApsConfig {
+    fn is_enabled(&self) -> bool {
+        self.enabled
+    }
+}
+
+/// Amazon APS auction provider.
+pub struct ApsAuctionProvider {
+    config: ApsConfig,
+}
+
+impl ApsAuctionProvider {
+    /// Create a new APS auction provider.
+    pub fn new(config: ApsConfig) -> Self {
+        Self { config }
+    }
+
+    /// Convert unified AuctionRequest to APS TAM bid request format.
+    fn to_aps_request(&self, request: &AuctionRequest) -> ApsBidRequest {
+        let slots: Vec<ApsSlot> = request
+            .slots
+            .iter()
+            .map(|slot| {
+                // Extract sizes from banner formats
+                let sizes: Vec<[u32; 2]> = slot
+                    .formats
+                    .iter()
+                    .filter(|f| f.media_type == MediaType::Banner)
+                    .map(|f| [f.width, f.height])
+                    .collect();
+
+                ApsSlot {
+                    slot_id: slot.id.clone(),
+                    sizes,
+                    slot_name: Some(slot.id.clone()),
+                }
+            })
+            .collect();
+
+        ApsBidRequest {
+            pub_id: self.config.pub_id.clone(),
+            slots,
+            page_url: request.publisher.page_url.clone(),
+            user_agent: request.device.as_ref().and_then(|d| d.user_agent.clone()),
+            timeout: Some(self.config.timeout_ms),
+        }
+    }
+
+    /// Parse size string (e.g., "300x250") into width and height.
+    fn parse_size(size: &str) -> Option<(u32, u32)> {
+        let parts: Vec<&str> = size.split('x').collect();
+        if parts.len() == 2 {
+            if let (Ok(w), Ok(h)) = (parts[0].parse::<u32>(), parts[1].parse::<u32>()) {
+                return Some((w, h));
+            }
+        }
+        None
+    }
+
+    /// Parse a single APS slot response into unified Bid format.
+    ///
+    /// Note: Price is NOT decoded here. The encoded price is stored in metadata
+    /// and will be decoded by the mediation layer (mocktioneer). This simulates
+    /// real-world APS where only Amazon/GAM can decode the proprietary price encoding.
+    fn parse_aps_slot(&self, slot: ApsSlotResponse) -> Result<Bid, ()> {
+        // Only process filled slots (fif == "1")
+        if slot.fif.as_deref() != Some("1") {
+            return Err(());
+        }
+
+        // Verify we have an encoded price field
+        let encoded_price = slot.amznbid.as_ref().or(slot.amznp.as_ref());
+        if encoded_price.is_none() {
+            log::debug!(
+                "APS: slot '{}' has no encoded price, skipping",
+                slot.slot_id
+            );
+            return Err(());
+        }
+
+        // Parse size from "WxH" format
+        let (width, height) = Self::parse_size(&slot.size).unwrap_or((0, 0));
+
+        // Build metadata from targeting keys - includes encoded price for mediation
+        let mut metadata = HashMap::new();
+        if let Some(ref amzniid) = slot.amzniid {
+            metadata.insert("amzniid".to_string(), json!(amzniid));
+        }
+        if let Some(ref amznbid) = slot.amznbid {
+            metadata.insert("amznbid".to_string(), json!(amznbid));
+        }
+        if let Some(ref amznp) = slot.amznp {
+            metadata.insert("amznp".to_string(), json!(amznp));
+        }
+        if let Some(ref amznsz) = slot.amznsz {
+            metadata.insert("amznsz".to_string(), json!(amznsz));
+        }
+        if let Some(ref amznactt) = slot.amznactt {
+            metadata.insert("amznactt".to_string(), json!(amznactt));
+        }
+
+        // APS doesn't return creative HTML - only targeting keys
+        // The creative will be generated by the mediation layer
+        // Price is None - will be decoded by mediation layer from amznbid metadata
+        Ok(Bid {
+            slot_id: slot.slot_id.clone(),
+            price: None, // Encoded price in metadata, decoded by mediation
+            currency: "USD".to_string(),
+            creative: None,
+            adomain: None, // APS doesn't provide adomain in response
+            bidder: "amazon-aps".to_string(),
+            width,
+            height,
+            nurl: None, // Real APS uses client-side event tracking
+            burl: None,
+            metadata,
+        })
+    }
+
+    /// Parse APS TAM response into unified AuctionResponse.
+    fn parse_aps_response(&self, json: &Json, response_time_ms: u64) -> AuctionResponse {
+        let mut bids = Vec::new();
+
+        // Try to parse as ApsBidResponse with contextual wrapper
+        if let Ok(aps_response) = serde_json::from_value::<ApsBidResponse>(json.clone()) {
+            log::debug!(
+                "APS: parsed contextual response with {} slots",
+                aps_response.contextual.slots.len()
+            );
+
+            for slot in aps_response.contextual.slots {
+                match self.parse_aps_slot(slot) {
+                    Ok(bid) => {
+                        let encoded_price = bid
+                            .metadata
+                            .get("amznbid")
+                            .and_then(|v| v.as_str())
+                            .unwrap_or("unknown");
+                        log::debug!(
+                            "APS: parsed bid for slot '{}' with encoded price (to be decoded by mediation)",
+                            bid.slot_id,
+                        );
+                        log::trace!(
+                            "APS: slot '{}' encoded price: {}",
+                            bid.slot_id,
+                            encoded_price
+                        );
+                        bids.push(bid);
+                    }
+                    Err(_) => {
+                        log::debug!("APS: skipped slot (no fill or invalid)");
+                    }
+                }
+            }
+        } else {
+            log::warn!("APS: failed to parse response as contextual format");
+        }
+
+        if bids.is_empty() {
+            AuctionResponse::no_bid("aps", response_time_ms)
+        } else {
+            AuctionResponse::success("aps", bids, response_time_ms)
+        }
+    }
+}
+
+impl AuctionProvider for ApsAuctionProvider {
+    fn provider_name(&self) -> &'static str {
+        "aps"
+    }
+
+    fn request_bids(
+        &self,
+        request: &AuctionRequest,
+        _context: &AuctionContext<'_>,
+    ) -> Result<fastly::http::request::PendingRequest, Report<TrustedServerError>> {
+        log::info!(
+            "APS: requesting bids for {} slots (pub_id: {})",
+            request.slots.len(),
+            self.config.pub_id
+        );
+
+        // Transform to APS format
+        let aps_request = self.to_aps_request(request);
+
+        // Serialize to JSON
+        let aps_json =
+            serde_json::to_value(&aps_request).change_context(TrustedServerError::Auction {
+                message: "Failed to serialize APS bid request".to_string(),
+            })?;
+
+        log::debug!("APS: sending bid request: {:?}", aps_json);
+
+        // Create HTTP POST request
+        let mut aps_req = Request::new(Method::POST, &self.config.endpoint);
+
+        aps_req
+            .set_body_json(&aps_json)
+            .change_context(TrustedServerError::Auction {
+                message: "Failed to set APS request body".to_string(),
+            })?;
+
+        // Send request asynchronously
+        let backend_name = ensure_backend_from_url(&self.config.endpoint).change_context(
+            TrustedServerError::Auction {
+                message: format!(
+                    "Failed to resolve backend for APS endpoint: {}",
+                    self.config.endpoint
+                ),
+            },
+        )?;
+
+        let pending =
+            aps_req
+                .send_async(backend_name)
+                .change_context(TrustedServerError::Auction {
+                    message: "Failed to send async request to APS".to_string(),
+                })?;
+
+        Ok(pending)
+    }
+
+    fn parse_response(
+        &self,
+        mut response: fastly::Response,
+        response_time_ms: u64,
+    ) -> Result<AuctionResponse, Report<TrustedServerError>> {
+        // Check status code
+        if !response.get_status().is_success() {
+            log::warn!("APS returned non-success status: {}", response.get_status());
+            return Ok(AuctionResponse::error("aps", response_time_ms));
+        }
+
+        // Parse response body
+        let body_bytes = response.take_body_bytes();
+        let response_json: Json =
+            serde_json::from_slice(&body_bytes).change_context(TrustedServerError::Auction {
+                message: "Failed to parse APS response JSON".to_string(),
+            })?;
+
+        log::debug!("APS: received response: {:?}", response_json);
+
+        // Transform to unified format
+        let auction_response = self.parse_aps_response(&response_json, response_time_ms);
+
+        log::info!(
+            "APS returned {} bids in {}ms",
+            auction_response.bids.len(),
+            response_time_ms
+        );
+
+        Ok(auction_response)
+    }
+
+    fn supports_media_type(&self, media_type: &MediaType) -> bool {
+        // APS supports banner and video formats
+        matches!(media_type, MediaType::Banner | MediaType::Video)
+    }
+
+    fn timeout_ms(&self) -> u32 {
+        self.config.timeout_ms
+    }
+
+    fn is_enabled(&self) -> bool {
+        self.config.enabled
+    }
+
+    fn backend_name(&self) -> Option<String> {
+        ensure_backend_from_url(&self.config.endpoint).ok()
+    }
+}
+
+// ============================================================================
+// Provider Auto-Registration
+// ============================================================================
+
+use crate::settings::Settings;
+use std::sync::Arc;
+
+/// Auto-register APS provider based on settings configuration.
+///
+/// Returns the APS provider if enabled in settings.
+pub fn register_providers(settings: &Settings) -> Vec<Arc<dyn AuctionProvider>> {
+    let mut providers: Vec<Arc<dyn AuctionProvider>> = Vec::new();
+
+    // Check for real APS provider configuration
+    match settings.integration_config::<ApsConfig>("aps") {
+        Ok(Some(config)) => {
+            log::info!(
+                "Registering real APS provider (pub_id: {}, endpoint: {})",
+                config.pub_id,
+                config.endpoint
+            );
+            providers.push(Arc::new(ApsAuctionProvider::new(config)));
+        }
+        Ok(None) => {
+            log::debug!("APS integration config found but is disabled");
+        }
+        Err(e) => {
+            log::error!("Failed to load APS configuration: {:?}", e);
+        }
+    }
+
+    providers
+}
+
+// ============================================================================
+// Tests
+// ============================================================================
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::auction::types::*;
+
+    fn create_test_auction_request() -> AuctionRequest {
+        AuctionRequest {
+            id: "test-auction-123".to_string(),
+            slots: vec![
+                AdSlot {
+                    id: "header-banner".to_string(),
+                    formats: vec![
+                        AdFormat {
+                            media_type: MediaType::Banner,
+                            width: 728,
+                            height: 90,
+                        },
+                        AdFormat {
+                            media_type: MediaType::Banner,
+                            width: 970,
+                            height: 250,
+                        },
+                    ],
+                    floor_price: Some(1.50),
+                    targeting: HashMap::new(),
+                },
+                AdSlot {
+                    id: "sidebar".to_string(),
+                    formats: vec![AdFormat {
+                        media_type: MediaType::Banner,
+                        width: 300,
+                        height: 250,
+                    }],
+                    floor_price: Some(1.00),
+                    targeting: HashMap::new(),
+                },
+            ],
+            publisher: PublisherInfo {
+                domain: "test.com".to_string(),
+                page_url: Some("https://test.com/article".to_string()),
+            },
+            user: UserInfo {
+                id: "user-123".to_string(),
+                fresh_id: "fresh-456".to_string(),
+                consent: None,
+            },
+            device: Some(DeviceInfo {
+                user_agent: Some("Mozilla/5.0".to_string()),
+                ip: Some("192.168.1.1".to_string()),
+                geo: None,
+            }),
+            site: None,
+            context: HashMap::new(),
+        }
+    }
+
+    #[test]
+    fn test_aps_request_transformation() {
+        let config = ApsConfig {
+            enabled: true,
+            pub_id: "5128".to_string(),
+            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
+            timeout_ms: 800,
+        };
+
+        let provider = ApsAuctionProvider::new(config);
+        let auction_request = create_test_auction_request();
+        let aps_request = provider.to_aps_request(&auction_request);
+
+        // Verify basic fields
+        assert_eq!(aps_request.pub_id, "5128");
+        assert_eq!(aps_request.slots.len(), 2);
+        assert_eq!(
+            aps_request.page_url,
+            Some("https://test.com/article".to_string())
+        );
+        assert_eq!(aps_request.user_agent, Some("Mozilla/5.0".to_string()));
+        assert_eq!(aps_request.timeout, Some(800));
+
+        // Verify first slot
+        let slot1 = &aps_request.slots[0];
+        assert_eq!(slot1.slot_id, "header-banner");
+        assert_eq!(slot1.sizes.len(), 2);
+        assert_eq!(slot1.sizes[0], [728, 90]);
+        assert_eq!(slot1.sizes[1], [970, 250]);
+
+        // Verify second slot
+        let slot2 = &aps_request.slots[1];
+        assert_eq!(slot2.slot_id, "sidebar");
+        assert_eq!(slot2.sizes.len(), 1);
+        assert_eq!(slot2.sizes[0], [300, 250]);
+    }
+
+    #[test]
+    fn test_aps_response_parsing_success() {
+        let config = ApsConfig {
+            enabled: true,
+            pub_id: "5128".to_string(),
+            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
+            timeout_ms: 800,
+        };
+
+        let provider = ApsAuctionProvider::new(config);
+
+        // Test APS response in real contextual format
+        let aps_response = json!({
+            "contextual": {
+                "slots": [
+                    {
+                        "slotID": "header-banner",
+                        "size": "728x90",
+                        "crid": "test-crid-123",
+                        "mediaType": "d",
+                        "fif": "1",
+                        "targeting": ["amzniid", "amznbid", "amznp", "amznsz", "amznactt"],
+                        "meta": ["slotID", "mediaType", "size"],
+                        "amzniid": "test-impression-id",
+                        "amznbid": "1kt0jk0",  // Proprietary Amazon encoding (not decodable)
+                        "amznp": "1kt0jk0",
+                        "amznsz": "728x90",
+                        "amznactt": "OPEN"
+                    },
+                    {
+                        "slotID": "sidebar",
+                        "size": "300x250",
+                        "crid": "test-crid-456",
+                        "mediaType": "d",
+                        "fif": "1",
+                        "targeting": ["amzniid", "amznbid", "amznp", "amznsz", "amznactt"],
+                        "meta": ["slotID", "mediaType", "size"],
+                        "amzniid": "test-impression-id-2",
+                        "amznbid": "ewpurk",  // Proprietary Amazon encoding (not decodable)
+                        "amznp": "ewpurk",
+                        "amznsz": "300x250",
+                        "amznactt": "OPEN"
+                    }
+                ],
+                "host": "https://aax-events.amazon-adsystem.com",
+                "status": "ok",
+                "cfe": true,
+                "ev": true,
+                "cb": "6"
+            }
+        });
+
+        let auction_response = provider.parse_aps_response(&aps_response, 150);
+
+        // Verify response
+        assert_eq!(auction_response.provider, "aps");
+        assert_eq!(auction_response.status, BidStatus::Success);
+        assert_eq!(auction_response.bids.len(), 2);
+        assert_eq!(auction_response.response_time_ms, 150);
+
+        // Verify first bid - price is None (encoded, to be decoded by mediation)
+        let bid1 = &auction_response.bids[0];
+        assert_eq!(bid1.slot_id, "header-banner");
+        assert_eq!(bid1.price, None); // Price is NOT decoded - it's in metadata for mediation
+        assert_eq!(bid1.width, 728);
+        assert_eq!(bid1.height, 90);
+        assert_eq!(bid1.currency, "USD");
+        assert_eq!(bid1.bidder, "amazon-aps");
+        assert_eq!(bid1.adomain, None);
+        assert!(bid1.metadata.contains_key("amzniid"));
+        assert!(bid1.metadata.contains_key("amznbid")); // Encoded price stored here
+
+        // Verify second bid
+        let bid2 = &auction_response.bids[1];
+        assert_eq!(bid2.slot_id, "sidebar");
+        assert_eq!(bid2.price, None); // Price is NOT decoded
+        assert_eq!(bid2.width, 300);
+        assert_eq!(bid2.height, 250);
+        assert!(bid2.metadata.contains_key("amznbid")); // Encoded price in metadata
+    }
+
+    #[test]
+    fn test_aps_response_parsing_no_bid() {
+        let config = ApsConfig {
+            enabled: true,
+            pub_id: "5128".to_string(),
+            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
+            timeout_ms: 800,
+        };
+
+        let provider = ApsAuctionProvider::new(config);
+
+        // Empty contextual response
+        let aps_response = json!({
+            "contextual": {
+                "slots": [],
+                "status": "ok"
+            }
+        });
+
+        let auction_response = provider.parse_aps_response(&aps_response, 100);
+
+        assert_eq!(auction_response.provider, "aps");
+        assert_eq!(auction_response.status, BidStatus::NoBid);
+        assert_eq!(auction_response.bids.len(), 0);
+    }
+
+    #[test]
+    fn test_aps_response_parsing_invalid_bids() {
+        let config = ApsConfig {
+            enabled: true,
+            pub_id: "5128".to_string(),
+            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
+            timeout_ms: 800,
+        };
+
+        let provider = ApsAuctionProvider::new(config);
+
+        // Response with invalid slots (not filled, zero price)
+        let aps_response = json!({
+            "contextual": {
+                "slots": [
+                    {
+                        "slotID": "header-banner",
+                        "size": "728x90",
+                        "fif": "0",  // Not filled
+                        "targeting": [],
+                        "meta": []
+                    },
+                    {
+                        "slotID": "sidebar",
+                        "size": "300x250",
+                        "fif": "1",
+                        "targeting": [],
+                        "meta": []
+                        // Missing price encoding - will decode to 0.0
+                    }
+                ],
+                "status": "ok"
+            }
+        });
+
+        let auction_response = provider.parse_aps_response(&aps_response, 100);
+
+        // Should return no-bid since all slots are invalid
+        assert_eq!(auction_response.status, BidStatus::NoBid);
+        assert_eq!(auction_response.bids.len(), 0);
+    }
+
+    #[test]
+    fn test_aps_slot_parsing() {
+        let config = ApsConfig {
+            enabled: true,
+            pub_id: "5128".to_string(),
+            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
+            timeout_ms: 800,
+        };
+
+        let provider = ApsAuctionProvider::new(config);
+
+        let aps_slot = ApsSlotResponse {
+            slot_id: "test-slot".to_string(),
+            size: "728x90".to_string(),
+            crid: Some("crid-123".to_string()),
+            media_type: Some("d".to_string()),
+            fif: Some("1".to_string()),
+            targeting: vec!["amzniid".to_string(), "amznbid".to_string()],
+            meta: vec!["slotID".to_string()],
+            amzniid: Some("impression-id-123".to_string()),
+            amznbid: Some("1c7d4ow".to_string()), // Encoded price (to be decoded by mediation)
+            amznp: Some("1c7d4ow".to_string()),
+            amznsz: Some("728x90".to_string()),
+            amznactt: Some("OPEN".to_string()),
+        };
+
+        let bid = provider
+            .parse_aps_slot(aps_slot)
+            .expect("should parse slot");
+
+        assert_eq!(bid.slot_id, "test-slot");
+        assert_eq!(bid.price, None); // Price NOT decoded - stored in metadata for mediation
+        assert_eq!(bid.width, 728);
+        assert_eq!(bid.height, 90);
+        assert_eq!(bid.currency, "USD");
+        assert_eq!(bid.bidder, "amazon-aps");
+        assert_eq!(bid.adomain, None);
+        assert_eq!(bid.nurl, None); // Real APS uses client-side tracking
+        assert_eq!(bid.burl, None);
+        assert!(bid.metadata.contains_key("amzniid"));
+        assert!(bid.metadata.contains_key("amznbid")); // Encoded price here
+        assert!(bid.metadata.contains_key("amznsz"));
+    }
+
+    #[test]
+    fn test_provider_metadata() {
+        let config = ApsConfig::default();
+        let provider = ApsAuctionProvider::new(config);
+
+        assert_eq!(provider.provider_name(), "aps");
+        assert!(!provider.is_enabled()); // Default is disabled
+        assert_eq!(provider.timeout_ms(), 800);
+        assert!(provider.supports_media_type(&MediaType::Banner));
+        assert!(provider.supports_media_type(&MediaType::Video));
+        assert!(!provider.supports_media_type(&MediaType::Native));
+    }
+
+    #[test]
+    fn test_aps_bids_have_no_creative_and_no_decoded_price() {
+        // APS doesn't provide creative HTML - it only provides targeting keys
+        // APS doesn't decode prices - only mediation layer can decode them
+        // The creative will be generated by the mediation layer (e.g., GAM or ad server)
+        let config = ApsConfig {
+            enabled: true,
+            pub_id: "5128".to_string(),
+            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
+            timeout_ms: 800,
+        };
+
+        let provider = ApsAuctionProvider::new(config);
+
+        let aps_slot = ApsSlotResponse {
+            slot_id: "test-slot".to_string(),
+            size: "300x250".to_string(),
+            crid: Some("test-creative".to_string()),
+            media_type: Some("d".to_string()),
+            fif: Some("1".to_string()),
+            targeting: vec!["amzniid".to_string(), "amznbid".to_string()],
+            meta: vec!["slotID".to_string()],
+            amzniid: Some("imp-123".to_string()),
+            amznbid: Some("encoded-price".to_string()),
+            amznp: Some("encoded-price-alt".to_string()),
+            amznsz: Some("300x250".to_string()),
+            amznactt: Some("OPEN".to_string()),
+        };
+
+        let bid = provider.parse_aps_slot(aps_slot).expect("should parse");
+
+        // Key assertions:
+        // 1. creative should be None for APS bids
+        assert_eq!(bid.creative, None, "APS bids should not have creative HTML");
+        // 2. price should be None (encoded price in metadata, decoded by mediation)
+        assert_eq!(bid.price, None, "APS bids should not have decoded price");
+
+        // Verify targeting keys are in metadata (includes encoded price)
+        assert!(bid.metadata.contains_key("amzniid"));
+        assert!(bid.metadata.contains_key("amznbid")); // Encoded price
+        assert_eq!(
+            bid.metadata.get("amzniid").and_then(|v| v.as_str()),
+            Some("imp-123")
+        );
+        assert_eq!(
+            bid.metadata.get("amznbid").and_then(|v| v.as_str()),
+            Some("encoded-price")
+        );
+    }
+}
diff --git a/crates/common/src/integrations/mod.rs b/crates/common/src/integrations/mod.rs
index 076d5cb..af1b5ea 100644
--- a/crates/common/src/integrations/mod.rs
+++ b/crates/common/src/integrations/mod.rs
@@ -2,6 +2,8 @@
 
 use crate::settings::Settings;
 
+pub mod adserver_mock;
+pub mod aps;
 pub mod didomi;
 pub mod lockr;
 pub mod nextjs;
diff --git a/crates/common/src/integrations/prebid.rs b/crates/common/src/integrations/prebid.rs
index 51b1b9f..2274770 100644
--- a/crates/common/src/integrations/prebid.rs
+++ b/crates/common/src/integrations/prebid.rs
@@ -8,12 +8,14 @@ use fastly::http::{header, Method, StatusCode};
 use fastly::{Request, Response};
 use serde::{Deserialize, Serialize};
 use serde_json::{json, Value as Json, Value as JsonValue};
-use url::Url;
 use validator::Validate;
 
+use crate::auction::provider::AuctionProvider;
+use crate::auction::types::{
+    AuctionContext, AuctionRequest, AuctionResponse, Bid as AuctionBid, MediaType,
+};
 use crate::backend::ensure_backend_from_url;
 use crate::constants::{HEADER_SYNTHETIC_FRESH, HEADER_SYNTHETIC_TRUSTED_SERVER};
-use crate::creative;
 use crate::error::TrustedServerError;
 use crate::geo::GeoInfo;
 use crate::integrations::{
@@ -26,8 +28,6 @@ use crate::settings::{IntegrationConfig, Settings};
 use crate::synthetic::{generate_synthetic_id, get_or_generate_synthetic_id};
 
 const PREBID_INTEGRATION_ID: &str = "prebid";
-const ROUTE_FIRST_PARTY_AD: &str = "/first-party/ad";
-const ROUTE_THIRD_PARTY_AD: &str = "/third-party/ad";
 
 #[derive(Debug, Clone, Deserialize, Serialize, Validate)]
 pub struct PrebidIntegrationConfig {
@@ -71,37 +71,39 @@ fn default_enabled() -> bool {
     true
 }
 
+#[allow(dead_code)]
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct BannerUnit {
     sizes: Vec<Vec<u32>>,
 }
 
+#[allow(dead_code)]
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct MediaTypes {
-    #[allow(dead_code)]
     banner: Option<BannerUnit>,
 }
 
+#[allow(dead_code)]
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct AdUnit {
     code: String,
-    #[allow(dead_code)]
     media_types: Option<MediaTypes>,
     #[serde(default)]
     bids: Option<Vec<Bid>>,
 }
 
+#[allow(dead_code)]
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct AdRequest {
     ad_units: Vec<AdUnit>,
-    #[allow(dead_code)]
     config: Option<JsonValue>,
 }
 
+#[allow(dead_code)]
 #[derive(Debug, Deserialize)]
 struct Bid {
     bidder: String,
@@ -125,42 +127,6 @@ impl PrebidIntegration {
         }
     }
 
-    async fn handle_third_party_ad(
-        &self,
-        settings: &Settings,
-        mut req: Request,
-    ) -> Result<Response, Report<TrustedServerError>> {
-        let body: AdRequest = serde_json::from_slice(&req.take_body_bytes()).change_context(
-            TrustedServerError::Prebid {
-                message: "Failed to parse tsjs auction request".to_string(),
-            },
-        )?;
-
-        log::info!("/third-party/ad: received {} adUnits", body.ad_units.len());
-        for unit in &body.ad_units {
-            if let Some(mt) = &unit.media_types {
-                if let Some(banner) = &mt.banner {
-                    log::debug!("unit={} sizes={:?}", unit.code, banner.sizes);
-                }
-            }
-        }
-
-        let openrtb = build_openrtb_from_ts(&body, settings, &self.config);
-        if let Ok(preview) = serde_json::to_string(&openrtb) {
-            log::debug!(
-                "OpenRTB payload (truncated): {}",
-                &preview.chars().take(512).collect::<String>()
-            );
-        }
-
-        req.set_body_json(&openrtb)
-            .change_context(TrustedServerError::Prebid {
-                message: "Failed to set OpenRTB body".to_string(),
-            })?;
-
-        handle_prebid_auction(settings, req, &self.config).await
-    }
-
     fn handle_script_handler(&self) -> Result<Response, Report<TrustedServerError>> {
         let body = "// Script overridden by Trusted Server\n";
 
@@ -172,69 +138,6 @@ impl PrebidIntegration {
             .with_header(header::CACHE_CONTROL, "public, max-age=31536000, immutable")
             .with_body(body))
     }
-
-    async fn handle_first_party_ad(
-        &self,
-        settings: &Settings,
-        mut req: Request,
-    ) -> Result<Response, Report<TrustedServerError>> {
-        let url = req.get_url_str();
-        let parsed = Url::parse(url).change_context(TrustedServerError::Prebid {
-            message: "Invalid first-party serve-ad URL".to_string(),
-        })?;
-        let qp = parsed
-            .query_pairs()
-            .into_owned()
-            .collect::<std::collections::HashMap<_, _>>();
-        let slot = qp.get("slot").cloned().unwrap_or_default();
-        let w = qp
-            .get("w")
-            .and_then(|s| s.parse::<u32>().ok())
-            .unwrap_or(300);
-        let h = qp
-            .get("h")
-            .and_then(|s| s.parse::<u32>().ok())
-            .unwrap_or(250);
-        if slot.is_empty() {
-            return Err(Report::new(TrustedServerError::BadRequest {
-                message: "missing slot".to_string(),
-            }));
-        }
-
-        let ad_req = AdRequest {
-            ad_units: vec![AdUnit {
-                code: slot.clone(),
-                media_types: Some(MediaTypes {
-                    banner: Some(BannerUnit {
-                        sizes: vec![vec![w, h]],
-                    }),
-                }),
-                bids: None,
-            }],
-            config: None,
-        };
-
-        let ortb = build_openrtb_from_ts(&ad_req, settings, &self.config);
-        req.set_body_json(&ortb)
-            .change_context(TrustedServerError::Prebid {
-                message: "Failed to set OpenRTB body".to_string(),
-            })?;
-
-        let mut pbs_resp = pbs_auction_for_get(settings, req, &self.config).await?;
-
-        let body_bytes = pbs_resp.take_body_bytes();
-        let html = match serde_json::from_slice::<Json>(&body_bytes) {
-            Ok(json) => extract_adm_for_slot(&json, &slot)
-                .unwrap_or_else(|| "<!-- no creative -->".to_string()),
-            Err(_) => String::from_utf8(body_bytes).unwrap_or_else(|_| "".to_string()),
-        };
-
-        let rewritten = creative::rewrite_creative_html(&html, settings);
-
-        Ok(Response::from_status(StatusCode::OK)
-            .with_header(header::CONTENT_TYPE, "text/html; charset=utf-8")
-            .with_body(rewritten))
-    }
 }
 
 fn build(settings: &Settings) -> Option<Arc<PrebidIntegration>> {
@@ -269,16 +172,10 @@ impl IntegrationProxy for PrebidIntegration {
     }
 
     fn routes(&self) -> Vec<IntegrationEndpoint> {
-        let mut routes = vec![
-            IntegrationEndpoint::get(ROUTE_FIRST_PARTY_AD),
-            IntegrationEndpoint::post(ROUTE_THIRD_PARTY_AD),
-        ];
+        let mut routes = vec![];
 
         if let Some(script_path) = &self.config.script_handler {
-            // We need to leak the string to get a 'static str for IntegrationEndpoint
-            // This is safe because the config lives for the lifetime of the application
-            let static_path: &'static str = Box::leak(script_path.clone().into_boxed_str());
-            routes.push(IntegrationEndpoint::get(static_path));
+            routes.push(IntegrationEndpoint::get(script_path.clone()));
         }
 
         routes
@@ -286,7 +183,7 @@ impl IntegrationProxy for PrebidIntegration {
 
     async fn handle(
         &self,
-        settings: &Settings,
+        _settings: &Settings,
         req: Request,
     ) -> Result<Response, Report<TrustedServerError>> {
         let path = req.get_path().to_string();
@@ -296,12 +193,6 @@ impl IntegrationProxy for PrebidIntegration {
             Method::GET if self.config.script_handler.as_ref() == Some(&path) => {
                 self.handle_script_handler()
             }
-            Method::GET if path == ROUTE_FIRST_PARTY_AD => {
-                self.handle_first_party_ad(settings, req).await
-            }
-            Method::POST if path == ROUTE_THIRD_PARTY_AD => {
-                self.handle_third_party_ad(settings, req).await
-            }
             _ => Err(Report::new(Self::error(format!(
                 "Unsupported Prebid route: {path}"
             )))),
@@ -332,6 +223,7 @@ impl IntegrationAttributeRewriter for PrebidIntegration {
     }
 }
 
+#[allow(dead_code)]
 fn build_openrtb_from_ts(
     req: &AdRequest,
     settings: &Settings,
@@ -398,40 +290,7 @@ fn is_prebid_script_url(url: &str) -> bool {
     )
 }
 
-async fn pbs_auction_for_get(
-    settings: &Settings,
-    req: Request,
-    config: &PrebidIntegrationConfig,
-) -> Result<Response, Report<TrustedServerError>> {
-    handle_prebid_auction(settings, req, config).await
-}
-
-fn extract_adm_for_slot(json: &Json, slot: &str) -> Option<String> {
-    let seatbids = json.get("seatbid")?.as_array()?;
-    for sb in seatbids {
-        if let Some(bids) = sb.get("bid").and_then(|b| b.as_array()) {
-            for bid in bids {
-                let impid = bid.get("impid").and_then(|v| v.as_str()).unwrap_or("");
-                if impid == slot {
-                    if let Some(adm) = bid.get("adm").and_then(|v| v.as_str()) {
-                        return Some(adm.to_string());
-                    }
-                }
-            }
-        }
-    }
-    for sb in seatbids {
-        if let Some(bids) = sb.get("bid").and_then(|b| b.as_array()) {
-            for bid in bids {
-                if let Some(adm) = bid.get("adm").and_then(|v| v.as_str()) {
-                    return Some(adm.to_string());
-                }
-            }
-        }
-    }
-    None
-}
-
+#[allow(dead_code)]
 async fn handle_prebid_auction(
     settings: &Settings,
     mut req: Request,
@@ -511,6 +370,7 @@ async fn handle_prebid_auction(
     }
 }
 
+#[allow(dead_code)]
 fn enhance_openrtb_request(
     request: &mut Json,
     synthetic_id: &str,
@@ -699,6 +559,339 @@ fn get_request_scheme(req: &Request) -> String {
     "https".to_string()
 }
 
+// ============================================================================
+// Prebid Auction Provider
+// ============================================================================
+
+/// Prebid Server auction provider.
+pub struct PrebidAuctionProvider {
+    config: PrebidIntegrationConfig,
+}
+
+impl PrebidAuctionProvider {
+    /// Create a new Prebid auction provider.
+    pub fn new(config: PrebidIntegrationConfig) -> Self {
+        Self { config }
+    }
+
+    /// Convert auction request to OpenRTB format.
+    fn to_openrtb(&self, request: &AuctionRequest) -> OpenRtbRequest {
+        let imps: Vec<Imp> = request
+            .slots
+            .iter()
+            .map(|slot| {
+                let formats: Vec<Format> = slot
+                    .formats
+                    .iter()
+                    .filter(|f| f.media_type == MediaType::Banner)
+                    .map(|f| Format {
+                        w: f.width,
+                        h: f.height,
+                    })
+                    .collect();
+
+                let mut bidder = std::collections::HashMap::new();
+                for bidder_name in &self.config.bidders {
+                    bidder.insert(bidder_name.clone(), Json::Object(serde_json::Map::new()));
+                }
+
+                Imp {
+                    id: slot.id.clone(),
+                    banner: Some(Banner { format: formats }),
+                    ext: Some(ImpExt {
+                        prebid: PrebidImpExt { bidder },
+                    }),
+                }
+            })
+            .collect();
+
+        OpenRtbRequest {
+            id: request.id.clone(),
+            imp: imps,
+            site: Some(Site {
+                domain: Some(request.publisher.domain.clone()),
+                page: request.publisher.page_url.clone(),
+            }),
+        }
+    }
+
+    /// Parse OpenRTB response into auction response.
+    fn parse_openrtb_response(&self, json: &Json, response_time_ms: u64) -> AuctionResponse {
+        let mut bids = Vec::new();
+
+        if let Some(seatbids) = json.get("seatbid").and_then(|v| v.as_array()) {
+            for seatbid in seatbids {
+                let seat = seatbid
+                    .get("seat")
+                    .and_then(|v| v.as_str())
+                    .unwrap_or("unknown");
+
+                if let Some(bid_array) = seatbid.get("bid").and_then(|v| v.as_array()) {
+                    for bid_obj in bid_array {
+                        if let Ok(bid) = self.parse_bid(bid_obj, seat) {
+                            bids.push(bid);
+                        }
+                    }
+                }
+            }
+        }
+
+        if bids.is_empty() {
+            AuctionResponse::no_bid("prebid", response_time_ms)
+        } else {
+            AuctionResponse::success("prebid", bids, response_time_ms)
+        }
+    }
+
+    /// Parse a single bid from OpenRTB response.
+    fn parse_bid(&self, bid_obj: &Json, seat: &str) -> Result<AuctionBid, ()> {
+        let slot_id = bid_obj
+            .get("impid")
+            .and_then(|v| v.as_str())
+            .ok_or(())?
+            .to_string();
+
+        let price = bid_obj.get("price").and_then(|v| v.as_f64()).ok_or(())?;
+
+        let creative = bid_obj
+            .get("adm")
+            .and_then(|v| v.as_str())
+            .map(|s| s.to_string());
+
+        let width = bid_obj.get("w").and_then(|v| v.as_u64()).unwrap_or(300) as u32;
+        let height = bid_obj.get("h").and_then(|v| v.as_u64()).unwrap_or(250) as u32;
+
+        let nurl = bid_obj
+            .get("nurl")
+            .and_then(|v| v.as_str())
+            .map(|s| s.to_string());
+
+        let burl = bid_obj
+            .get("burl")
+            .and_then(|v| v.as_str())
+            .map(|s| s.to_string());
+
+        let adomain = bid_obj
+            .get("adomain")
+            .and_then(|v| v.as_array())
+            .map(|arr| {
+                arr.iter()
+                    .filter_map(|v| v.as_str().map(|s| s.to_string()))
+                    .collect()
+            });
+
+        Ok(AuctionBid {
+            slot_id,
+            price: Some(price), // Prebid provides decoded prices
+            currency: "USD".to_string(),
+            creative,
+            adomain,
+            bidder: seat.to_string(),
+            width,
+            height,
+            nurl,
+            burl,
+            metadata: std::collections::HashMap::new(),
+        })
+    }
+}
+
+impl AuctionProvider for PrebidAuctionProvider {
+    fn provider_name(&self) -> &'static str {
+        "prebid"
+    }
+
+    fn request_bids(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+    ) -> Result<fastly::http::request::PendingRequest, Report<TrustedServerError>> {
+        log::info!("Prebid: requesting bids for {} slots", request.slots.len());
+
+        // Convert to OpenRTB
+        let openrtb = self.to_openrtb(request);
+        let mut openrtb_json =
+            serde_json::to_value(&openrtb).change_context(TrustedServerError::Prebid {
+                message: "Failed to serialize OpenRTB request".to_string(),
+            })?;
+
+        // Enhance with user info
+        if !openrtb_json["user"].is_object() {
+            openrtb_json["user"] = json!({});
+        }
+        openrtb_json["user"]["id"] = json!(&request.user.id);
+        if !openrtb_json["user"]["ext"].is_object() {
+            openrtb_json["user"]["ext"] = json!({});
+        }
+        openrtb_json["user"]["ext"]["synthetic_fresh"] = json!(&request.user.fresh_id);
+
+        // Add device info if available
+        if let Some(device) = &request.device {
+            if let Some(geo) = &device.geo {
+                let geo_obj = json!({
+                    "type": 2,
+                    "country": geo.country,
+                    "city": geo.city,
+                    "region": geo.region,
+                });
+                if !openrtb_json["device"].is_object() {
+                    openrtb_json["device"] = json!({});
+                }
+                openrtb_json["device"]["geo"] = geo_obj;
+            }
+        }
+
+        // Add privacy regulations based on Sec-GPC header
+        if context.request.get_header("Sec-GPC").is_some() {
+            if !openrtb_json["regs"].is_object() {
+                openrtb_json["regs"] = json!({});
+            }
+            if !openrtb_json["regs"]["ext"].is_object() {
+                openrtb_json["regs"]["ext"] = json!({});
+            }
+            openrtb_json["regs"]["ext"]["us_privacy"] = json!("1YYN");
+        }
+
+        if !openrtb_json["ext"].is_object() {
+            openrtb_json["ext"] = json!({});
+        }
+        if !openrtb_json["ext"]["trusted_server"].is_object() {
+            openrtb_json["ext"]["trusted_server"] = json!({});
+        }
+
+        let request_host = get_request_host(context.request);
+        let request_scheme = get_request_scheme(context.request);
+        openrtb_json["ext"]["trusted_server"]["request_host"] = json!(request_host);
+        openrtb_json["ext"]["trusted_server"]["request_scheme"] = json!(request_scheme);
+
+        // Add request signing if enabled
+        if let Some(request_signing_config) = &context.settings.request_signing {
+            if request_signing_config.enabled && openrtb_json["id"].is_string() {
+                let id = openrtb_json["id"]
+                    .as_str()
+                    .expect("should have string id when is_string checked");
+                let signer = RequestSigner::from_config()?;
+                let signature = signer.sign(id.as_bytes())?;
+
+                openrtb_json["ext"]["trusted_server"]["signature"] = json!(signature);
+                openrtb_json["ext"]["trusted_server"]["kid"] = json!(signer.kid);
+            }
+        }
+
+        // Create HTTP request
+        let mut pbs_req = Request::new(
+            Method::POST,
+            format!("{}/openrtb2/auction", self.config.server_url),
+        );
+        copy_request_headers(context.request, &mut pbs_req);
+
+        pbs_req
+            .set_body_json(&openrtb_json)
+            .change_context(TrustedServerError::Prebid {
+                message: "Failed to set request body".to_string(),
+            })?;
+
+        // Send request asynchronously
+        let backend_name = ensure_backend_from_url(&self.config.server_url)?;
+        let pending =
+            pbs_req
+                .send_async(backend_name)
+                .change_context(TrustedServerError::Prebid {
+                    message: "Failed to send async request to Prebid Server".to_string(),
+                })?;
+
+        Ok(pending)
+    }
+
+    fn parse_response(
+        &self,
+        mut response: fastly::Response,
+        response_time_ms: u64,
+    ) -> Result<AuctionResponse, Report<TrustedServerError>> {
+        // Parse response
+        if !response.get_status().is_success() {
+            log::warn!(
+                "Prebid returned non-success status: {}",
+                response.get_status()
+            );
+            return Ok(AuctionResponse::error("prebid", response_time_ms));
+        }
+
+        let body_bytes = response.take_body_bytes();
+        let mut response_json: Json =
+            serde_json::from_slice(&body_bytes).change_context(TrustedServerError::Prebid {
+                message: "Failed to parse Prebid response".to_string(),
+            })?;
+
+        let request_host = response_json
+            .get("ext")
+            .and_then(|ext| ext.get("trusted_server"))
+            .and_then(|trusted_server| trusted_server.get("request_host"))
+            .and_then(|value| value.as_str())
+            .unwrap_or("")
+            .to_string();
+        let request_scheme = response_json
+            .get("ext")
+            .and_then(|ext| ext.get("trusted_server"))
+            .and_then(|trusted_server| trusted_server.get("request_scheme"))
+            .and_then(|value| value.as_str())
+            .unwrap_or("https")
+            .to_string();
+
+        if request_host.is_empty() {
+            log::warn!("Prebid response missing request host; skipping URL rewrites");
+        } else {
+            transform_prebid_response(&mut response_json, &request_host, &request_scheme)?;
+        }
+
+        let auction_response = self.parse_openrtb_response(&response_json, response_time_ms);
+
+        log::info!(
+            "Prebid returned {} bids in {}ms",
+            auction_response.bids.len(),
+            response_time_ms
+        );
+
+        Ok(auction_response)
+    }
+
+    fn supports_media_type(&self, media_type: &MediaType) -> bool {
+        matches!(media_type, MediaType::Banner)
+    }
+
+    fn timeout_ms(&self) -> u32 {
+        self.config.timeout_ms
+    }
+
+    fn is_enabled(&self) -> bool {
+        self.config.enabled
+    }
+
+    fn backend_name(&self) -> Option<String> {
+        ensure_backend_from_url(&self.config.server_url).ok()
+    }
+}
+
+// ============================================================================
+// Provider Auto-Registration
+// ============================================================================
+
+/// Auto-register Prebid provider based on settings configuration.
+///
+/// This function checks the settings for Prebid configuration and returns
+/// the provider if enabled.
+pub fn register_auction_provider(settings: &Settings) -> Vec<Arc<dyn AuctionProvider>> {
+    let mut providers: Vec<Arc<dyn AuctionProvider>> = Vec::new();
+
+    // Prebid provider is always registered if integration is enabled
+    if let Ok(Some(config)) = settings.integration_config::<PrebidIntegrationConfig>("prebid") {
+        log::info!("Registering Prebid auction provider");
+        providers.push(Arc::new(PrebidAuctionProvider::new(config)));
+    }
+
+    providers
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -885,7 +1078,7 @@ mod tests {
 
         let synthetic_id = "synthetic-123";
         let fresh_id = "fresh-456";
-        let mut req = Request::new(Method::POST, "https://edge.example/third-party/ad");
+        let mut req = Request::new(Method::POST, "https://edge.example/auction");
         req.set_header("Sec-GPC", "1");
 
         enhance_openrtb_request(&mut request_json, synthetic_id, fresh_id, &settings, &req)
@@ -944,28 +1137,6 @@ mod tests {
         }
     }
 
-    #[test]
-    fn extract_adm_for_slot_prefers_exact_match() {
-        let response = json!({
-            "seatbid": [{
-                "bid": [
-                    { "impid": "slot-b", "adm": "<!-- slot B -->" },
-                    { "impid": "slot-a", "adm": "<!-- slot A -->" }
-                ]
-            }]
-        });
-
-        let adm = extract_adm_for_slot(&response, "slot-a").expect("adm should exist");
-        assert_eq!(adm, "<!-- slot A -->");
-
-        let fallback = extract_adm_for_slot(&response, "missing")
-            .expect("should fall back to first available adm");
-        assert!(
-            fallback == "<!-- slot B -->" || fallback == "<!-- slot A -->",
-            "fallback should return some creative"
-        );
-    }
-
     #[test]
     fn make_first_party_proxy_url_base64_encodes_target() {
         let url = "https://cdn.example/path?x=1";
@@ -1099,8 +1270,8 @@ server_url = "https://prebid.example"
 
         let routes = integration.routes();
 
-        // Should have 3 routes: first-party ad, third-party ad, and script handler
-        assert_eq!(routes.len(), 3);
+        // Should have 1 route: script handler
+        assert_eq!(routes.len(), 1);
 
         let has_script_route = routes
             .iter()
@@ -1115,7 +1286,7 @@ server_url = "https://prebid.example"
 
         let routes = integration.routes();
 
-        // Should only have 2 routes: first-party ad and third-party ad
-        assert_eq!(routes.len(), 2);
+        // Should have 0 routes when no script handler configured
+        assert_eq!(routes.len(), 0);
     }
 }
diff --git a/crates/common/src/integrations/registry.rs b/crates/common/src/integrations/registry.rs
index 819890d..a302bfb 100644
--- a/crates/common/src/integrations/registry.rs
+++ b/crates/common/src/integrations/registry.rs
@@ -170,52 +170,55 @@ impl IntegrationDocumentState {
 #[derive(Clone, Debug)]
 pub struct IntegrationEndpoint {
     pub method: Method,
-    pub path: &'static str,
+    pub path: String,
 }
 
 impl IntegrationEndpoint {
     #[must_use]
-    pub fn new(method: Method, path: &'static str) -> Self {
-        Self { method, path }
+    pub fn new(method: Method, path: impl Into<String>) -> Self {
+        Self {
+            method,
+            path: path.into(),
+        }
     }
 
     #[must_use]
-    pub fn get(path: &'static str) -> Self {
+    pub fn get(path: impl Into<String>) -> Self {
         Self {
             method: Method::GET,
-            path,
+            path: path.into(),
         }
     }
 
     #[must_use]
-    pub fn post(path: &'static str) -> Self {
+    pub fn post(path: impl Into<String>) -> Self {
         Self {
             method: Method::POST,
-            path,
+            path: path.into(),
         }
     }
 
     #[must_use]
-    pub fn put(path: &'static str) -> Self {
+    pub fn put(path: impl Into<String>) -> Self {
         Self {
             method: Method::PUT,
-            path,
+            path: path.into(),
         }
     }
 
     #[must_use]
-    pub fn delete(path: &'static str) -> Self {
+    pub fn delete(path: impl Into<String>) -> Self {
         Self {
             method: Method::DELETE,
-            path,
+            path: path.into(),
         }
     }
 
     #[must_use]
-    pub fn patch(path: &'static str) -> Self {
+    pub fn patch(path: impl Into<String>) -> Self {
         Self {
             method: Method::PATCH,
-            path,
+            path: path.into(),
         }
     }
 }
@@ -248,7 +251,7 @@ pub trait IntegrationProxy: Send + Sync {
     /// ```
     fn get(&self, path: &str) -> IntegrationEndpoint {
         let full_path = format!("/integrations/{}{}", self.integration_name(), path);
-        IntegrationEndpoint::get(Box::leak(full_path.into_boxed_str()))
+        IntegrationEndpoint::get(full_path)
     }
 
     /// Helper to create a namespaced POST endpoint.
@@ -260,7 +263,7 @@ pub trait IntegrationProxy: Send + Sync {
     /// ```
     fn post(&self, path: &str) -> IntegrationEndpoint {
         let full_path = format!("/integrations/{}{}", self.integration_name(), path);
-        IntegrationEndpoint::post(Box::leak(full_path.into_boxed_str()))
+        IntegrationEndpoint::post(full_path)
     }
 
     /// Helper to create a namespaced PUT endpoint.
@@ -272,7 +275,7 @@ pub trait IntegrationProxy: Send + Sync {
     /// ```
     fn put(&self, path: &str) -> IntegrationEndpoint {
         let full_path = format!("/integrations/{}{}", self.integration_name(), path);
-        IntegrationEndpoint::put(Box::leak(full_path.into_boxed_str()))
+        IntegrationEndpoint::put(full_path)
     }
 
     /// Helper to create a namespaced DELETE endpoint.
@@ -280,11 +283,11 @@ pub trait IntegrationProxy: Send + Sync {
     ///
     /// # Example
     /// ```ignore
-    /// self.delete("/users")  // becomes /integrations/my_integration/users
+    /// self.delete("/users/123")  // becomes /integrations/my_integration/users/123
     /// ```
     fn delete(&self, path: &str) -> IntegrationEndpoint {
         let full_path = format!("/integrations/{}{}", self.integration_name(), path);
-        IntegrationEndpoint::delete(Box::leak(full_path.into_boxed_str()))
+        IntegrationEndpoint::delete(full_path)
     }
 
     /// Helper to create a namespaced PATCH endpoint.
@@ -292,11 +295,11 @@ pub trait IntegrationProxy: Send + Sync {
     ///
     /// # Example
     /// ```ignore
-    /// self.patch("/users")  // becomes /integrations/my_integration/users
+    /// self.patch("/settings")  // becomes /integrations/my_integration/settings
     /// ```
     fn patch(&self, path: &str) -> IntegrationEndpoint {
         let full_path = format!("/integrations/{}{}", self.integration_name(), path);
-        IntegrationEndpoint::patch(Box::leak(full_path.into_boxed_str()))
+        IntegrationEndpoint::patch(full_path)
     }
 }
 
@@ -500,7 +503,7 @@ impl IntegrationRegistry {
                         let matchit_path = if route.path.ends_with("/*") {
                             format!("{}/{{*rest}}", route.path.strip_suffix("/*").unwrap())
                         } else {
-                            route.path.to_string()
+                            route.path.clone()
                         };
 
                         // Select appropriate router and insert
@@ -630,9 +633,10 @@ impl IntegrationRegistry {
             let entry = map
                 .entry(*integration_id)
                 .or_insert_with(|| IntegrationMetadata::new(integration_id));
-            entry
-                .routes
-                .push(IntegrationEndpoint::new(route.method.clone(), route.path));
+            entry.routes.push(IntegrationEndpoint::new(
+                route.method.clone(),
+                route.path.clone(),
+            ));
         }
 
         for rewriter in &self.inner.html_rewriters {
diff --git a/crates/common/src/lib.rs b/crates/common/src/lib.rs
index b9f5fd5..99289f5 100644
--- a/crates/common/src/lib.rs
+++ b/crates/common/src/lib.rs
@@ -21,6 +21,8 @@
 //! - [`test_support`]: Testing utilities and mocks
 //! - [`why`]: Debugging and introspection utilities
 
+pub mod auction;
+pub mod auction_config_types;
 pub mod auth;
 pub mod backend;
 pub mod constants;
diff --git a/crates/common/src/openrtb.rs b/crates/common/src/openrtb.rs
index c73f974..6881af8 100644
--- a/crates/common/src/openrtb.rs
+++ b/crates/common/src/openrtb.rs
@@ -1,6 +1,8 @@
 use serde::Serialize;
 use serde_json::Value;
 
+use crate::auction::types::OrchestratorExt;
+
 /// Minimal subset of OpenRTB 2.x bid request used by Trusted Server.
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "lowercase")]
@@ -49,3 +51,103 @@ pub struct ImpExt {
 pub struct PrebidImpExt {
     pub bidder: std::collections::HashMap<String, Value>,
 }
+
+/// Minimal subset of OpenRTB 2.x bid response used by Trusted Server.
+#[derive(Debug, Serialize)]
+pub struct OpenRtbResponse {
+    pub id: String,
+    pub seatbid: Vec<SeatBid>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub ext: Option<ResponseExt>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct SeatBid {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub seat: Option<String>,
+    pub bid: Vec<OpenRtbBid>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct OpenRtbBid {
+    pub id: String,
+    pub impid: String,
+    pub price: f64,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub adm: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub crid: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub w: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub h: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub adomain: Option<Vec<String>>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct ResponseExt {
+    pub orchestrator: OrchestratorExt,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{OpenRtbBid, OpenRtbResponse, ResponseExt, SeatBid};
+    use crate::auction::types::OrchestratorExt;
+
+    #[test]
+    fn openrtb_response_serializes_expected_fields() {
+        let response = OpenRtbResponse {
+            id: "auction-1".to_string(),
+            seatbid: vec![SeatBid {
+                seat: Some("bidder-a".to_string()),
+                bid: vec![OpenRtbBid {
+                    id: "bidder-a-slot-1".to_string(),
+                    impid: "slot-1".to_string(),
+                    price: 1.25,
+                    adm: Some("<div>Test Creative HTML</div>".to_string()),
+                    crid: Some("bidder-a-creative".to_string()),
+                    w: Some(300),
+                    h: Some(250),
+                    adomain: Some(vec!["example.com".to_string()]),
+                }],
+            }],
+            ext: Some(ResponseExt {
+                orchestrator: OrchestratorExt {
+                    strategy: "parallel_only".to_string(),
+                    providers: 2,
+                    total_bids: 3,
+                    time_ms: 12,
+                },
+            }),
+        };
+
+        let serialized = serde_json::to_value(&response).expect("should serialize");
+        let expected = serde_json::json!({
+            "id": "auction-1",
+            "seatbid": [{
+                "seat": "bidder-a",
+                "bid": [{
+                    "id": "bidder-a-slot-1",
+                    "impid": "slot-1",
+                    "price": 1.25,
+                    "adm": "<div>Test Creative HTML</div>",
+                    "crid": "bidder-a-creative",
+                    "w": 300,
+                    "h": 250,
+                    "adomain": ["example.com"]
+                }]
+            }],
+            "ext": {
+                "orchestrator": {
+                    "strategy": "parallel_only",
+                    "providers": 2,
+                    "total_bids": 3,
+                    "time_ms": 12
+                }
+            }
+        });
+
+        assert_eq!(serialized, expected);
+    }
+}
diff --git a/crates/common/src/proxy.rs b/crates/common/src/proxy.rs
index 64b72bc..3e782f5 100644
--- a/crates/common/src/proxy.rs
+++ b/crates/common/src/proxy.rs
@@ -149,7 +149,7 @@ fn finalize_proxied_response(
 
     if ct.contains("text/html") {
         // HTML: rewrite and serve as HTML (safe to read as string)
-        let body = beresp.take_body_str();
+        let body = beresp.take_body_str(); // TODO: don't panic!
         let rewritten = crate::creative::rewrite_creative_html(&body, settings);
         return rebuild_text_response(beresp, "text/html; charset=utf-8", rewritten);
     }
diff --git a/crates/common/src/settings.rs b/crates/common/src/settings.rs
index 4a41b1e..52a0837 100644
--- a/crates/common/src/settings.rs
+++ b/crates/common/src/settings.rs
@@ -11,12 +11,13 @@ use std::sync::OnceLock;
 use url::Url;
 use validator::{Validate, ValidationError};
 
+use crate::auction_config_types::AuctionConfig;
 use crate::error::TrustedServerError;
 
 pub const ENVIRONMENT_VARIABLE_PREFIX: &str = "TRUSTED_SERVER";
 pub const ENVIRONMENT_VARIABLE_SEPARATOR: &str = "__";
 
-#[derive(Debug, Default, Deserialize, Serialize, Validate)]
+#[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
 pub struct Publisher {
     pub domain: String,
     pub cookie_domain: String,
@@ -66,7 +67,7 @@ impl Publisher {
     }
 }
 
-#[derive(Debug, Default, Deserialize, Serialize)]
+#[derive(Debug, Default, Clone, Deserialize, Serialize)]
 pub struct IntegrationSettings {
     #[serde(flatten)]
     entries: HashMap<String, JsonValue>,
@@ -168,7 +169,7 @@ impl DerefMut for IntegrationSettings {
 }
 
 #[allow(unused)]
-#[derive(Debug, Default, Deserialize, Serialize, Validate)]
+#[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
 pub struct Synthetic {
     pub counter_store: String,
     pub opid_store: String,
@@ -187,7 +188,7 @@ impl Synthetic {
     }
 }
 
-#[derive(Debug, Default, Deserialize, Serialize, Validate)]
+#[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
 pub struct Rewrite {
     /// List of domains to exclude from rewriting. Supports wildcards (e.g., "*.example.com").
     /// URLs from these domains will not be proxied through first-party endpoints.
@@ -222,7 +223,7 @@ impl Rewrite {
     }
 }
 
-#[derive(Debug, Default, Deserialize, Serialize, Validate)]
+#[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
 pub struct Handler {
     #[validate(length(min = 1), custom(function = validate_path))]
     pub path: String,
@@ -247,7 +248,7 @@ impl Handler {
     }
 }
 
-#[derive(Debug, Default, Deserialize, Serialize)]
+#[derive(Debug, Default, Clone, Deserialize, Serialize)]
 pub struct RequestSigning {
     #[serde(default = "default_request_signing_enabled")]
     pub enabled: bool,
@@ -259,7 +260,7 @@ fn default_request_signing_enabled() -> bool {
     false
 }
 
-#[derive(Debug, Default, Deserialize, Serialize, Validate)]
+#[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
 pub struct Settings {
     #[validate(nested)]
     pub publisher: Publisher,
@@ -277,6 +278,8 @@ pub struct Settings {
     #[serde(default)]
     #[validate(nested)]
     pub rewrite: Rewrite,
+    #[serde(default)]
+    pub auction: AuctionConfig,
 }
 
 #[allow(unused)]
diff --git a/crates/common/src/settings_data.rs b/crates/common/src/settings_data.rs
index 7061ca2..f02eaca 100644
--- a/crates/common/src/settings_data.rs
+++ b/crates/common/src/settings_data.rs
@@ -5,6 +5,8 @@ use validator::Validate;
 use crate::error::TrustedServerError;
 use crate::settings::Settings;
 
+pub use crate::auction_config_types::AuctionConfig;
+
 const SETTINGS_DATA: &[u8] = include_bytes!("../../../target/trusted-server-out.toml");
 
 /// Creates a new [`Settings`] instance from the embedded configuration file.
diff --git a/crates/fastly/src/main.rs b/crates/fastly/src/main.rs
index 183fea9..dce550a 100644
--- a/crates/fastly/src/main.rs
+++ b/crates/fastly/src/main.rs
@@ -3,6 +3,8 @@ use fastly::http::Method;
 use fastly::{Error, Request, Response};
 use log_fastly::Logger;
 
+use trusted_server_common::auction::endpoints::handle_auction;
+use trusted_server_common::auction::{build_orchestrator, AuctionOrchestrator};
 use trusted_server_common::auth::enforce_basic_auth;
 use trusted_server_common::error::TrustedServerError;
 use trusted_server_common::integrations::IntegrationRegistry;
@@ -33,14 +35,24 @@ fn main(req: Request) -> Result<Response, Error> {
         }
     };
     log::info!("Settings {settings:?}");
+
+    // Build the auction orchestrator once at startup
+    let orchestrator = build_orchestrator(&settings);
+
     let integration_registry = IntegrationRegistry::new(&settings);
 
-    futures::executor::block_on(route_request(settings, integration_registry, req))
+    futures::executor::block_on(route_request(
+        &settings,
+        &orchestrator,
+        &integration_registry,
+        req,
+    ))
 }
 
 async fn route_request(
-    settings: Settings,
-    integration_registry: IntegrationRegistry,
+    settings: &Settings,
+    orchestrator: &AuctionOrchestrator,
+    integration_registry: &IntegrationRegistry,
     req: Request,
 ) -> Result<Response, Error> {
     log::info!(
@@ -48,7 +60,7 @@ async fn route_request(
         ::std::env::var("FASTLY_SERVICE_VERSION").unwrap_or_else(|_| String::new())
     );
 
-    if let Some(response) = enforce_basic_auth(&settings, &req) {
+    if let Some(response) = enforce_basic_auth(settings, &req) {
         return Ok(response);
     }
 
@@ -60,32 +72,35 @@ async fn route_request(
     let result = match (method, path.as_str()) {
         // Serve the tsjs library
         (Method::GET, path) if path.starts_with("/static/tsjs=") => {
-            handle_tsjs_dynamic(&settings, req)
+            handle_tsjs_dynamic(settings, req)
         }
 
         // Discovery endpoint for trusted-server capabilities and JWKS
         (Method::GET, "/.well-known/trusted-server.json") => {
-            handle_trusted_server_discovery(&settings, req)
+            handle_trusted_server_discovery(settings, req)
         }
 
         // Signature verification endpoint
-        (Method::POST, "/verify-signature") => handle_verify_signature(&settings, req),
+        (Method::POST, "/verify-signature") => handle_verify_signature(settings, req),
 
         // Key rotation admin endpoints
-        (Method::POST, "/admin/keys/rotate") => handle_rotate_key(&settings, req),
-        (Method::POST, "/admin/keys/deactivate") => handle_deactivate_key(&settings, req),
+        (Method::POST, "/admin/keys/rotate") => handle_rotate_key(settings, req),
+        (Method::POST, "/admin/keys/deactivate") => handle_deactivate_key(settings, req),
+
+        // Unified auction endpoint (returns creative HTML inline)
+        (Method::POST, "/auction") => handle_auction(settings, orchestrator, req).await,
 
         // tsjs endpoints
-        (Method::GET, "/first-party/proxy") => handle_first_party_proxy(&settings, req).await,
-        (Method::GET, "/first-party/click") => handle_first_party_click(&settings, req).await,
+        (Method::GET, "/first-party/proxy") => handle_first_party_proxy(settings, req).await,
+        (Method::GET, "/first-party/click") => handle_first_party_click(settings, req).await,
         (Method::GET, "/first-party/sign") | (Method::POST, "/first-party/sign") => {
-            handle_first_party_proxy_sign(&settings, req).await
+            handle_first_party_proxy_sign(settings, req).await
         }
         (Method::POST, "/first-party/proxy-rebuild") => {
-            handle_first_party_proxy_rebuild(&settings, req).await
+            handle_first_party_proxy_rebuild(settings, req).await
         }
         (m, path) if integration_registry.has_route(&m, path) => integration_registry
-            .handle_proxy(&m, path, &settings, req)
+            .handle_proxy(&m, path, settings, req)
             .await
             .unwrap_or_else(|| {
                 Err(Report::new(TrustedServerError::BadRequest {
@@ -100,7 +115,7 @@ async fn route_request(
                 path
             );
 
-            match handle_publisher_request(&settings, &integration_registry, req) {
+            match handle_publisher_request(settings, integration_registry, req) {
                 Ok(response) => Ok(response),
                 Err(e) => {
                     log::error!("Failed to proxy to publisher origin: {:?}", e);
diff --git a/crates/js/lib/src/core/render.ts b/crates/js/lib/src/core/render.ts
index 5464eb5..4685185 100644
--- a/crates/js/lib/src/core/render.ts
+++ b/crates/js/lib/src/core/render.ts
@@ -174,3 +174,8 @@ function buildIframeDocument(creativeHtml: string): string {
     creativeHtml
   );
 }
+
+// Build a complete HTML document for a creative, suitable for use with iframe.srcdoc
+export function buildCreativeDocument(creativeHtml: string): string {
+  return buildIframeDocument(creativeHtml);
+}
diff --git a/crates/js/lib/src/core/request.ts b/crates/js/lib/src/core/request.ts
index 98e04a3..8aed30e 100644
--- a/crates/js/lib/src/core/request.ts
+++ b/crates/js/lib/src/core/request.ts
@@ -1,16 +1,12 @@
-// Request orchestration for tsjs: fires first-party iframe loads or third-party fetches.
-import { delay } from '../shared/async';
-
+// Request orchestration for tsjs: unified auction endpoint with iframe-based creative rendering.
 import { log } from './log';
 import { getAllUnits, firstSize } from './registry';
-import { renderCreativeIntoSlot, renderAllAdUnits, createAdIframe, findSlot } from './render';
-import { getConfig } from './config';
-import { RequestMode } from './types';
+import { createAdIframe, findSlot, buildCreativeDocument } from './render';
 import type { RequestAdsCallback, RequestAdsOptions } from './types';
 
 // getHighestCpmBids is provided by the Prebid extension (shim) to mirror Prebid's API
 
-// Entry point matching Prebid's requestBids signature; decides first/third-party mode.
+// Entry point matching Prebid's requestBids signature; uses unified /auction endpoint.
 export function requestAds(
   callbackOrOpts?: RequestAdsCallback | RequestAdsOptions,
   maybeOpts?: RequestAdsOptions
@@ -25,81 +21,38 @@ export function requestAds(
     callback = opts?.bidsBackHandler;
   }
 
-  const mode: RequestMode = (getConfig().mode as RequestMode | undefined) ?? RequestMode.FirstParty;
-  log.info('requestAds: called', { hasCallback: typeof callback === 'function', mode });
+  log.info('requestAds: called', { hasCallback: typeof callback === 'function' });
   try {
     const adUnits = getAllUnits();
     const payload = { adUnits, config: {} };
     log.debug('requestAds: payload', { units: adUnits.length });
-    if (mode === RequestMode.FirstParty) void requestAdsFirstParty(adUnits);
-    else requestAdsThirdParty(payload);
+
+    // Use unified auction endpoint
+    void requestAdsUnified(payload);
+
     // Synchronously invoke callback to match test expectations
     try {
       if (callback) callback();
     } catch {
       /* ignore callback errors */
     }
-    // network handled in requestAdsThirdParty; no-op here
   } catch {
     log.warn('requestAds: failed to initiate');
   }
 }
 
-// Create per-slot first-party iframe requests served directly from the edge.
-async function requestAdsFirstParty(adUnits: ReadonlyArray<{ code: string }>) {
-  for (const unit of adUnits) {
-    const size = (firstSize(unit) ?? [300, 250]) as readonly [number, number];
-    const slotId = unit.code;
-
-    const attemptInsert = async (attemptsRemaining: number): Promise<void> => {
-      const container = findSlot(slotId) as HTMLElement | null;
-      if (container) {
-        const iframe = createAdIframe(container, {
-          name: `tsjs_iframe_${slotId}`,
-          title: 'Ad content',
-          width: size[0],
-          height: size[1],
-        });
-        iframe.src = `/first-party/ad?slot=${encodeURIComponent(slotId)}&w=${encodeURIComponent(String(size[0]))}&h=${encodeURIComponent(String(size[1]))}`;
-        return;
-      }
-
-      if (attemptsRemaining <= 0) {
-        log.warn('requestAds(firstParty): slot not found; skipping iframe', { slotId });
-        return;
-      }
-
-      if (typeof document !== 'undefined' && document.readyState === 'loading') {
-        document.addEventListener(
-          'DOMContentLoaded',
-          () => {
-            void attemptInsert(attemptsRemaining - 1);
-          },
-          { once: true }
-        );
-        return;
-      }
-
-      await delay(50);
-      await attemptInsert(attemptsRemaining - 1);
-    };
-
-    void attemptInsert(10);
-  }
-}
-
-// Fire a JSON POST to the third-party ad endpoint and render returned creatives.
-function requestAdsThirdParty(payload: { adUnits: unknown[]; config: unknown }) {
-  // Render simple placeholders immediately so pages have content
-  renderAllAdUnits();
+// Fire a JSON POST to the unified /auction endpoint and render creatives via iframes.
+function requestAdsUnified(payload: { adUnits: unknown[]; config: unknown }) {
   if (typeof fetch !== 'function') {
     log.warn('requestAds: fetch not available; nothing to render');
     return;
   }
-  log.info('requestAds: sending request to /third-party/ad', {
+
+  log.info('requestAds: sending request to /auction', {
     units: (payload.adUnits || []).length,
   });
-  void fetch('/third-party/ad', {
+
+  void fetch('/auction', {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
     credentials: 'same-origin',
@@ -107,14 +60,22 @@ function requestAdsThirdParty(payload: { adUnits: unknown[]; config: unknown })
     keepalive: true,
   })
     .then(async (res) => {
-      log.debug('requestAds: sent');
+      log.debug('requestAds: received response');
       try {
         const ct = res.headers.get('content-type') || '';
         if (res.ok && ct.includes('application/json')) {
           const data: unknown = await res.json();
-          for (const bid of parseSeatBids(data)) {
-            if (bid.impid && bid.adm) renderCreativeIntoSlot(String(bid.impid), bid.adm);
+          const bids = parseSeatBids(data);
+
+          log.info('requestAds: got bids', { count: bids.length });
+
+          for (const bid of bids) {
+            if (bid.impid && bid.adm) {
+              // adm contains the creative HTML directly (already rewritten with proxy URLs)
+              renderCreativeInline(String(bid.impid), String(bid.adm), bid.w, bid.h);
+            }
           }
+
           log.info('requestAds: rendered creatives from response');
           return;
         }
@@ -128,8 +89,60 @@ function requestAdsThirdParty(payload: { adUnits: unknown[]; config: unknown })
     });
 }
 
+// Render a creative by writing HTML directly into a sandboxed iframe.
+function renderCreativeInline(
+  slotId: string,
+  creativeHtml: string,
+  creativeWidth?: number,
+  creativeHeight?: number
+): void {
+  const container = findSlot(slotId) as HTMLElement | null;
+  if (!container) {
+    log.warn('renderCreativeInline: slot not found; skipping render', { slotId });
+    return;
+  }
+
+  try {
+    // Clear previous content
+    container.innerHTML = '';
+
+    // Determine size with fallback chain: creative size → ad unit size → 300x250
+    let width: number;
+    let height: number;
+
+    if (creativeWidth && creativeHeight && creativeWidth > 0 && creativeHeight > 0) {
+      // Use actual creative dimensions from bid response
+      width = creativeWidth;
+      height = creativeHeight;
+      log.debug('renderCreativeInline: using creative dimensions', { width, height });
+    } else {
+      // Fallback to ad unit's first size, then to 300x250
+      const unit = getAllUnits().find((u) => u.code === slotId);
+      const size = (unit && firstSize(unit)) || [300, 250];
+      width = size[0];
+      height = size[1];
+      log.debug('renderCreativeInline: using ad unit dimensions', { width, height });
+    }
+
+    // Create iframe sized for the ad
+    const iframe = createAdIframe(container, {
+      name: `tsjs_iframe_${slotId}`,
+      title: 'Ad content',
+      width,
+      height,
+    });
+
+    // Write creative HTML directly into iframe using srcdoc
+    iframe.srcdoc = buildCreativeDocument(creativeHtml);
+
+    log.info('renderCreativeInline: rendered', { slotId, width, height, htmlLength: creativeHtml.length });
+  } catch (err) {
+    log.warn('renderCreativeInline: failed', { slotId, err });
+  }
+}
+
 // Local minimal OpenRTB typing to keep core decoupled from Prebid extension types
-type RtBid = { impid?: string; adm?: string };
+type RtBid = { impid?: string; adm?: string; w?: number; h?: number };
 type RtSeatBid = { bid?: RtBid[] | null };
 type RtResponse = { seatbid?: RtSeatBid[] | null };
 
@@ -149,7 +162,9 @@ function parseSeatBids(data: unknown): RtBid[] {
     for (const b of bids) {
       const impid = typeof b?.impid === 'string' ? b!.impid : undefined;
       const adm = typeof b?.adm === 'string' ? b!.adm : undefined;
-      out.push({ impid, adm });
+      const w = typeof b?.w === 'number' ? b!.w : undefined;
+      const h = typeof b?.h === 'number' ? b!.h : undefined;
+      out.push({ impid, adm, w, h });
     }
   }
   return out;
diff --git a/crates/js/lib/test/core/request.test.ts b/crates/js/lib/test/core/request.test.ts
index 54b6264..8002413 100644
--- a/crates/js/lib/test/core/request.test.ts
+++ b/crates/js/lib/test/core/request.test.ts
@@ -10,31 +10,23 @@ describe('request.requestAds', () => {
     renderMock.mockReset();
   });
 
-  it('sends fetch and renders creatives from response', async () => {
-    // mock render module to capture calls
-    vi.mock('../../src/core/render', async () => {
-      const actual = await vi.importActual<any>('../../src/core/render');
-      return {
-        ...actual,
-        renderCreativeIntoSlot: (slotId: string, html: string) => renderMock(slotId, html),
-      };
-    });
-
-    // mock fetch
+  it('sends fetch and renders creatives via iframe from response', async () => {
+    // mock fetch - returns creative HTML inline in adm field
+    const creativeHtml = '<div>Test Creative</div>';
     (globalThis as any).fetch = vi.fn().mockResolvedValue({
       ok: true,
       status: 200,
       headers: { get: () => 'application/json' },
-      json: async () => ({ seatbid: [{ bid: [{ impid: 'slot1', adm: '<div>ad</div>' }] }] }),
+      json: async () => ({
+        seatbid: [{ bid: [{ impid: 'slot1', adm: creativeHtml }] }],
+      }),
     });
 
     const { addAdUnits } = await import('../../src/core/registry');
-    const { setConfig } = await import('../../src/core/config');
     const { requestAds } = await import('../../src/core/request');
 
     document.body.innerHTML = '<div id="slot1"></div>';
     addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
-    setConfig({ mode: 'thirdParty' } as any);
 
     requestAds();
     // wait microtasks
@@ -42,7 +34,11 @@ describe('request.requestAds', () => {
     await Promise.resolve();
 
     expect((globalThis as any).fetch).toHaveBeenCalled();
-    expect(renderMock).toHaveBeenCalledWith('slot1', '<div>ad</div>');
+
+    // Verify iframe was created with creative HTML in srcdoc
+    const iframe = document.querySelector('#slot1 iframe') as HTMLIFrameElement | null;
+    expect(iframe).toBeTruthy();
+    expect(iframe!.srcdoc).toContain(creativeHtml);
   });
 
   it('handles unexpected third-party response without rendering', async () => {
@@ -102,9 +98,19 @@ describe('request.requestAds', () => {
     expect(renderMock).not.toHaveBeenCalled();
   });
 
-  it('inserts an iframe per ad unit with correct src (firstParty)', async () => {
+  it('inserts an iframe with creative HTML from unified auction', async () => {
+    // mock fetch for unified auction endpoint - returns inline HTML
+    const creativeHtml = '<img src="/first-party/proxy?tsurl=...">Ad</img>';
+    (globalThis as any).fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: { get: () => 'application/json' },
+      json: async () => ({
+        seatbid: [{ bid: [{ impid: 'slot1', adm: creativeHtml }] }],
+      }),
+    });
+
     const { addAdUnits } = await import('../../src/core/registry');
-    const { setConfig } = await import('../../src/core/config');
     const { requestAds } = await import('../../src/core/request');
 
     // Prepare slot in DOM
@@ -112,32 +118,44 @@ describe('request.requestAds', () => {
     div.id = 'slot1';
     document.body.appendChild(div);
 
-    // Configure first-party mode explicitly
-    setConfig({ mode: 'firstParty' } as any);
-
     // Add an ad unit and request
     addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
     requestAds();
 
-    // Verify iframe was inserted with expected src
+    await Promise.resolve();
+    await Promise.resolve();
+
+    // Verify iframe was inserted with creative HTML in srcdoc
     const iframe = document.querySelector('#slot1 iframe') as HTMLIFrameElement | null;
     expect(iframe).toBeTruthy();
-    expect(iframe!.getAttribute('src')).toContain('/first-party/ad?');
-    expect(iframe!.getAttribute('src')).toContain('slot=slot1');
-    expect(iframe!.getAttribute('src')).toContain('w=300');
-    expect(iframe!.getAttribute('src')).toContain('h=250');
+    expect(iframe!.srcdoc).toContain(creativeHtml);
   });
 
-  it('skips iframe insertion when slot is missing (firstParty)', async () => {
+  it('skips iframe insertion when slot is missing', async () => {
+    // mock fetch for unified auction endpoint - returns inline HTML
+    (globalThis as any).fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: { get: () => 'application/json' },
+      json: async () => ({
+        seatbid: [
+          {
+            bid: [{ impid: 'missing-slot', adm: '<div>Creative for missing slot</div>' }],
+          },
+        ],
+      }),
+    });
+
     const { addAdUnits } = await import('../../src/core/registry');
-    const { setConfig } = await import('../../src/core/config');
     const { requestAds } = await import('../../src/core/request');
 
-    setConfig({ mode: 'firstParty' } as any);
     addAdUnits({ code: 'missing-slot', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
     requestAds();
 
-    // No iframe should be inserted because the slot isn't present
+    await Promise.resolve();
+    await Promise.resolve();
+
+    // No iframe should be inserted because the slot isn't present in DOM
     const iframe = document.querySelector('iframe');
     expect(iframe).toBeNull();
   });
diff --git a/docs/guide/aps.md b/docs/guide/aps.md
new file mode 100644
index 0000000..b304b58
--- /dev/null
+++ b/docs/guide/aps.md
@@ -0,0 +1,397 @@
+# Amazon Publisher Services (APS) Integration
+
+Server-side bidding integration for Amazon's Transparent Ad Marketplace (TAM).
+
+## Overview
+
+The APS integration enables publishers to request bids from Amazon's demand sources server-side, providing:
+
+- **Privacy-first bidding**: No client-side ID tracking or third-party cookies required
+- **Reduced latency**: Server-side auction reduces page load impact
+- **Unified auction**: Integrates seamlessly with other bidders (Prebid, GAM)
+- **Performance**: Async bidding with configurable timeouts
+
+## Quick Start
+
+Get started with server-side APS bidding in 5 minutes.
+
+### Prerequisites
+
+- Fastly Compute service configured
+- APS publisher account with valid `pub_id`
+- Rust toolchain installed (see main README)
+
+### Step 1: Configure Fastly Backend
+
+Add APS backend to your Fastly service:
+
+**Option A: Via Fastly UI**
+1. Go to your service → Origins
+2. Click "Create a Backend"
+3. Configure:
+   - Name: `aax.amazon-adsystem.com`
+   - Address: `aax.amazon-adsystem.com`
+   - Port: `443`
+   - Enable TLS: ✓
+
+**Option B: Via `fastly.toml`**
+
+Add to your `fastly.toml`:
+
+```toml
+[[backends]]
+name = "aax.amazon-adsystem.com"
+address = "aax.amazon-adsystem.com"
+port = 443
+use_ssl = true
+ssl_cert_hostname = "aax.amazon-adsystem.com"
+ssl_sni_hostname = "aax.amazon-adsystem.com"
+```
+
+### Step 2: Enable APS in Configuration
+
+Edit `trusted-server.toml`:
+
+```toml
+# Enable APS bidding
+[integrations.aps]
+enabled = true
+pub_id = "5128"  # Replace with your APS publisher ID
+endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
+timeout_ms = 800
+
+# Configure auction to use APS
+[auction]
+enabled = true
+strategy = "parallel_only"  # Run APS alongside other bidders
+bidders = ["aps"]  # Add other bidders like ["aps", "prebid"]
+timeout_ms = 2000
+```
+
+### Step 3: Deploy or Test Locally
+
+**Deploy to Fastly:**
+```bash
+cargo build --release --target wasm32-wasip1
+fastly compute publish
+```
+
+**Test Locally:**
+```bash
+fastly compute serve
+```
+
+### Step 4: Verify It's Working
+
+Check the logs for APS activity:
+
+```bash
+# You should see:
+INFO APS: requesting bids for 2 slots (pub_id: 5128)
+DEBUG APS: sending bid request: {...}
+DEBUG APS: received response: {...}
+INFO APS returned 2 bids in 150ms
+```
+
+## Architecture
+
+```
+Publisher Page Request
+        ↓
+Auction Orchestrator
+        ↓
+APS Provider (async)
+        ↓
+https://aax.amazon-adsystem.com/e/dtb/bid
+        ↓
+Parse APS Response → Unified Bid Format
+        ↓
+Auction Winner Selection
+```
+
+## Configuration
+
+### Basic Setup
+
+Add to `trusted-server.toml`:
+
+```toml
+[integrations.aps]
+enabled = true
+pub_id = "5128"  # Your APS publisher ID
+endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
+timeout_ms = 800
+```
+
+### Environment Variables
+
+Override settings via environment variables:
+
+```bash
+TRUSTED_SERVER__INTEGRATIONS__APS__ENABLED=true
+TRUSTED_SERVER__INTEGRATIONS__APS__PUB_ID=5128
+TRUSTED_SERVER__INTEGRATIONS__APS__TIMEOUT_MS=800
+```
+
+## Auction Strategies
+
+### APS Only
+
+```toml
+[auction]
+enabled = true
+bidders = ["aps"]
+# No mediator = parallel only (highest CPM wins)
+```
+
+### APS + Prebid (Parallel)
+
+Best for maximum revenue:
+
+```toml
+[auction]
+enabled = true
+providers = ["aps", "prebid"]
+timeout_ms = 2000
+# No mediator = all providers compete, highest CPM wins
+
+[integrations.aps]
+enabled = true
+pub_id = "5128"
+timeout_ms = 800
+
+[integrations.prebid]
+enabled = true
+server_url = "https://prebid-server.example.com"
+timeout_ms = 1000
+```
+
+**Benefits:**
+- Maximum fill rate
+- Best CPM selection
+- All bidders compete equally
+
+### APS + Prebid + Mediation
+
+Let a mediator decide winners:
+
+```toml
+[auction]
+enabled = true
+providers = ["aps", "prebid"]
+mediator = "adserver_mock"  # Enables parallel mediation (mediator decides winner)
+timeout_ms = 2000
+```
+
+## Request Format
+
+The integration transforms unified `AuctionRequest` to APS TAM format:
+
+```json
+{
+  "pubId": "5128",
+  "slots": [
+    {
+      "slotID": "header-banner",
+      "slotName": "header-banner",
+      "sizes": [[728, 90], [970, 250]]
+    }
+  ],
+  "pageUrl": "https://example.com/article",
+  "ua": "Mozilla/5.0...",
+  "timeout": 800
+}
+```
+
+## Response Format
+
+APS returns bids in this format:
+
+```json
+{
+  "bids": [
+    {
+      "slotID": "header-banner",
+      "price": 2.50,
+      "adm": "<div>Creative HTML</div>",
+      "w": 728,
+      "h": 90,
+      "adomain": ["amazon.com"],
+      "bidId": "bid-123",
+      "nurl": "https://win-notification.com",
+      "targeting": {
+        "amzniid": "user-id",
+        "amznbid": "2.50"
+      }
+    }
+  ]
+}
+```
+
+The integration automatically transforms this to unified `Bid` format.
+
+## Testing
+
+### Unit Tests
+
+```bash
+cargo test -p trusted-server-common aps::tests
+```
+
+### Local Testing
+
+1. Configure APS in `trusted-server.toml`
+2. Set up Fastly backend
+3. Run locally:
+   ```bash
+   fastly compute serve
+   ```
+4. Inspect logs for bid requests/responses
+
+### Testing
+
+For local testing without live APS credentials, configure the integration with test values:
+
+```toml
+[integrations.aps]
+enabled = true
+pub_id = "test-publisher-123"
+endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
+timeout_ms = 800
+```
+
+Run unit tests:
+```bash
+cargo test -p trusted-server-common aps
+```
+
+## Monitoring
+
+The integration logs detailed information at different levels:
+
+```rust
+// Info: Auction lifecycle
+log::info!("APS: requesting bids for 2 slots (pub_id: 5128)");
+log::info!("APS returned 2 bids in 150ms");
+
+// Debug: Request/response payloads
+log::debug!("APS: sending bid request: {...}");
+log::debug!("APS: received response: {...}");
+
+// Warn: Non-success responses
+log::warn!("APS returned non-success status: 400");
+```
+
+## Troubleshooting
+
+### Problem: No bids returned
+
+**Check:**
+1. Verify `pub_id` is correct
+2. Check backend is configured: `fastly backend list`
+3. Increase timeout: `timeout_ms = 1200`
+4. View logs with `fastly compute serve`
+
+**Possible causes:**
+- Invalid `pub_id` configuration
+- Timeout too short (increase `timeout_ms`)
+- Backend not configured correctly
+- APS account not active
+
+### Problem: "Backend not found" error
+
+**Solution:**
+Add backend to Fastly (see Step 1)
+
+### Problem: Parse errors
+
+**Check:**
+- Enable debug logging
+- Verify endpoint URL is correct
+- Check APS API for changes
+
+**Solutions:**
+- Enable debug logging to inspect response
+- Verify APS endpoint is correct
+- Check for API changes (update structs if needed)
+
+### Timeout Errors
+
+**Symptoms:**
+```
+APS request failed: Timeout
+```
+
+**Solutions:**
+- Increase `timeout_ms` in config
+- Check backend connectivity
+- Verify DNS resolution for `aax.amazon-adsystem.com`
+
+## Performance Tuning
+
+### Timeout Configuration
+
+- **Default**: 800ms (matches APS client-side behavior)
+- **Aggressive**: 500ms (reduce latency, may miss some bids)
+- **Conservative**: 1200ms (maximize fill rate)
+
+```toml
+[integrations.aps]
+timeout_ms = 800  # Balance latency vs fill rate
+```
+
+### Orchestrator Timeout
+
+Ensure orchestrator timeout exceeds provider timeout:
+
+```toml
+[auction]
+timeout_ms = 2000  # > sum of all provider timeouts
+
+[integrations.aps]
+timeout_ms = 800
+
+[integrations.prebid]
+timeout_ms = 1000
+```
+
+## Integration with Client-Side
+
+While this implementation focuses on server-side bidding, you can optionally add client-side components later:
+
+1. **ID Resolution**: Integrate third-party ID vendors client-side
+2. **Analytics**: Load `aps_csm.js` for viewability tracking
+3. **Config Loading**: Fetch `/configs/{pub_id}` for advanced settings
+
+See the original network flow documentation for client-side patterns.
+
+## Future Enhancements
+
+Potential additions for complete APS TAM parity:
+
+1. **Video Support**: Add video slot formats
+2. **ID Enrichment**: Server-side ID resolution (LiveRamp, ID5, etc.)
+3. **Advanced Targeting**: Pass user segments, geo data
+4. **Config API**: Fetch APS configuration from `/configs/{pub_id}`
+5. **Analytics**: Integrate with APS measurement endpoints
+
+## Reference
+
+- **APS TAM Docs**: https://aps.amazon.com/aps/transparent-ad-marketplace-api/
+- **Integration Code**: `crates/common/src/integrations/aps.rs`
+- **Tests**: `crates/common/src/integrations/aps.rs#tests`
+- **Example Config**: `trusted-server.toml`
+
+## Support
+
+Questions? Issues?
+1. Check logs: `fastly compute serve`
+2. Run tests: `cargo test aps`
+3. Verify configuration in `trusted-server.toml`
+4. Review this documentation
+
+---
+
+**Status**: ✅ Production Ready (Server-Side Bidding)
+
+**Last Updated**: 2025-12-23
diff --git a/docs/guide/integration_guide.md b/docs/guide/integration_guide.md
index f615827..15c5bae 100644
--- a/docs/guide/integration_guide.md
+++ b/docs/guide/integration_guide.md
@@ -295,10 +295,10 @@ time.
 
 Two built-in integrations demonstrate how the framework pieces fit together:
 
-| Integration | Purpose                                                                                                                                                                                                                                               | Key files                                                                                    |
-| ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
-| `testlight` | Sample partner stub showing request proxying, attribute rewrites, and asset injection.                                                                                                                                                                | `crates/common/src/integrations/testlight.rs`, `crates/js/lib/src/integrations/testlight.ts` |
-| `prebid`    | Production Prebid Server bridge that owns `/first-party/ad` & `/third-party/ad`, injects synthetic IDs, rewrites creatives/notification URLs, and removes publisher-supplied Prebid scripts because the shim already ships in the unified TSJS build. | `crates/common/src/integrations/prebid.rs`, `crates/js/lib/src/ext/prebidjs.ts`              |
+| Integration | Purpose                                                                                                                                                                                  | Key files                                                                                    |
+| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
+| `testlight` | Sample partner stub showing request proxying, attribute rewrites, and asset injection.                                                                                                   | `crates/common/src/integrations/testlight.rs`, `crates/js/lib/src/integrations/testlight.ts` |
+| `prebid`    | Production Prebid Server bridge that owns `/first-party/ad` & `/auction`, injects synthetic IDs, rewrites creatives/notification URLs, and removes publisher-supplied Prebid scripts because the shim already ships in the unified TSJS build. | `crates/common/src/integrations/prebid.rs`, `crates/js/lib/src/ext/prebidjs.ts`              |
 
 ### Example: Prebid integration
 
@@ -323,11 +323,11 @@ Prebid applies the same steps outlined above with a few notable patterns:
    other integrations use.
 
 2. **Routes owned by the integration** – `IntegrationProxy::routes` declares the
-   `/integrations/prebid/first-party/ad` (GET) and `/integrations/prebid/third-party/ad` (POST)
+   `/integrations/prebid/first-party/ad` (GET) and `/auction` (POST)
    endpoints. Both handlers share helpers that shape OpenRTB payloads, inject synthetic IDs +
    geo/request-signing context, forward requests via `ensure_backend_from_url`, and run the HTML
-   creative rewrites before responding. All routes are properly namespaced under
-   `/integrations/prebid/` to follow the integration routing pattern.
+   creative rewrites before responding. The `/auction` route is mounted at the top level,
+   while other integration-specific routes follow the `/integrations/prebid/` namespacing pattern.
 
 3. **HTML rewrites through the registry** – When `auto_configure` is enabled, the integration’s
    `IntegrationAttributeRewriter` removes any `<script src="prebid*.js">` or `<link href=…>`
diff --git a/fastly.toml b/fastly.toml
index a80fea4..bd33d27 100644
--- a/fastly.toml
+++ b/fastly.toml
@@ -32,6 +32,10 @@ build = """
         [[local_server.kv_stores.opid_store]]
             key = "placeholder"
             data = "placeholder"
+
+        [[local_server.kv_stores.creative_store]]
+            key = "placeholder"
+            data = "placeholder"
     [local_server.secret_stores]
         [[local_server.secret_stores.signing_keys]]
             key = "ts-2025-10-A"
diff --git a/trusted-server.toml b/trusted-server.toml
index 1abf398..da92cb4 100644
--- a/trusted-server.toml
+++ b/trusted-server.toml
@@ -40,6 +40,7 @@ timeout_ms = 1000
 bidders = ["kargo", "rubicon", "appnexus", "openx"]
 auto_configure = false
 debug = false
+# debug_query_params = ""
 # script_handler = "/prebid.js"
 
 [integrations.nextjs]
@@ -81,3 +82,24 @@ rewrite_sdk = true
 # exclude_domains = [
 #     "*.edgecompute.app",
 # ]
+
+
+[auction]
+enabled = true
+providers = ["prebid"]
+# mediator = "adserver_mock"  # will use mediator when set
+timeout_ms = 2000
+
+[integrations.aps]
+enabled = false
+pub_id = "your-aps-publisher-id"
+endpoint = "https://origin-mocktioneer.cdintel.com/e/dtb/bid"
+timeout_ms = 1000
+
+[integrations.adserver_mock]
+enabled = false
+endpoint = "https://origin-mocktioneer.cdintel.com/adserver/mediate"
+timeout_ms = 1000
+
+
+