Get Started

Generate a nonce

A "nonce" is a single encrypted string generated by PAL via the NonceLoader. The PAL SDK requires each new stream request to be accompanied by a newly generated nonce. However, nonces may be reused for multiple ad requests within the same stream. To generate a nonce using the PAL SDK, create an HTML file and add the following:


  <button id="generate-nonce">Generate Nonce</button>
  <script src="//"></script>
  <script src="pal.js"></script>

Then, create a JavaScript file and add the following:


let nonceLoader;
let managerPromise;

 * Initializes the PAL loader.
function init() {
      .addEventListener('click', generateNonce);

  // The default value for `allowStorage` is false, but can be
  // changed once the appropriate consent has been gathered. The
  // getConsentToStorage() method is a placeholder for the publisher's own
  // method of obtaining user consent, either by integrating with a CMP or
  // based on other methods the publisher chooses to handle storage consent.

  const consentSettings = new goog.pal.ConsentSettings();
  consentSettings.allowStorage = getConsentToStorage();

  nonceLoader = new goog.pal.NonceLoader(consentSettings);

 * Generates a nonce with sample arguments and logs it to the console. Note that
 * the sendAdImpression() and sendAdClick() methods should be called on the
 * NonceManager when the ad is played or clicked on respectively.
function generateNonce() {
  const request = new goog.pal.NonceRequest();
  request.adWillAutoPlay = true;
  request.adWillPlayMuted = true;
  request.continuousPlayback = false;
  request.descriptionUrl = '';
  request.iconsSupported = true;
  request.playerType = 'Sample Player Type';
  request.playerVersion = '1.0';
  request.ppid = 'Sample PPID';
  request.videoHeight = 480;
  request.videoWidth = 640;

  managerPromise = nonceLoader.loadNonceManager(request);
      .then((manager) => {
        console.log('Nonce generated: ' + manager.getNonce());
      .catch((error) => {
        console.log('Error generating nonce: ' + error);


When making your direct VAST call (DVC), set this nonce as the value on the paln parameter. The nonce is URL safe—you don't need to URL-encode it.