diff --git a/features.json b/features.json
index ccb2166a05f..4d8377cda7d 100644
--- a/features.json
+++ b/features.json
@@ -1,4 +1,5 @@
 [
   "NATIVE",
-  "VIDEO"
+  "VIDEO",
+  "UID2_CSTG"
 ]
diff --git a/integrationExamples/gpt/userId_example.html b/integrationExamples/gpt/userId_example.html
index 836c03c4657..c9465f5b074 100644
--- a/integrationExamples/gpt/userId_example.html
+++ b/integrationExamples/gpt/userId_example.html
@@ -31,7 +31,7 @@
     var pbjs = pbjs || {};
     pbjs.que = pbjs.que || [];
   </script>
-  <script  type="text/javascript"  src="../../build/dev/prebid.js" async></script>
+  <script type="text/javascript" src="../../build/dev/prebid.js" async></script>
 
   <script>
     function getHashedEmail() { }
diff --git a/modules/uid2IdSystem.js b/modules/uid2IdSystem.js
index ae63affdc06..1b8b8361b68 100644
--- a/modules/uid2IdSystem.js
+++ b/modules/uid2IdSystem.js
@@ -7,7 +7,7 @@
  */
 
 import { logInfo, logWarn } from '../src/utils.js';
-import {submodule} from '../src/hook.js';
+import { submodule } from '../src/hook.js';
 import {getStorageManager} from '../src/storageManager.js';
 import {MODULE_TYPE_UID} from '../src/activities/modules.js';
 
@@ -83,21 +83,22 @@ export const uid2IdSubmodule = {
       return;
     }
 
-    let mappedCstgConfig = {
-      serverPublicKey: config?.params?.serverPublicKey,
-      subscriptionId: config?.params?.subscriptionId,
-      ...extractIdentityFromParams(config?.params ?? {})
-    }
-
     const mappedConfig = {
       apiBaseUrl: config?.params?.uid2ApiBase ?? UID2_BASE_URL,
       paramToken: config?.params?.uid2Token,
       serverCookieName: config?.params?.uid2Cookie ?? config?.params?.uid2ServerCookie,
       storage: config?.params?.storage ?? 'localStorage',
-      cstg: mappedCstgConfig,
       clientId: UID2_CLIENT_ID,
       internalStorage: ADVERTISING_COOKIE
     }
+
+    if (FEATURES.UID2_CSTG) {
+      mappedConfig.cstg = {
+        serverPublicKey: config?.params?.serverPublicKey,
+        subscriptionId: config?.params?.subscriptionId,
+        ...extractIdentityFromParams(config?.params ?? {})
+      }
+    }
     _logInfo(`UID2 configuration loaded and mapped.`, mappedConfig);
     const result = Uid2GetId(mappedConfig, storage, _logInfo, _logWarn);
     _logInfo(`UID2 getId returned`, result);
diff --git a/modules/uid2IdSystem_shared.js b/modules/uid2IdSystem_shared.js
index e9f098cbfee..1fdc7121fae 100644
--- a/modules/uid2IdSystem_shared.js
+++ b/modules/uid2IdSystem_shared.js
@@ -8,92 +8,6 @@ function isValidIdentity(identity) {
   return !!(typeof identity === 'object' && identity !== null && identity.advertising_token && identity.identity_expires && identity.refresh_from && identity.refresh_token && identity.refresh_expires);
 }
 
-function isNormalizedPhone(phone) {
-  return /^\+[0-9]{10,15}$/.test(phone);
-}
-
-function isBase64Hash(value) {
-  if (!(value && value.length === 44)) {
-    return false;
-  }
-
-  try {
-    return btoa(atob(value)) === value;
-  } catch (err) {
-    return false;
-  }
-}
-
-function isCSTGOptions(
-  maybeOpts,
-  _logWarn
-) {
-  if (typeof maybeOpts !== 'object' || maybeOpts === null) {
-    _logWarn('CSTG opts must be an object');
-    return false;
-  }
-
-  const opts = maybeOpts;
-  if (typeof opts.serverPublicKey !== 'string') {
-    _logWarn('CSTG opts.serverPublicKey must be a string');
-    return false;
-  }
-  const serverPublicKeyPrefix = /^UID2-X-[A-Z]-.+/;
-  if (!serverPublicKeyPrefix.test(opts.serverPublicKey)) {
-    _logWarn(
-      `CSTG opts.serverPublicKey must match the regular expression ${serverPublicKeyPrefix}`
-    );
-    return false;
-  }
-  // We don't do any further validation of the public key, as we will find out
-  // later if it's valid by using importKey.
-
-  if (typeof opts.subscriptionId !== 'string') {
-    _logWarn('CSTG opts.subscriptionId must be a string');
-    return false;
-  }
-  if (opts.subscriptionId.length === 0) {
-    _logWarn('CSTG opts.subscriptionId is empty');
-    return false;
-  }
-  return true
-}
-
-function getValidIdentity(opts, _logWarn) {
-  if (opts.emailHash) {
-    if (!isBase64Hash(opts.emailHash)) {
-      _logWarn('CSTG opts.emailHash is invalid');
-      return;
-    }
-    return { email_hash: opts.emailHash }
-  }
-
-  if (opts.phoneHash) {
-    if (!isBase64Hash(opts.phoneHash)) {
-      _logWarn('CSTG opts.phoneHash is invalid');
-      return;
-    }
-    return { phone_hash: opts.phoneHash }
-  }
-
-  if (opts.email) {
-    const normalizedEmail = normalizeEmail(opts.email);
-    if (normalizedEmail === undefined) {
-      _logWarn('CSTG opts.email is invalid');
-      return;
-    }
-    return { email: opts.email }
-  }
-
-  if (opts.phone) {
-    if (!isNormalizedPhone(opts.phone)) {
-      _logWarn('CSTG opts.phone is invalid');
-      return;
-    }
-    return { phone: opts.phone }
-  }
-}
-
 // This is extracted from an in-progress API client. Once it's available via NPM, this class should be replaced with the NPM package.
 export class Uid2ApiClient {
   constructor(opts, clientId, logInfo, logWarn) {
@@ -121,24 +35,6 @@ export class Uid2ApiClient {
       response.status === 'optout' || response.status === 'expired_token' || (response.status === 'success' && response.body && isValidIdentity(response.body))
     );
   }
-  isCstgApiSuccessResponse(response) {
-    return this.hasStatusResponse(response) && (
-      response.status === 'success' &&
-      isValidIdentity(response.body)
-    );
-  }
-  isCstgApiClientErrorResponse(response) {
-    return this.hasStatusResponse(response) && (
-      response.status === 'client_error' &&
-      typeof response.message === 'string'
-    );
-  }
-  isCstgApiForbiddenResponse(response) {
-    return this.hasStatusResponse(response) && (
-      response.status === 'invalid_http_origin' &&
-      typeof response.message === 'string'
-    );
-  }
   ResponseToRefreshResult(response) {
     if (this.isValidRefreshResponse(response)) {
       if (response.status === 'success') { return { status: response.status, identity: response.body }; }
@@ -201,98 +97,6 @@ export class Uid2ApiClient {
       } });
     return promise;
   }
-
-  async callCstgApi(request) {
-    this._logInfo('Building CSTG request for', request);
-    const box = await UID2CstgBox.build(stripPublicKeyPrefix(this._serverPublicKey))
-    const encoder = new TextEncoder();
-    const now = Date.now();
-    const { iv, ciphertext } = await box.encrypt(
-      encoder.encode(JSON.stringify(request)),
-      encoder.encode(JSON.stringify([now]))
-    );
-
-    const exportedPublicKey = await UID2CstgCrypto.exportPublicKey(box.clientPublicKey);
-    const requestBody = {
-      payload: UID2CstgCrypto.bytesToBase64(new Uint8Array(ciphertext)),
-      iv: UID2CstgCrypto.bytesToBase64(new Uint8Array(iv)),
-      public_key: UID2CstgCrypto.bytesToBase64(new Uint8Array(exportedPublicKey)),
-      timestamp: now,
-      subscription_id: this._subscriptionId,
-    };
-    return this._callCstgApi(requestBody, box)
-  }
-
-  _callCstgApi(requestBody, box) {
-    const url = this._baseUrl + '/v2/token/client-generate';
-    let resolvePromise;
-    let rejectPromise;
-    const promise = new Promise((resolve, reject) => {
-      resolvePromise = resolve;
-      rejectPromise = reject;
-    });
-
-    this._logInfo('Sending CSTG request', requestBody);
-    ajax(url, {
-      success: async(responseText, xhr) => {
-        try {
-          const encodedResp = UID2CstgCrypto.base64ToBytes(responseText);
-          const decrypted = await box.decrypt(
-            encodedResp.slice(0, 12),
-            encodedResp.slice(12)
-          )
-          const decryptedResponse = new TextDecoder().decode(decrypted);
-          const response = JSON.parse(decryptedResponse);
-          if (this.isCstgApiSuccessResponse(response)) {
-            resolvePromise({
-              status: 'success',
-              identity: response.body,
-            });
-          } else {
-            // A 200 should always be a success response.
-            // Something has gone wrong.
-            rejectPromise(
-              `API error: Response body was invalid for HTTP status 200: ${decryptedResponse}`
-            );
-          }
-        } catch (err) {
-          rejectPromise(err);
-        }
-      },
-      error: (error, xhr) => {
-        try {
-          if (xhr.status === 400) {
-            const response = JSON.parse(xhr.responseText);
-            if (this.isCstgApiClientErrorResponse(response)) {
-              rejectPromise(`Client error: ${response.message}`);
-            } else {
-              // A 400 should always be a client error.
-              // Something has gone wrong.
-              rejectPromise(
-                `API error: Response body was invalid for HTTP status 400: ${xhr.responseText}`
-              );
-            }
-          } else if (xhr.status === 403) {
-            const response = JSON.parse(xhr.responseText);
-            if (this.isCstgApiForbiddenResponse(xhr)) {
-              rejectPromise(`Forbidden: ${response.message}`);
-            } else {
-              // A 403 should always be a forbidden response.
-              // Something has gone wrong.
-              rejectPromise(
-                `API error: Response body was invalid for HTTP status 403: ${xhr.responseText}`
-              );
-            }
-          } else {
-            rejectPromise(`API error: Unexpected HTTP status ${xhr.status}: ${error}`);
-          }
-        } catch (_e) {
-          rejectPromise(error)
-        }
-      }
-    }, JSON.stringify(requestBody), { method: 'POST' });
-    return promise;
-  }
 }
 export class Uid2StorageManager {
   constructor(storage, preferLocalStorage, storageName, logInfo) {
@@ -363,98 +167,6 @@ export class Uid2StorageManager {
   }
 }
 
-class UID2CstgBox {
-  static _namedCurve = 'P-256'
-  constructor(clientPublicKey, sharedKey) {
-    this._clientPublicKey = clientPublicKey;
-    this._sharedKey = sharedKey;
-  }
-
-  static async build(serverPublicKey) {
-    const clientKeyPair = await UID2CstgCrypto.generateKeyPair(UID2CstgBox._namedCurve);
-    const importedServerPublicKey = await UID2CstgCrypto.importPublicKey(
-      serverPublicKey,
-      this._namedCurve
-    );
-    const sharedKey = await UID2CstgCrypto.deriveKey(
-      importedServerPublicKey,
-      clientKeyPair.privateKey
-    );
-    return new UID2CstgBox(clientKeyPair.publicKey, sharedKey);
-  }
-
-  async encrypt(plaintext, additionalData) {
-    const iv = window.crypto.getRandomValues(new Uint8Array(12));
-    const ciphertext = await window.crypto.subtle.encrypt({
-      name: 'AES-GCM',
-      iv,
-      additionalData,
-    }, this._sharedKey, plaintext)
-    return { iv, ciphertext }
-  }
-
-  async decrypt(iv, ciphertext) {
-    return window.crypto.subtle.decrypt({
-      name: 'AES-GCM',
-      iv
-    }, this._sharedKey, ciphertext);
-  }
-
-  get clientPublicKey() {
-    return this._clientPublicKey;
-  }
-}
-
-class UID2CstgCrypto {
-  static base64ToBytes(base64) {
-    const binString = atob(base64);
-    return Uint8Array.from(binString, (m) => m.codePointAt(0));
-  }
-
-  static bytesToBase64(bytes) {
-    const binString = Array.from(bytes, (x) => String.fromCodePoint(x)).join('');
-    return btoa(binString);
-  }
-
-  static async generateKeyPair(namedCurve) {
-    const params = {
-      name: 'ECDH',
-      namedCurve: namedCurve,
-    };
-    return window.crypto.subtle.generateKey(params, false, ['deriveKey']);
-  }
-
-  static async importPublicKey(publicKey, namedCurve) {
-    const params = {
-      name: 'ECDH',
-      namedCurve: namedCurve,
-    };
-    return window.crypto.subtle.importKey('spki', this.base64ToBytes(publicKey), params, false, []);
-  }
-
-  static exportPublicKey(publicKey) {
-    return window.crypto.subtle.exportKey('spki', publicKey);
-  }
-
-  static async deriveKey(serverPublicKey, clientPrivateKey) {
-    return window.crypto.subtle.deriveKey({
-      name: 'ECDH',
-      public: serverPublicKey,
-    }, clientPrivateKey, {
-      name: 'AES-GCM',
-      length: 256,
-    }, false, ['encrypt', 'decrypt']);
-  }
-
-  static async hash(value) {
-    const hash = await window.crypto.subtle.digest(
-      'SHA-256',
-      new TextEncoder().encode(value)
-    );
-    return this.bytesToBase64(new Uint8Array(hash));
-  }
-}
-
 function refreshTokenAndStore(baseUrl, token, clientId, storageManager, _logInfo, _logWarn) {
   _logInfo('UID2 base url provided: ', baseUrl);
   const client = new Uid2ApiClient({baseUrl}, clientId, _logInfo, _logWarn);
@@ -471,126 +183,496 @@ function refreshTokenAndStore(baseUrl, token, clientId, storageManager, _logInfo
   });
 }
 
-function normalizeEmail(email) {
-  if (email == undefined || email.length <= 0) {
-    return undefined;
-  }
+let clientSideTokenGenerator;
+if (FEATURES.UID2_CSTG) {
+  const SERVER_PUBLIC_KEY_PREFIX_LENGTH = 9;
 
-  const STARTING_STATE = 'Starting';
-  const SUBDOMAIN_STATE = 'SubDomain'
+  clientSideTokenGenerator = {
+    isCSTGOptionsValid(maybeOpts, _logWarn) {
+      if (typeof maybeOpts !== 'object' || maybeOpts === null) {
+        _logWarn('CSTG opts must be an object');
+        return false;
+      }
 
-  let preSb = '';
-  let preSbSpecialized = '';
-  let sb = '';
-  let wsBuffer = '';
+      const opts = maybeOpts;
+      if (typeof opts.serverPublicKey !== 'string') {
+        _logWarn('CSTG opts.serverPublicKey must be a string');
+        return false;
+      }
+      const serverPublicKeyPrefix = /^UID2-X-[A-Z]-.+/;
+      if (!serverPublicKeyPrefix.test(opts.serverPublicKey)) {
+        _logWarn(
+          `CSTG opts.serverPublicKey must match the regular expression ${serverPublicKeyPrefix}`
+        );
+        return false;
+      }
+      // We don't do any further validation of the public key, as we will find out
+      // later if it's valid by using importKey.
 
-  let parsingState = STARTING_STATE;
-  let inExtension = false;
+      if (typeof opts.subscriptionId !== 'string') {
+        _logWarn('CSTG opts.subscriptionId must be a string');
+        return false;
+      }
+      if (opts.subscriptionId.length === 0) {
+        _logWarn('CSTG opts.subscriptionId is empty');
+        return false;
+      }
+      return true;
+    },
+
+    getValidIdentity(opts, _logWarn) {
+      if (opts.emailHash) {
+        if (!UID2DiiNormalization.isBase64Hash(opts.emailHash)) {
+          _logWarn('CSTG opts.emailHash is invalid');
+          return;
+        }
+        return { email_hash: opts.emailHash };
+      }
 
-  for (const cGiven of email) {
-    let c = cGiven;
-    if (cGiven >= 'A' && cGiven < 'Z') {
-      c = String.fromCharCode(c.charCodeAt(0) + 32);
-    }
+      if (opts.phoneHash) {
+        if (!UID2DiiNormalization.isBase64Hash(opts.phoneHash)) {
+          _logWarn('CSTG opts.phoneHash is invalid');
+          return;
+        }
+        return { phone_hash: opts.phoneHash };
+      }
 
-    switch (parsingState) {
-      case STARTING_STATE:
-        if (c == ' ') {
-          break;
+      if (opts.email) {
+        const normalizedEmail = UID2DiiNormalization.normalizeEmail(opts.email);
+        if (normalizedEmail === undefined) {
+          _logWarn('CSTG opts.email is invalid');
+          return;
         }
-        if (c == '@') {
-          parsingState = SUBDOMAIN_STATE;
-        } else if (c == '.') {
-          preSb += c;
-        } else if (c == '+') {
-          preSb += c;
-          inExtension = true;
-        } else {
-          preSb += c;
-          if (!inExtension) {
-            preSbSpecialized += c;
-          }
+        return { email: opts.email };
+      }
+
+      if (opts.phone) {
+        if (!UID2DiiNormalization.isNormalizedPhone(opts.phone)) {
+          _logWarn('CSTG opts.phone is invalid');
+          return;
         }
-        break;
-      case SUBDOMAIN_STATE:
-        if (c == '@') {
-          return undefined;
-        } else if (c == ' ') {
-          wsBuffer += c;
-          break;
-        } else if (wsBuffer.length > 0) {
-          sb += wsBuffer;
-          wsBuffer = '';
+        return { phone: opts.phone };
+      }
+    },
+
+    isStoredTokenInvalid(cstgIdentity, storedTokens, _logInfo, _logWarn) {
+      if (storedTokens) {
+        const identity = Object.values(cstgIdentity)[0];
+        if (!this.isStoredTokenFromSameIdentity(storedTokens, identity)) {
+          _logInfo(
+            'CSTG supplied new identity - ignoring stored value.',
+            storedTokens.originalIdentity,
+            cstgIdentity
+          );
+          // Stored token wasn't originally sourced from the provided identity - ignore the stored value. A new user has logged in?
+          return true;
         }
-        sb += c;
+      }
+      return false;
+    },
+
+    async generateTokenAndStore(
+      baseUrl,
+      cstgOpts,
+      cstgIdentity,
+      storageManager,
+      _logInfo,
+      _logWarn
+    ) {
+      _logInfo('UID2 cstg opts provided: ', JSON.stringify(cstgOpts));
+      const client = new UID2CstgApiClient(
+        { baseUrl, cstg: cstgOpts },
+        _logInfo,
+        _logWarn
+      );
+      const response = await client.generateToken(cstgIdentity);
+      _logInfo('CSTG endpoint responded with:', response);
+      const tokens = {
+        originalIdentity: this.encodeOriginalIdentity(cstgIdentity),
+        latestToken: response.identity,
+      };
+      storageManager.storeValue(tokens);
+      return tokens;
+    },
+
+    isStoredTokenFromSameIdentity(storedTokens, identity) {
+      if (!storedTokens.originalIdentity) return false;
+      return (
+        cyrb53Hash(identity, storedTokens.originalIdentity.salt) ===
+        storedTokens.originalIdentity.identity
+      );
+    },
+
+    encodeOriginalIdentity(identity) {
+      const identityValue = Object.values(identity)[0];
+      const salt = Math.floor(Math.random() * Math.pow(2, 32));
+      return {
+        identity: cyrb53Hash(identityValue, salt),
+        salt,
+      };
+    },
+  };
+
+  class UID2DiiNormalization {
+    EMAIL_EXTENSION_SYMBOL = '+';
+    EMAIL_DOT = '.';
+    GMAIL_DOMAIN = 'gmail.com';
+
+    static isBase64Hash(value) {
+      if (!(value && value.length === 44)) {
+        return false;
+      }
+
+      try {
+        return btoa(atob(value)) === value;
+      } catch (err) {
+        return false;
+      }
     }
-  }
 
-  if (sb.length == 0) {
-    return undefined;
-  }
+    static isNormalizedPhone(phone) {
+      return /^\+[0-9]{10,15}$/.test(phone);
+    }
 
-  let domainPart = sb;
-  const GMAILDOMAIN = 'gmail.com';
+    static normalizeEmail(email) {
+      if (!email || !email.length) return;
 
-  let addressPartToUse = domainPart == GMAILDOMAIN ? preSbSpecialized : preSb;
-  if (addressPartToUse.length == 0) {
-    return undefined;
-  }
+      const parsedEmail = email.trim().toLowerCase();
+      if (parsedEmail.indexOf(' ') > 0) return;
 
-  return addressPartToUse + '@' + domainPart;
-}
+      const emailParts = this.splitEmailIntoAddressAndDomain(parsedEmail);
+      if (!emailParts) return;
 
-async function generateCstgRequest(cstgIdentity) {
-  if ('email_hash' in cstgIdentity || 'phone_hash' in cstgIdentity) {
-    return cstgIdentity;
-  }
-  if ('email' in cstgIdentity) {
-    const emailHash = await UID2CstgCrypto.hash(cstgIdentity.email)
-    return { email_hash: emailHash };
+      const { address, domain } = emailParts;
+
+      const emailIsGmail = this.isGmail(domain);
+      const parsedAddress = this.normalizeAddressPart(
+        address,
+        emailIsGmail,
+        emailIsGmail
+      );
+      return parsedAddress ? `${parsedAddress}@${domain}` : undefined;
+    }
+
+    static splitEmailIntoAddressAndDomain(email) {
+      const parts = email.split('@');
+      if (
+        !parts.length ||
+        parts.length !== 2 ||
+        parts.some((part) => part === '')
+      ) { return; }
+
+      return {
+        address: parts[0],
+        domain: parts[1],
+      };
+    }
+
+    static isGmail(domain) {
+      return domain === this.GMAIL_DOMAIN;
+    }
+
+    static dropExtension(address, extensionSymbol = this.EMAIL_EXTENSION_SYMBOL) {
+      return address.split(extensionSymbol)[0];
+    }
+
+    static normalizeAddressPart(address, shouldRemoveDot, shouldDropExtension) {
+      let parsedAddress = address;
+      if (shouldRemoveDot) { parsedAddress = parsedAddress.replaceAll(this.EMAIL_DOT, ''); }
+      if (shouldDropExtension) parsedAddress = this.dropExtension(parsedAddress);
+      return parsedAddress;
+    }
   }
-  if ('phone' in cstgIdentity) {
-    const phoneHash = await UID2CstgCrypto.hash(cstgIdentity.phone)
-    return {phone_hash: phoneHash}
+
+  class UID2CstgApiClient {
+    constructor(opts, logInfo, logWarn) {
+      this._baseUrl = opts.baseUrl;
+      this._serverPublicKey = opts.cstg.serverPublicKey;
+      this._subscriptionId = opts.cstg.subscriptionId;
+      this._logInfo = logInfo;
+      this._logWarn = logWarn;
+    }
+
+    hasStatusResponse(response) {
+      return typeof response === 'object' && response && response.status;
+    }
+
+    isCstgApiSuccessResponse(response) {
+      return (
+        this.hasStatusResponse(response) &&
+        response.status === 'success' &&
+        isValidIdentity(response.body)
+      );
+    }
+
+    isCstgApiClientErrorResponse(response) {
+      return (
+        this.hasStatusResponse(response) &&
+        response.status === 'client_error' &&
+        typeof response.message === 'string'
+      );
+    }
+
+    isCstgApiForbiddenResponse(response) {
+      return (
+        this.hasStatusResponse(response) &&
+        response.status === 'invalid_http_origin' &&
+        typeof response.message === 'string'
+      );
+    }
+
+    stripPublicKeyPrefix(serverPublicKey) {
+      return serverPublicKey.substring(SERVER_PUBLIC_KEY_PREFIX_LENGTH);
+    }
+
+    async generateCstgRequest(cstgIdentity) {
+      if ('email_hash' in cstgIdentity || 'phone_hash' in cstgIdentity) {
+        return cstgIdentity;
+      }
+      if ('email' in cstgIdentity) {
+        const emailHash = await UID2CstgCrypto.hash(cstgIdentity.email);
+        return { email_hash: emailHash };
+      }
+      if ('phone' in cstgIdentity) {
+        const phoneHash = await UID2CstgCrypto.hash(cstgIdentity.phone);
+        return { phone_hash: phoneHash };
+      }
+    }
+
+    async generateToken(cstgIdentity) {
+      const request = await this.generateCstgRequest(cstgIdentity);
+      this._logInfo('Building CSTG request for', request);
+      const box = await UID2CstgBox.build(
+        this.stripPublicKeyPrefix(this._serverPublicKey)
+      );
+      const encoder = new TextEncoder();
+      const now = Date.now();
+      const { iv, ciphertext } = await box.encrypt(
+        encoder.encode(JSON.stringify(request)),
+        encoder.encode(JSON.stringify([now]))
+      );
+
+      const exportedPublicKey = await UID2CstgCrypto.exportPublicKey(
+        box.clientPublicKey
+      );
+      const requestBody = {
+        payload: UID2CstgCrypto.bytesToBase64(new Uint8Array(ciphertext)),
+        iv: UID2CstgCrypto.bytesToBase64(new Uint8Array(iv)),
+        public_key: UID2CstgCrypto.bytesToBase64(
+          new Uint8Array(exportedPublicKey)
+        ),
+        timestamp: now,
+        subscription_id: this._subscriptionId,
+      };
+      return this.callCstgApi(requestBody, box);
+    }
+
+    async callCstgApi(requestBody, box) {
+      const url = this._baseUrl + '/v2/token/client-generate';
+      let resolvePromise;
+      let rejectPromise;
+      const promise = new Promise((resolve, reject) => {
+        resolvePromise = resolve;
+        rejectPromise = reject;
+      });
+
+      this._logInfo('Sending CSTG request', requestBody);
+      ajax(
+        url,
+        {
+          success: async (responseText, xhr) => {
+            try {
+              const encodedResp = UID2CstgCrypto.base64ToBytes(responseText);
+              const decrypted = await box.decrypt(
+                encodedResp.slice(0, 12),
+                encodedResp.slice(12)
+              );
+              const decryptedResponse = new TextDecoder().decode(decrypted);
+              const response = JSON.parse(decryptedResponse);
+              if (this.isCstgApiSuccessResponse(response)) {
+                resolvePromise({
+                  status: 'success',
+                  identity: response.body,
+                });
+              } else {
+                // A 200 should always be a success response.
+                // Something has gone wrong.
+                rejectPromise(
+                  `API error: Response body was invalid for HTTP status 200: ${decryptedResponse}`
+                );
+              }
+            } catch (err) {
+              rejectPromise(err);
+            }
+          },
+          error: (error, xhr) => {
+            try {
+              if (xhr.status === 400) {
+                const response = JSON.parse(xhr.responseText);
+                if (this.isCstgApiClientErrorResponse(response)) {
+                  rejectPromise(`Client error: ${response.message}`);
+                } else {
+                  // A 400 should always be a client error.
+                  // Something has gone wrong.
+                  rejectPromise(
+                    `API error: Response body was invalid for HTTP status 400: ${xhr.responseText}`
+                  );
+                }
+              } else if (xhr.status === 403) {
+                const response = JSON.parse(xhr.responseText);
+                if (this.isCstgApiForbiddenResponse(xhr)) {
+                  rejectPromise(`Forbidden: ${response.message}`);
+                } else {
+                  // A 403 should always be a forbidden response.
+                  // Something has gone wrong.
+                  rejectPromise(
+                    `API error: Response body was invalid for HTTP status 403: ${xhr.responseText}`
+                  );
+                }
+              } else {
+                rejectPromise(
+                  `API error: Unexpected HTTP status ${xhr.status}: ${error}`
+                );
+              }
+            } catch (_e) {
+              rejectPromise(error);
+            }
+          },
+        },
+        JSON.stringify(requestBody),
+        { method: 'POST' }
+      );
+      return promise;
+    }
   }
-}
 
-async function generateTokenAndStore(baseUrl, cstgOpts, cstgIdentity, clientId, storageManager, _logInfo, _logWarn) {
-  _logInfo('UID2 cstg opts provided: ', JSON.stringify(cstgOpts));
-  const client = new Uid2ApiClient({baseUrl, cstg: cstgOpts}, clientId, _logInfo, _logWarn);
-  const request = await generateCstgRequest(cstgIdentity);
-  const response = await client.callCstgApi(request)
-  _logInfo('CSTG endpoint responded with:', response);
-  const tokens = {
-    originalIdentity: encodeOriginalIdentity(cstgIdentity),
-    latestToken: response.identity,
-  };
-  storageManager.storeValue(tokens);
-  return tokens;
-}
+  class UID2CstgBox {
+    static _namedCurve = 'P-256';
+    constructor(clientPublicKey, sharedKey) {
+      this._clientPublicKey = clientPublicKey;
+      this._sharedKey = sharedKey;
+    }
+
+    static async build(serverPublicKey) {
+      const clientKeyPair = await UID2CstgCrypto.generateKeyPair(
+        UID2CstgBox._namedCurve
+      );
+      const importedServerPublicKey = await UID2CstgCrypto.importPublicKey(
+        serverPublicKey,
+        this._namedCurve
+      );
+      const sharedKey = await UID2CstgCrypto.deriveKey(
+        importedServerPublicKey,
+        clientKeyPair.privateKey
+      );
+      return new UID2CstgBox(clientKeyPair.publicKey, sharedKey);
+    }
 
-function encodeOriginalIdentity(identity) {
-  const identityValue = Object.values(identity)[0];
-  const salt = Math.floor(Math.random() * Math.pow(2, 32));
-  return {
-    identity: cyrb53Hash(identityValue, salt),
-    salt
+    async encrypt(plaintext, additionalData) {
+      const iv = window.crypto.getRandomValues(new Uint8Array(12));
+      const ciphertext = await window.crypto.subtle.encrypt(
+        {
+          name: 'AES-GCM',
+          iv,
+          additionalData,
+        },
+        this._sharedKey,
+        plaintext
+      );
+      return { iv, ciphertext };
+    }
+
+    async decrypt(iv, ciphertext) {
+      return window.crypto.subtle.decrypt(
+        {
+          name: 'AES-GCM',
+          iv,
+        },
+        this._sharedKey,
+        ciphertext
+      );
+    }
+
+    get clientPublicKey() {
+      return this._clientPublicKey;
+    }
   }
-}
 
-function storedTokenFromSameIdentity(storedTokens, identity) {
-  if (!storedTokens.originalIdentity) return false;
-  return cyrb53Hash(identity, storedTokens.originalIdentity.salt) === storedTokens.originalIdentity.identity
+  class UID2CstgCrypto {
+    static base64ToBytes(base64) {
+      const binString = atob(base64);
+      return Uint8Array.from(binString, (m) => m.codePointAt(0));
+    }
+
+    static bytesToBase64(bytes) {
+      const binString = Array.from(bytes, (x) => String.fromCodePoint(x)).join(
+        ''
+      );
+      return btoa(binString);
+    }
+
+    static async generateKeyPair(namedCurve) {
+      const params = {
+        name: 'ECDH',
+        namedCurve: namedCurve,
+      };
+      return window.crypto.subtle.generateKey(params, false, ['deriveKey']);
+    }
+
+    static async importPublicKey(publicKey, namedCurve) {
+      const params = {
+        name: 'ECDH',
+        namedCurve: namedCurve,
+      };
+      return window.crypto.subtle.importKey(
+        'spki',
+        this.base64ToBytes(publicKey),
+        params,
+        false,
+        []
+      );
+    }
+
+    static exportPublicKey(publicKey) {
+      return window.crypto.subtle.exportKey('spki', publicKey);
+    }
+
+    static async deriveKey(serverPublicKey, clientPrivateKey) {
+      return window.crypto.subtle.deriveKey(
+        {
+          name: 'ECDH',
+          public: serverPublicKey,
+        },
+        clientPrivateKey,
+        {
+          name: 'AES-GCM',
+          length: 256,
+        },
+        false,
+        ['encrypt', 'decrypt']
+      );
+    }
+
+    static async hash(value) {
+      const hash = await window.crypto.subtle.digest(
+        'SHA-256',
+        new TextEncoder().encode(value)
+      );
+      return this.bytesToBase64(new Uint8Array(hash));
+    }
+  }
 }
 
 export function Uid2GetId(config, prebidStorageManager, _logInfo, _logWarn) {
   let suppliedToken = null;
-  const cstgIdentity = config.cstg && isCSTGOptions(config.cstg, _logWarn) && getValidIdentity(config.cstg);
   const preferLocalStorage = (config.storage !== 'cookie');
   const storageManager = new Uid2StorageManager(prebidStorageManager, preferLocalStorage, config.internalStorage, _logInfo);
   _logInfo(`Module is using ${preferLocalStorage ? 'local storage' : 'cookies'} for internal storage.`);
 
-  if (cstgIdentity) {
+  const isCstgEnabled =
+  clientSideTokenGenerator &&
+  clientSideTokenGenerator.isCSTGOptionsValid(config.cstg, _logWarn);
+  if (isCstgEnabled) {
     _logInfo(`Module is using client-side token generation.`);
     // Ignores config.paramToken and config.serverCookieName if any is provided
     suppliedToken = null;
@@ -607,7 +689,7 @@ export function Uid2GetId(config, prebidStorageManager, _logInfo, _logWarn) {
   if (storedTokens && typeof storedTokens === 'string') {
     // Stored value is a plain token - if no token is supplied, just use the stored value.
 
-    if (!suppliedToken && !cstgIdentity) {
+    if (!suppliedToken && !isCstgEnabled) {
       _logInfo('Returning legacy cookie value.');
       return { id: storedTokens };
     }
@@ -624,26 +706,26 @@ export function Uid2GetId(config, prebidStorageManager, _logInfo, _logWarn) {
     }
   }
 
-  if (cstgIdentity) {
-    if (storedTokens) {
-      const identity = Object.values(cstgIdentity)[0]
-      if (!storedTokenFromSameIdentity(storedTokens, identity)) {
-        _logInfo('CSTG supplied new identity - ignoring stored value.', storedTokens.originalIdentity, cstgIdentity);
-        // Stored token wasn't originally sourced from the provided identity - ignore the stored value. A new user has logged in?
+  if (FEATURES.UID2_CSTG && isCstgEnabled) {
+    const cstgIdentity = clientSideTokenGenerator.getValidIdentity(config.cstg, _logWarn);
+    if (cstgIdentity) {
+      if (storedTokens && clientSideTokenGenerator.isStoredTokenInvalid(cstgIdentity, storedTokens, _logInfo, _logWarn)) {
         storedTokens = null;
       }
-    }
-    if (!storedTokens || Date.now() > storedTokens.latestToken.refresh_expires) {
-      const promise = generateTokenAndStore(config.apiBaseUrl, config.cstg, cstgIdentity, config.clientId, storageManager, _logInfo, _logWarn);
-      _logInfo('Generate token using CSTG');
-      return { callback: (cb) => {
-        promise.then((result) => {
-          _logInfo('Token generation responded, passing the new token on.', result);
-          cb(result);
-        });
-      } };
+
+      if (!storedTokens || Date.now() > storedTokens.latestToken.refresh_expires) {
+        const promise = clientSideTokenGenerator.generateTokenAndStore(config.apiBaseUrl, config.cstg, cstgIdentity, storageManager, _logInfo, _logWarn);
+        _logInfo('Generate token using CSTG');
+        return { callback: (cb) => {
+          promise.then((result) => {
+            _logInfo('Token generation responded, passing the new token on.', result);
+            cb(result);
+          });
+        } };
+      }
     }
   }
+
   const useSuppliedToken = !(storedTokens?.latestToken) || (suppliedToken && suppliedToken.identity_expires > storedTokens.latestToken.identity_expires);
   const newestAvailableToken = useSuppliedToken ? suppliedToken : storedTokens.latestToken;
   _logInfo('UID2 module selected latest token', useSuppliedToken, newestAvailableToken);
@@ -670,13 +752,9 @@ export function Uid2GetId(config, prebidStorageManager, _logInfo, _logWarn) {
     originalToken: suppliedToken ?? storedTokens?.originalToken,
     latestToken: newestAvailableToken,
   };
-  if (cstgIdentity) tokens.originalIdentity = storedTokens?.originalIdentity
+  if (FEATURES.UID2_CSTG && isCstgEnabled) {
+    tokens.originalIdentity = storedTokens?.originalIdentity;
+  }
   storageManager.storeValue(tokens);
   return { id: tokens };
 }
-
-const SERVER_PUBLIC_KEY_PREFIX_LENGTH = 9;
-
-function stripPublicKeyPrefix(serverPublicKey) {
-  return serverPublicKey.substring(SERVER_PUBLIC_KEY_PREFIX_LENGTH);
-}
diff --git a/package-lock.json b/package-lock.json
index 82d5a79adce..d1ce623a3e2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6,7 +6,7 @@
   "packages": {
     "": {
       "name": "prebid.js",
-      "version": "8.8.0-pre",
+      "version": "8.13.0-pre",
       "license": "Apache-2.0",
       "dependencies": {
         "@babel/core": "^7.16.7",
@@ -6997,9 +6997,9 @@
       "dev": true
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001429",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001429.tgz",
-      "integrity": "sha512-511ThLu1hF+5RRRt0zYCf2U2yRr9GPF6m5y90SBCWsvSoYoW7yAGlv/elyPaNfvGCkp6kj/KFZWU0BMA69Prsg==",
+      "version": "1.0.30001533",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001533.tgz",
+      "integrity": "sha512-9aY/b05NKU4Yl2sbcJhn4A7MsGwR1EPfW/nrqsnqVA0Oq50wpmPaGI+R1Z0UKlUl96oxUkGEOILWtOHck0eCWw==",
       "funding": [
         {
           "type": "opencollective",
@@ -7008,6 +7008,10 @@
         {
           "type": "tidelift",
           "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
         }
       ]
     },
@@ -30653,9 +30657,9 @@
       "dev": true
     },
     "caniuse-lite": {
-      "version": "1.0.30001429",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001429.tgz",
-      "integrity": "sha512-511ThLu1hF+5RRRt0zYCf2U2yRr9GPF6m5y90SBCWsvSoYoW7yAGlv/elyPaNfvGCkp6kj/KFZWU0BMA69Prsg=="
+      "version": "1.0.30001533",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001533.tgz",
+      "integrity": "sha512-9aY/b05NKU4Yl2sbcJhn4A7MsGwR1EPfW/nrqsnqVA0Oq50wpmPaGI+R1Z0UKlUl96oxUkGEOILWtOHck0eCWw=="
     },
     "caseless": {
       "version": "0.12.0",
diff --git a/test/spec/modules/uid2IdSystem_spec.js b/test/spec/modules/uid2IdSystem_spec.js
index 8a45e4cc710..4681dd6f0d8 100644
--- a/test/spec/modules/uid2IdSystem_spec.js
+++ b/test/spec/modules/uid2IdSystem_spec.js
@@ -1,6 +1,6 @@
 /* eslint-disable no-console */
 
-import {coreStorage, init, setSubmoduleRegistry, requestBidsHook} from 'modules/userId/index.js';
+import {coreStorage, init, setSubmoduleRegistry} from 'modules/userId/index.js';
 import {config} from 'src/config.js';
 import * as utils from 'src/utils.js';
 import { uid2IdSubmodule } from 'modules/uid2IdSystem.js';
@@ -359,166 +359,168 @@ describe(`UID2 module`, function () {
     });
   });
 
-  describe('When CSTG config provided', function () {
-    let scenarios = [
-      {
-        name: 'email provided in config',
-        identity: { email: 'test@example.com' },
-        setConfig: function (extraConfig) { config.setConfig(makePrebidConfig({ ...cstgConfigParams, ...this.identity }, extraConfig)) },
-        setInvalidConfig: (extraConfig) => config.setConfig(makePrebidConfig({ ...cstgConfigParams, email: '123' }, extraConfig))
-      },
-      {
-        name: 'phone provided in config',
-        identity: { phone: '+12345678910' },
-        setConfig: function (extraConfig) { config.setConfig(makePrebidConfig({ ...cstgConfigParams, ...this.identity }, extraConfig)) },
-        setInvalidConfig: (extraConfig) => config.setConfig(makePrebidConfig({ ...cstgConfigParams, phone: 'test123' }, extraConfig))
-      },
-      {
-        name: 'email hash provided in config',
-        identity: { email_hash: 'lz3+Rj7IV4X1+Vr1ujkG7tstkxwk5pgkqJ6mXbpOgTs=' },
-        setConfig: function (extraConfig) { config.setConfig(makePrebidConfig({ ...cstgConfigParams, emailHash: this.identity.email_hash }, extraConfig)) },
-        setInvalidConfig: (extraConfig) => config.setConfig(makePrebidConfig({ ...cstgConfigParams, emailHash: 'test@example.com' }, extraConfig))
-      },
-      {
-        name: 'phone hash provided in config',
-        identity: { phone_hash: 'kVJ+4ilhrqm3HZDDnCQy4niZknvCoM4MkoVzZrQSdJw=' },
-        setConfig: function (extraConfig) { config.setConfig(makePrebidConfig({ ...cstgConfigParams, phoneHash: this.identity.phone_hash }, extraConfig)) },
-        setInvalidConfig: (extraConfig) => config.setConfig(makePrebidConfig({ ...cstgConfigParams, phoneHash: '614332222111' }, extraConfig))
-      },
-    ]
-    scenarios.forEach(function(scenario) {
-      describe(`And ${scenario.name}`, function() {
-        describe(`When invalid identity is provided`, function() {
-          it('the auction should have no uid2', async function () {
-            scenario.setInvalidConfig()
-            const bid = await runAuction();
-            expectNoIdentity(bid);
-            expectGlobalToHaveNoUid2();
-            expectModuleStorageEmptyOrMissing();
-          })
-        });
-
-        describe('When valid identity is provided, and the auction is set to run immediately', function() {
-          it('it should ignores token provided in config, and the auction should have no uid2', async function() {
-            scenario.setConfig({ uid2Token: apiHelpers.makeTokenResponse(initialToken), auctionDelay: 0, syncDelay: 1 });
-            const bid = await runAuction();
-            expectNoIdentity(bid);
-            expectGlobalToHaveNoUid2();
-            expectModuleStorageEmptyOrMissing();
-          })
-
-          it('it should ignores token provided in server-set cookie', async function() {
-            cookieHelpers.setPublisherCookie(publisherCookieName, initialToken);
-            scenario.setConfig({ ...newServerCookieConfigParams, auctionDelay: 0, syncDelay: 1 })
-            const bid = await runAuction();
-            expectNoIdentity(bid);
-            expectGlobalToHaveNoUid2();
-            expectModuleStorageEmptyOrMissing();
-          })
+  if (FEATURES.UID2_CSTG) {
+    describe('When CSTG is enabled provided', function () {
+      let scenarios = [
+        {
+          name: 'email provided in config',
+          identity: { email: 'test@example.com' },
+          setConfig: function (extraConfig) { config.setConfig(makePrebidConfig({ ...cstgConfigParams, ...this.identity }, extraConfig)) },
+          setInvalidConfig: (extraConfig) => config.setConfig(makePrebidConfig({ ...cstgConfigParams, email: '123' }, extraConfig))
+        },
+        {
+          name: 'phone provided in config',
+          identity: { phone: '+12345678910' },
+          setConfig: function (extraConfig) { config.setConfig(makePrebidConfig({ ...cstgConfigParams, ...this.identity }, extraConfig)) },
+          setInvalidConfig: (extraConfig) => config.setConfig(makePrebidConfig({ ...cstgConfigParams, phone: 'test123' }, extraConfig))
+        },
+        {
+          name: 'email hash provided in config',
+          identity: { email_hash: 'lz3+Rj7IV4X1+Vr1ujkG7tstkxwk5pgkqJ6mXbpOgTs=' },
+          setConfig: function (extraConfig) { config.setConfig(makePrebidConfig({ ...cstgConfigParams, emailHash: this.identity.email_hash }, extraConfig)) },
+          setInvalidConfig: (extraConfig) => config.setConfig(makePrebidConfig({ ...cstgConfigParams, emailHash: 'test@example.com' }, extraConfig))
+        },
+        {
+          name: 'phone hash provided in config',
+          identity: { phone_hash: 'kVJ+4ilhrqm3HZDDnCQy4niZknvCoM4MkoVzZrQSdJw=' },
+          setConfig: function (extraConfig) { config.setConfig(makePrebidConfig({ ...cstgConfigParams, phoneHash: this.identity.phone_hash }, extraConfig)) },
+          setInvalidConfig: (extraConfig) => config.setConfig(makePrebidConfig({ ...cstgConfigParams, phoneHash: '614332222111' }, extraConfig))
+        },
+      ]
+      scenarios.forEach(function(scenario) {
+        describe(`And ${scenario.name}`, function() {
+          describe(`When invalid identity is provided`, function() {
+            it('the auction should have no uid2', async function () {
+              scenario.setInvalidConfig()
+              const bid = await runAuction();
+              expectNoIdentity(bid);
+              expectGlobalToHaveNoUid2();
+              expectModuleStorageEmptyOrMissing();
+            })
+          });
 
-          describe('When the token generated in time', function() {
-            testApiSuccessAndFailure(async function(apiSucceeds) {
-              scenario.setConfig();
-              apiHelpers.respondAfterDelay(auctionDelayMs / 10, server);
+          describe('When valid identity is provided, and the auction is set to run immediately', function() {
+            it('it should ignores token provided in config, and the auction should have no uid2', async function() {
+              scenario.setConfig({ uid2Token: apiHelpers.makeTokenResponse(initialToken), auctionDelay: 0, syncDelay: 1 });
               const bid = await runAuction();
+              expectNoIdentity(bid);
+              expectGlobalToHaveNoUid2();
+              expectModuleStorageEmptyOrMissing();
+            })
 
-              if (apiSucceeds) expectToken(bid, clientSideGeneratedToken);
-              else expectNoIdentity(bid);
-            }, cstgApiUrl, 'it should be used in the auction', 'the auction should have no uid2', false, clientSideGeneratedToken);
-
-            testApiSuccessAndFailure(async function(apiSucceeds) {
-              scenario.setConfig();
-              apiHelpers.respondAfterDelay(auctionDelayMs / 10, server);
-
-              await runAuction();
-              if (apiSucceeds) {
-                expectModuleStorageToContain(undefined, clientSideGeneratedToken, scenario.identity);
-              } else {
-                expectModuleStorageEmptyOrMissing();
-              }
-            }, cstgApiUrl, 'the generated token should be stored in the module storage', 'the module storage should not be set', false, clientSideGeneratedToken);
+            it('it should ignores token provided in server-set cookie', async function() {
+              cookieHelpers.setPublisherCookie(publisherCookieName, initialToken);
+              scenario.setConfig({ ...newServerCookieConfigParams, auctionDelay: 0, syncDelay: 1 })
+              const bid = await runAuction();
+              expectNoIdentity(bid);
+              expectGlobalToHaveNoUid2();
+              expectModuleStorageEmptyOrMissing();
+            })
+
+            describe('When the token generated in time', function() {
+              testApiSuccessAndFailure(async function(apiSucceeds) {
+                scenario.setConfig();
+                apiHelpers.respondAfterDelay(auctionDelayMs / 10, server);
+                const bid = await runAuction();
+
+                if (apiSucceeds) expectToken(bid, clientSideGeneratedToken);
+                else expectNoIdentity(bid);
+              }, cstgApiUrl, 'it should be used in the auction', 'the auction should have no uid2', false, clientSideGeneratedToken);
+
+              testApiSuccessAndFailure(async function(apiSucceeds) {
+                scenario.setConfig();
+                apiHelpers.respondAfterDelay(auctionDelayMs / 10, server);
+
+                await runAuction();
+                if (apiSucceeds) {
+                  expectModuleStorageToContain(undefined, clientSideGeneratedToken, scenario.identity);
+                } else {
+                  expectModuleStorageEmptyOrMissing();
+                }
+              }, cstgApiUrl, 'the generated token should be stored in the module storage', 'the module storage should not be set', false, clientSideGeneratedToken);
+            });
           });
         });
       });
-    });
-    describe(`when the response doesn't arrive before the auction timer`, function() {
-      testApiSuccessAndFailure(async function() {
-        config.setConfig(makePrebidConfig({ ...cstgConfigParams, email: 'test@test.com' }));
-        const bid = await runAuction();
-        expectNoIdentity(bid);
-      }, cstgApiUrl, 'it should run the auction', undefined, false, clientSideGeneratedToken);
-
-      testApiSuccessAndFailure(async function(apiSucceeds) {
-        config.setConfig(makePrebidConfig({ ...cstgConfigParams, email: 'test@test.com' }));
-        const promise = apiHelpers.respondAfterDelay(auctionDelayMs * 2, server);
+      describe(`when the response doesn't arrive before the auction timer`, function() {
+        testApiSuccessAndFailure(async function() {
+          config.setConfig(makePrebidConfig({ ...cstgConfigParams, email: 'test@test.com' }));
+          const bid = await runAuction();
+          expectNoIdentity(bid);
+        }, cstgApiUrl, 'it should run the auction', undefined, false, clientSideGeneratedToken);
 
-        const bid = await runAuction();
-        expectNoIdentity(bid);
-        expectGlobalToHaveNoUid2();
-        await promise;
-        if (apiSucceeds) expectGlobalToHaveToken(clientSideGeneratedToken);
-        else expectGlobalToHaveNoUid2();
-      }, cstgApiUrl, 'it should update the userId after the auction', 'there should be no global identity', false, clientSideGeneratedToken);
-    })
+        testApiSuccessAndFailure(async function(apiSucceeds) {
+          config.setConfig(makePrebidConfig({ ...cstgConfigParams, email: 'test@test.com' }));
+          const promise = apiHelpers.respondAfterDelay(auctionDelayMs * 2, server);
 
-    describe('when there is a token in the module cookie', function() {
-      describe('when originalIdentity matches', function() {
-        describe('When the storedToken is valid', function() {
-          it('it should use the stored token in the auction', async function() {
-            const refreshedIdentity = apiHelpers.makeTokenResponse(refreshedToken);
-            const moduleCookie = {originalIdentity: makeOriginalIdentity('test@test.com'), latestToken: refreshedIdentity};
-            coreStorage.setCookie(moduleCookieName, JSON.stringify(moduleCookie), cookieHelpers.getFutureCookieExpiry());
-            config.setConfig(makePrebidConfig({ ...cstgConfigParams, email: 'test@test.com', auctionDelay: 0, syncDelay: 1 }));
-            const bid = await runAuction();
-            expectToken(bid, refreshedToken);
-          });
-        })
+          const bid = await runAuction();
+          expectNoIdentity(bid);
+          expectGlobalToHaveNoUid2();
+          await promise;
+          if (apiSucceeds) expectGlobalToHaveToken(clientSideGeneratedToken);
+          else expectGlobalToHaveNoUid2();
+        }, cstgApiUrl, 'it should update the userId after the auction', 'there should be no global identity', false, clientSideGeneratedToken);
+      })
 
-        describe('When the storedToken is expired and can be refreshed ', function() {
-          it('it should calls refresh API', function() {
-            testApiSuccessAndFailure(async function(apiSucceeds) {
-              const refreshedIdentity = apiHelpers.makeTokenResponse(refreshedToken, true, true);
+      describe('when there is a token in the module cookie', function() {
+        describe('when originalIdentity matches', function() {
+          describe('When the storedToken is valid', function() {
+            it('it should use the stored token in the auction', async function() {
+              const refreshedIdentity = apiHelpers.makeTokenResponse(refreshedToken);
               const moduleCookie = {originalIdentity: makeOriginalIdentity('test@test.com'), latestToken: refreshedIdentity};
               coreStorage.setCookie(moduleCookieName, JSON.stringify(moduleCookie), cookieHelpers.getFutureCookieExpiry());
-              config.setConfig(makePrebidConfig({ ...cstgConfigParams, email: 'test@test.com' }));
-              apiHelpers.respondAfterDelay(auctionDelayMs / 10, server);
-
+              config.setConfig(makePrebidConfig({ ...cstgConfigParams, email: 'test@test.com', auctionDelay: 0, syncDelay: 1 }));
               const bid = await runAuction();
+              expectToken(bid, refreshedToken);
+            });
+          })
 
-              if (apiSucceeds) expectToken(bid, refreshedToken);
-              else expectNoIdentity(bid);
-            }, refreshApiUrl, 'it should use refreshed token in the auction', 'the auction should have no uid2');
-          });
-        })
-
-        describe('When the storedToken is expired for refresh', function() {
-          it('it should calls CSTG API and not use the stored token', function() {
-            testApiSuccessAndFailure(async function(apiSucceeds) {
-              const refreshedIdentity = apiHelpers.makeTokenResponse(refreshedToken, true, true, true);
-              const moduleCookie = {originalIdentity: makeOriginalIdentity('test@test.com'), latestToken: refreshedIdentity};
-              coreStorage.setCookie(moduleCookieName, JSON.stringify(moduleCookie), cookieHelpers.getFutureCookieExpiry());
-              config.setConfig(makePrebidConfig({ ...cstgConfigParams, email: 'test@test.com' }));
-              apiHelpers.respondAfterDelay(auctionDelayMs / 10, server);
-
-              const bid = await runAuction();
+          describe('When the storedToken is expired and can be refreshed ', function() {
+            it('it should calls refresh API', function() {
+              testApiSuccessAndFailure(async function(apiSucceeds) {
+                const refreshedIdentity = apiHelpers.makeTokenResponse(refreshedToken, true, true);
+                const moduleCookie = {originalIdentity: makeOriginalIdentity('test@test.com'), latestToken: refreshedIdentity};
+                coreStorage.setCookie(moduleCookieName, JSON.stringify(moduleCookie), cookieHelpers.getFutureCookieExpiry());
+                config.setConfig(makePrebidConfig({ ...cstgConfigParams, email: 'test@test.com' }));
+                apiHelpers.respondAfterDelay(auctionDelayMs / 10, server);
+
+                const bid = await runAuction();
+
+                if (apiSucceeds) expectToken(bid, refreshedToken);
+                else expectNoIdentity(bid);
+              }, refreshApiUrl, 'it should use refreshed token in the auction', 'the auction should have no uid2');
+            });
+          })
 
-              if (apiSucceeds) expectToken(bid, clientSideGeneratedToken);
-              else expectNoIdentity(bid);
-            }, cstgApiUrl, 'it should use generated token in the auction', 'the auction should have no uid2', false, clientSideGeneratedToken);
-          });
+          describe('When the storedToken is expired for refresh', function() {
+            it('it should calls CSTG API and not use the stored token', function() {
+              testApiSuccessAndFailure(async function(apiSucceeds) {
+                const refreshedIdentity = apiHelpers.makeTokenResponse(refreshedToken, true, true, true);
+                const moduleCookie = {originalIdentity: makeOriginalIdentity('test@test.com'), latestToken: refreshedIdentity};
+                coreStorage.setCookie(moduleCookieName, JSON.stringify(moduleCookie), cookieHelpers.getFutureCookieExpiry());
+                config.setConfig(makePrebidConfig({ ...cstgConfigParams, email: 'test@test.com' }));
+                apiHelpers.respondAfterDelay(auctionDelayMs / 10, server);
+
+                const bid = await runAuction();
+
+                if (apiSucceeds) expectToken(bid, clientSideGeneratedToken);
+                else expectNoIdentity(bid);
+              }, cstgApiUrl, 'it should use generated token in the auction', 'the auction should have no uid2', false, clientSideGeneratedToken);
+            });
+          })
         })
-      })
 
-      it('when originalIdentity not match, the auction should has no uid2', async function() {
-        const refreshedIdentity = apiHelpers.makeTokenResponse(refreshedToken);
-        const moduleCookie = {originalIdentity: makeOriginalIdentity('123@test.com'), latestToken: refreshedIdentity};
-        coreStorage.setCookie(moduleCookieName, JSON.stringify(moduleCookie), cookieHelpers.getFutureCookieExpiry());
-        config.setConfig(makePrebidConfig({ ...cstgConfigParams, email: 'test@test.com' }));
-        const bid = await runAuction();
-        expectNoIdentity(bid);
-      });
-    })
-  });
+        it('when originalIdentity not match, the auction should has no uid2', async function() {
+          const refreshedIdentity = apiHelpers.makeTokenResponse(refreshedToken);
+          const moduleCookie = {originalIdentity: makeOriginalIdentity('123@test.com'), latestToken: refreshedIdentity};
+          coreStorage.setCookie(moduleCookieName, JSON.stringify(moduleCookie), cookieHelpers.getFutureCookieExpiry());
+          config.setConfig(makePrebidConfig({ ...cstgConfigParams, email: 'test@test.com' }));
+          const bid = await runAuction();
+          expectNoIdentity(bid);
+        });
+      })
+    });
+  }
 
   describe('When neither token nor CSTG config provided', function () {
     describe('when there is a non-cstg-derived token in the module cookie', function () {