This paper shows point identification in first-price auction models with risk aversion and unobserved auction heterogeneity by exploiting multiple bids from each auction and variation in the number of bidders. The required exclusion restriction is shown to be consistent with a large class of entry models. If the exclusion restriction is violated, but weaker restrictions hold instead, the same identification strategy still yields valid bounds for the primitives. We propose a sieve maximum likelihood estimator. A series of Monte Carlo experiments illustrate that the estimator performs well in finite samples and that ignoring unobserved auction heterogeneity can lead to a significant bias in risk-aversion estimates. In an application to U.S. Forest Service timber auctions we find that the bidders are risk neutral, but we would reject risk neutrality without accounting for unobserved auction heterogeneity.