Flexible Authentication: Reimagining authentication for millions of users at Airbnb

Summary

Airbnb overhauled its login and registration architecture by transitioning to a server-driven framework called Flexible Authentication. The new system separates user identification from verification, using a backend policy engine to dynamically serve the optimal auth challenge and fallback options based on regional and user context. This shift eliminated dead ends, reduced client bundle sizes, and dramatically sped up experimentation velocity across Web, iOS, and Android.

Takeaways

1. 1

   Adopting an 'Identify first then Challenge' model lets a server-side policy engine pick the most context-appropriate verification method, such as WhatsApp in Brazil or Naver in South Korea.

2. 2

   Transitioning to fully server-driven UI screens reduced client authentication code by 60%, cut 100KB from the web bundle, and shortened experiment rollout cycles from weeks to days.

3. 3

   Always providing a server-ranked fallback list ('Try another way') eliminated auth dead ends, increasing successful logins by 2.6% and reducing duplicate account creation by 27%.