Flexible Authentication: Reimagining authentication for millions of users at Airbnb

Summary

Airbnb overhauled its login and registration architecture by transitioning to a server-driven framework called Flexible Authentication. The new system separates user identification from verification, using a backend policy engine to dynamically serve the optimal auth challenge and fallback options based on regional and user context. This shift eliminated dead ends, reduced client bundle sizes, and dramatically sped up experimentation velocity across Web, iOS, and Android.

Takeaways

• Adopting an 'Identify first then Challenge' model lets a server-side policy engine pick the most context-appropriate verification method, such as WhatsApp in Brazil or Naver in South Korea.
• Transitioning to fully server-driven UI screens reduced client authentication code by 60%, cut 100KB from the web bundle, and shortened experiment rollout cycles from weeks to days.
• Always providing a server-ranked fallback list ('Try another way') eliminated auth dead ends, increasing successful logins by 2.6% and reducing duplicate account creation by 27%.

Related reading

• Airbnb · Jun 9, 2026

  Scaling beyond one: How Airbnb evolved its data architecture for a multi-product world

  To support its expansion from Homes into Experiences and Services, Airbnb evolved its offline data warehouse architecture to balance domain-specific needs with organizational consistency. Rather than enforcing a single global pattern, data teams adopted a framework of foundational principles that paired separate data models for unique product features with monolithic models for cross-cutting domains like payments and messaging.

  Patrick Lam

• Airbnb · May 19, 2026

  Scaling Airbnb’s identity graph with a unified knowledge graph infrastructure

  Airbnb migrated its massive identity graph from a third-party graph database vendor to a unified, in-house knowledge graph platform to solve long-tail latency and scaling bottlenecks. Built on JanusGraph with AWS DynamoDB for persistence and OpenSearch for indexing, the new architecture decouples storage operations from graph traversal logic. The migration improved P99 query latency, eliminated routine instance reboots, and supported a tenfold increase in write throughput.

  Lucen Zhao

• Airbnb · Jun 4, 2026

  Sitar-agent: Building a reliable dynamic configuration sidecar at scale

  Airbnb modernized sitar-agent, a Kubernetes sidecar that delivers dynamic configuration updates to thousands of polyglot service instances without requiring redeployments. The architecture uses periodic AWS S3 snapshots to enable fast, decoupled pod startups and maintains local file-based storage for the main container to read configs with in-memory caching. Key design decisions include retaining an isolated sidecar over an in-process library and optimizing pull-based polling with server-side caching.

  Bo Teng

• Airbnb · Aug 25, 2026

  Project Lighthouse — Part 3: Introducing project-lighthouse-anonymize

  Airbnb has open-sourced project-lighthouse-anonymize, a Python library powering their privacy-preserving anonymization used to measure user experience disparities. The release is accompanied by technical papers detailing Core Mondrian, an extended partition-based anonymization algorithm, alongside a framework for measuring anonymized data quality. The library enforces k-anonymity and p-sensitive k-anonymity while offering built-in data quality metrics.

  Adam Bloomston