Airbnb has redesigned its authentication architecture to make login flows easier to change across Web, iOS, and Android. The new system moves authentication decisions from clients to a server-side policy engine that selects the most appropriate authentication challenge based on the user and session context. According to Airbnb, the redesign reduced authentication-related code by 60%, reduced the web client bundle by 100 KB, increased successful authentication by 2.6%, and reduced duplicate account creation by 27%.

Airbnb’s Identify-then-Challenge Architecture (Source: Airbnb Blog Post)

The architecture separates authentication into two stages. First, users identify the account they want to access using an email address, phone number, or social login. The server then evaluates account and session information and uses a configurable policy engine to select the challenge most likely to succeed. Other supported methods are returned as fallback options. For example, the system can prefer WhatsApp OTP for a user in Brazil or a regional identity provider for a user in South Korea.

Jose Santos, an engineer at Airbnb, explained the user problem behind the redesign:

People don’t always remember how they created an account months or years ago. They may have changed devices, lost access to a phone number, or be using a different login method in another region. Authentication needs to adapt.

A key architectural change is that clients no longer determine which authentication challenge to present. The server makes that decision, while the client renders the screen the server returns. This allows Airbnb to change authentication strategies by region or experiment without shipping new client code.

Airbnb introduced a server-driven Challenge Picker to help users recover from authentication failures without restarting the flow. Each challenge includes a Try another way option, while the server returns ranked alternatives based on previously successful methods, registered authentication methods, and platform availability.

Server-Driven Authentication Flow (Source: Airbnb Blog Post)

The company extended the server-driven model across signup and login. Identifier entry, authentication challenges, account selection, and error handling are represented as server-defined screens. Web, iOS, and Android clients render these screens and return user actions to the server. Server-side schemas also generate client type definitions and help detect mismatches during development.

Moving authentication flow logic to the server changed Airbnb’s experimentation cycle. The company ran more than 20 experiments during the first three months after launch, with experiments that did not require client changes moving from idea to measured result in days rather than weeks.

The redesign also covered regional authentication methods, returning user flows, loading states, and error handling. According to Airbnb Lead Experience Designer Chloe Fan, an initial minimalist version reduced engagement because it was too easy to dismiss, prompting further experimentation and refinement.

Airbnb reports a 2.6% increase in successful authentication, a 27% reduction in duplicate account creation, and an approximately 11% reduction in OTP costs. The architecture allows Airbnb to continue changing authentication methods and flow logic without embedding those decisions in individual clients.