KOEN
Read Original
#Backend

Flexible Authentication: Reimagining authentication for millions of users at Airbnb

Flexible Authentication: Reimagining authentication for millions of users at Airbnb
01

Summary

Stopping Revenue Leaks at Login: How Airbnb Reengineered Authentication with a Server-Driven Architecture

Inside the 'Identify First then Challenge' model that cut client code by 60% and boosted login success by 2.6%

Airbnb faced structural challenges with global user log-ins due to infrequent usage and regional preference differences. This article details Airbnb's journey of dismantling a heavy client-side architecture in favor of 'Flexible Authentication'—a server-driven UI (SDUI) system powered by a centralized policy engine that delivers tailored login experiences in real-time.

  • 01Eliminated client state complexity to achieve 60% code reduction and saved 100KB in web bundle size
  • 02Implemented a server-side Policy Engine to dynamically offer optimal region-specific login options like WhatsApp in Brazil or Naver in South Korea
  • 03Deployed the 'Challenge Picker' to completely wipe out dead-end flows and slash duplicate account creation by 27%
  • 04Utilized server-side schemas with auto-generated code to guarantee strict type safety across Web, iOS, and Android clients
  • 05Accelerated experimentation velocity from weeks to days, running over 20 login experiments in the first three months

RECOMMENDATION

Highly recommended for platform and product engineering teams looking to seamlessly support diverse global authentication methods and rapidly test onboarding flows without waiting for app store rollouts.

The Problem

Airbnb's legacy authentication system had organically grown over a decade, distributing complex business logic across clients and causing duplicate accounts and user drop-offs due to the lack of seamless fallback options. It also suffered from slow experimentation cycles because new features and regional optimizations had to wait for full mobile app release cycles.

The Solution

They established a new 'Identify first then Challenge' model where the user inputs identity details first, and a server-side policy engine evaluates the context to determine the best challenge. They transitioned to a fully server-driven UI where every screen is the unit of abstraction and implemented a 'Challenge Picker' that serves contextual alternative login methods dynamically.

The Result

Shifting business logic to the server eliminated 60% of client-side code and reduced the web bundle size by 100KB, allowing engineers to shorten experiment turnaround times from weeks to days. As a result, login success rate increased by 2.6%, duplicate account rates fell by 27%, and OTP expenses were reduced by roughly 11%.

Trade-off

Concentrating all routing and authentication logic onto the server raises the complexity and compute load of the server-side policy engine. Additionally, every step transition now requires a network round-trip, which may negatively impact UI responsiveness under poor network conditions, and demands strict API contract management between server-side schemas and clients.

03

Key Concepts

Concept · 01

Server-Driven UI (SDUI)

An architectural pattern where the server dictates the layout, structure, and navigation of the client application dynamically via API responses, keeping the client as a lean, thin renderer.

  • Structured the authentication sequence (identifiers, challenges, pickers) entirely through server-defined screen abstractions.
  • Allowed immediate updates to login behaviors and UI layouts across Web, iOS, and Android simultaneously without submitting binary builds.
Concept · 02

Identify First then Challenge

An authentication approach where a user provides their identifier first, and the backend engine dynamically decides the most appropriate verification challenge based on user context and historical data.

  • Removed the challenge-selection decision from the client and handed complete authority to the server's policy engine.
  • Drove localized experiences, such as steering Brazilian users to WhatsApp OTP instead of standard SMS due to higher regional adoption.
Concept · 03

Challenge Picker

A dynamic server-driven component that presents alternative authentication methods to the user when they fail or cannot use their primary verification challenge.

  • Integrated a 'Try another way' alternative selection to guarantee that every authentication screen provides an escape path.
  • Ranked secondary methods contextually based on user history, registered options, and platform capabilities.