Flexible Authentication: Reimagining authentication for millions of users at Airbnb

Airbnb cut duplicate account creation by 27% and raised login success rates by 2.6% across millions of sessions by stripping authentication logic out of its native apps entirely. 👇

For a marketplace like Airbnb, users often log in months apart. A failed login means a lost booking. Over a decade, Airbnb piled on new login methods like social auth, phone numbers, and email OTPs. But logic lived heavily inside client binaries, creating rigid flows, dead ends when a single method failed, and weeks of delay waiting for app store reviews to test fixes.

To solve this, Airbnb rebuilt its system into a server-driven framework called Flexible Authentication. The core shift was moving every routing decision, screen sequence, and fallback option off the client and onto the server.

The system handles logins through a step-by-step server-driven pipeline:

* Identify first: The user enters an identifier like an email address, phone number, or social handle without selecting a login method upfront. * Server policy evaluation: A server-side policy engine checks the session context and account history to pick the challenge most likely to work. For example, it chooses WhatsApp OTP over SMS for a user in Brazil, or Naver login for a host in South Korea. * Thin-client rendering: The server returns a complete screen definition. The iOS, Android, and web apps act purely as thin renderers using auto-generated type definitions from the server schema, keeping clients light and free of flow logic. * Adaptive fallbacks: Every screen includes a "Try another way" button powered by a server-driven Challenge Picker. If the main challenge fails, the server serves a ranked list of alternative methods based on platform capabilities and past successful logins.

Moving flow control to the server allowed Airbnb to clean up client state management, cutting authentication code by 60% and shrinking the web bundle by 100KB.

Because flow changes no longer require app store releases, Airbnb ran over 20 experiments in three months, collapsing iteration times from weeks to days. Leading with the best challenge and offering smooth fallbacks lifted overall authentication success by 2.6%, dropped duplicate account creation by 27%, and cut SMS OTP costs by roughly 11%.