Flexible Authentication: Airbnb Redesigns Authentication for Millions of Users

Airbnb completely redesigned its authentication system to seamlessly support guests and hosts who log in infrequently. The existing flow, which had become complex after the addition of social login, Email OTP, and phone number authentication over 10 years, was unified under a new paradigm called Flexible Authentication.

The core is the Identify first then Challenge model. When a user first identifies their account via email, phone number, or social login, the server's policy engine selects the authentication method with the highest probability of success based on user, account, region, platform, and past authentication history.

• For phone number registrants in Brazil, WhatsApp OTP is prioritized over SMS
• For returning hosts in Korea, Naver login is prioritized over Google ID
• Alternative methods with high success probability are provided alongside the default authentication method

The server, not the client, decides the authentication method. Since the client renders the screens delivered by the server, Airbnb can adjust and experiment with region-specific authentication strategies without app updates.

All authentication screens also provide a Try another way option. A server-driven component called Challenge Picker was built so that users who forget their password or do not receive SMS can switch to other authentication methods registered to their account without restarting the flow from the beginning.

Additionally, by transitioning the authentication experience to a server-driven approach, a foundation was established to experiment with login improvements without being bound by client release cycles.