Airbnb Reduces Authentication Code by 60% with Server-Driven Architecture

New Server-Driven Authentication System

Airbnb has implemented a new server-driven architecture for its authentication processes across Web, iOS, and Android platforms. This redesign shifts the responsibility for authentication decisions from individual client applications to a centralized server-side policy engine. The server now selects the most appropriate authentication challenge based on user and session context.

Operational Improvements and User Experience

The new system has resulted in significant operational improvements for Airbnb. The company reported a 60% reduction in authentication-related code and a 100 KB decrease in the web client bundle size. User experience metrics also improved, with a 2.6% increase in successful authentications and a 27% reduction in duplicate account creations. This approach addresses issues where users might forget their original sign-up method or change devices.

Architecture and Flexibility

The architecture separates authentication into an identification stage, where users provide an account identifier, and a challenge stage, where the server determines the best authentication method. This allows for dynamic adaptation of authentication strategies, such as preferring WhatsApp OTP in Brazil or a regional identity provider in South Korea, without requiring client-side code updates. Clients render screens defined by the server and send user actions back.

Enhanced Recovery and Signup Flows

Airbnb also introduced a server-driven Challenge Picker to assist users in recovering from authentication failures. This feature provides a 'Try another way' option, with the server offering ranked alternative methods based on past successes, registered methods, and platform availability. The server-driven model extends to signup and login flows, where identifier entry, challenges, account selection, and error handling are all managed through server-defined screens.