Airbnb Cuts Authentication Code by 60% with Server Driven Architecture

Airbnb has redesigned its authentication system to make login flows more adaptable across web, iOS, and Android platforms. The new server-driven architecture moves authentication decisions from clients to a server-side policy engine, selecting the most appropriate challenge based on user and session context. This change reduces authentication-related code by 60%, shrinks the web client bundle by 100 KB, boosts successful authentication by 2.6%, and lowers duplicate account creation by 27%.

The architecture, called Identify-then-Challenge, separates authentication into two stages. Initially, users provide an email, phone number, or social login to identify their account. The server then assesses account and session data, employing a configurable policy engine to choose the most likely successful challenge. Fallback options are offered as alternatives. For instance, the system may prefer WhatsApp OTP for Brazilian users or a regional identity provider for those in South Korea.

A significant architectural shift occurs as clients no longer determine the authentication challenge to present. The server makes this decision, while the client renders the resulting screen. This allows Airbnb to modify authentication strategies by region or experiment without releasing new client code. The company introduced a Challenge Picker to aid users in recovering from authentication failures without restarting the flow.

Each challenge includes a "Try another way" option, while the server returns ranked alternatives based on previous successes, registered methods, and platform availability.

Airbnb extended the server-driven model to signups, with identifier entry, authentication challenges, account selection, and error handling all represented as server-defined screens. Web, iOS, and Android clients render these screens and report user actions back to the server. Server-side schemas generate client type definitions and help detect mismatches during development.

This shift to server-side authentication logic has altered Airbnb's experimentation cycle. Within the first three months, the company ran over 20 experiments, with those not requiring client changes moving from concept to measured results in days rather than weeks. The redesign also encompassed regional authentication methods, user flows for returns, loading states, and error handling.

Airbnb's Lead Experience Designer, Chloe Fan, noted that an initial minimalist version reduced engagement due to its ease of dismissal, prompting further experimentation and refinement.

The redesign has yielded several benefits: a 2.6% increase in successful authentication, a 27% reduction in duplicate account creation, and an estimated 11% decrease in OTP costs. The server-driven architecture enables Airbnb to continuously modify authentication methods and flow logic without embedding these decisions in individual clients.