# Flexible Authentication: Reimagining authentication for millions of users at Airbnb

DevFeed: [Flexible Authentication: Reimagining authentication for millions of users at Airbnb](<https://devfeed.tech/articles/flexible-authentication-reimagining-authentication-for-millions-of-users-at-airbnb-1216.md>)

Original publisher: [Read original article](<https://medium.com/airbnb-engineering/flexible-authentication-reimagining-authentication-for-millions-of-users-at-airbnb-3a8a4c917137?source=rss----53c7c27702d5---4>)

Author: Jose Santos

Published: 2026-08-12T17:01:04Z

Content type: article

Language: en

Sources: [The Airbnb Tech Blog - Medium](<https://devfeed.tech/sources/the-airbnb-tech-blog-medium.md>)

Topics: [Authentication](<https://devfeed.tech/topics/authentication.md>), [App](<https://devfeed.tech/topics/app.md>)

Tags: [app](<https://devfeed.tech/tags/app.md>), [architecture](<https://devfeed.tech/tags/architecture.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [blog](<https://devfeed.tech/tags/blog.md>), [brazil](<https://devfeed.tech/tags/brazil.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [identity](<https://devfeed.tech/tags/identity.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [product-intuition](<https://devfeed.tech/tags/product-intuition.md>), [revenue](<https://devfeed.tech/tags/revenue.md>), [software-architecture](<https://devfeed.tech/tags/software-architecture.md>), [software-engineering](<https://devfeed.tech/tags/software-engineering.md>), [technology](<https://devfeed.tech/tags/technology.md>), [whatsapp](<https://devfeed.tech/tags/whatsapp.md>)

## AI overview

Airbnb describes Flexible Authentication, a redesign of login and signup for users with varied session patterns, devices, and login methods. Its central model identifies the user first and then selects the verification challenge best suited to the person and context, such as WhatsApp OTP or a regional identity provider.

## Source excerpt

Rebuilding login and signup surfaced product insights, not just technical challenges. Here's how we designed Flexible Authentication at the intersection of product intuition and technical architecture. By: Jose Santos, Mike Barry For Airbnb, logins at irregular intervals are normal. A guest books a trip in January and may not open the app again until summer. A host checks back only when a reservation comes in, and may be busy with other activities when it does. For a two-sided marketplace where a failed login means a lost booking, and lost revenue for both the guest and the host, long gaps between sessions are a structural challenge, not an edge case. Our authentication system had grown organically over a decade, adding new login methods like Social Login, Email OTP, and Phone over time. We recognized that our users have diverse needs: many, such as hosts, use Airbnb daily, while others visit less frequently, when they are planning trips or traveling. To provide a seamless experience, we needed to ensure we were doing a great job supporting all of these usage patterns, helping users pick up exactly where they left off, regardless of how much time had passed or which device they were using. In this blog post, we'll walk through how we rebuilt Airbnb's authentication flows using a new paradigm we call Flexible Authentication, and how each architectural decision was guided by insights into the user's experience. Identify first then Challenge The 'Identify first then Challenge' model was the product insight that reframed the project. Our old system treated authentication as a single question: can this person prove who they are? The real question is more nuanced: given the multiple aspects of the user session, what's the easiest way for them to verify it? A traveler in Brazil who registered with a phone number is better served by a WhatsApp one-time password (OTP) than by SMS, since WhatsApp penetration far exceeds SMS in this market. A returning host in South Korea is b