Airbnb Cuts Authentication Code By 60% With Server-Driven Architecture
InfoQ, Friday, September 4th, 2026
Airbnb moved auth decisions from clients to a server policy engine, cutting code 60% and speeding experiments to days.
Airbnb rebuilt its authentication flows around a server-driven architecture in which a backend policy engine, not the client, decides which challenge a user sees.
Reported results include a 60% reduction in authentication code, a 100 KB smaller web bundle, 2.6% more successful authentications, 27% fewer duplicate accounts, and roughly 11% lower OTP costs.
Because strategy lives on the server, Airbnb ran more than 20 experiments in three months and can vary flows by region, such as preferring WhatsApp OTP in Brazil.