Skip to content

CONCEPT Cited by 1 source

Identify first, then challenge

Definition

Identify-first-then-challenge is a two-stage authentication model that splits login into (1) an identify stage, where the user states who they are using any method they choose (email, phone number, social login), and (2) a challenge stage, where — now that the target account is known — the system selects the verification challenge most likely to succeed for that specific account and context.

It reframes the authentication question from the traditional "can this person prove who they are?" (a single monolithic step) to "given who this account belongs to and the current context, what is the easiest way for them to verify?" (Source: sources/2026-08-12-airbnb-flexible-authentication)

Why the split matters

Knowing the account before choosing a challenge is the key unlock: the system can pick a challenge from what that account has registered and previously succeeded with, rather than presenting a hard-coded default. The right challenge is a function of the person and their context:

  • A traveler in Brazil who registered with a phone number is better served by a WhatsApp OTP than SMS (WhatsApp penetration far exceeds SMS there).
  • A returning host in South Korea is better served by their Naver login than a Google ID (Naver is the leading local identity provider).

The choice is made by a configurable policy engine that can consume all available session/account signals, including history.

Consequences

  • Pairs naturally with fallbacks. Because the account is known, the system can rank all of that account's usable methods, which is exactly what the Challenge Picker needs.
  • Pairs naturally with server-driven UI. The challenge decision is a server responsibility, so the client renders whatever challenge screen it is handed (patterns/server-decides-client-renders).
  • Improves outcomes. Leading with the most-likely-to-succeed challenge (instead of a hard-coded one) reduces time-to-login and lifts authentication-success rate; at Airbnb this contributed to a +2.6% success lift and a 27% reduction in duplicate accounts (fewer users give up and create a new account).

Contrast

  • Monolithic "prove it" login — one method decided up front (often client-side), no account context, dead-ends on failure. The legacy Airbnb stack behaved this way: a failed SMS forced the user back to re-enter an email to try password login.
  • Identify-first-then-challenge — account context first, then the best-fit challenge, with ranked fallbacks always in reach.

Seen in

Last updated · 623 distilled / 1,987 read