How Trade Me modernized authentication for millions of customers, deployed in under six weeks

New Zealand's largest marketplace layered intelligent step-up authentication on top of Duende IdentityServer with Authsignal, and has since moved into passkey deployment.

Trade Me

Trade Me is New Zealand's largest online marketplace, connecting millions of Kiwis to buy and sell everything from cars and property to everyday household items. As the country's most trusted trading platform, Trade Me handles thousands of transactions daily across a diverse and active user base.

Operating at that scale means authentication decisions affect a very large number of people. The Trade Me team took a proactive approach to modernising their authentication layer, looking for a solution that would strengthen protections for customers while keeping the marketplace experience seamless.

The approach

Trade Me's engineering team wanted to add intelligent, risk-based step-up authentication without replacing or migrating the existing identity infrastructure. The platform runs on Duende IdentityServer, and the goal was to layer modern authentication capabilities on top of what was already in place.

Rather than divert engineering resources into building and maintaining a custom solution, the team chose to partner with Authsignal. The decision came down to speed, flexibility, and the ability to move forward without pulling the engineering team away from core platform work.

"By partnering with Authsignal, we were able to add intelligent authentication to our existing stack without diverting engineering resources from our core product roadmap. It gave us the flexibility to move fast. Authsignal handles the complexity of authentication so we didn't have to build and maintain it ourselves.” 

- Jan Eichmann, Lead Software Engineer, Trade Me

The implementation

Trade Me integrated Authsignal with their existing Duende IdentityServer. A working prototype was operational within days of the initial demo, and full production deployment followed in under six weeks.

Clear documentation and a direct Slack-based support channel meant Trade Me's engineering team could move at pace, get answers in real time, and maintain momentum from day one.

"Trade Me's team moved quickly from concept to production. It's common for our customers to be surprised by how fast they can stand up a working POC. The clear documentation and direct Slack support channel mean teams can resolve questions immediately and maintain momentum throughout implementation."

- Paul Bickley, Director of Commercial & Growth, Authsignal

‍

The team took a phased approach to rollout, establishing baseline metrics before introducing Email OTP authentication on every new device. This allowed Trade Me to measure impact at each stage and manage the transition carefully across a diverse user base before scaling further.

Throughout the transition, the experience for Trade Me's members remained seamless. The step-up challenges only appeared in moments where they made sense, such as higher-risk moments, so the vast majority of sessions were unaffected.

The result was a modern authentication layer running on top of the existing identity stack, live in weeks rather than months, with the engineering team free to stay focused on the platform.

The outcomes

The phased approach meant Trade Me could validate the impact of each change before scaling further, giving the team confidence that the experience for legitimate users remained seamless throughout the rollout.

"The phased approach gave us confidence at every stage. We could measure the impact, adjust where needed, and scale knowing we had a clear picture of how the rollout was landing across our user base."

- Meridy Green, Technical Product Owner, Trade Me

What's next

Building on the authentication foundation already in place, Trade Me has expanded their verification options with SMS and WhatsApp as additional channels, giving users more choice in how they authenticate.

Most recently, Trade Me has moved into the deployment of passkeys, the phishing-resistant authentication standard that replaces traditional passwords with a faster, more secure login experience. It's a natural next step for a platform that has consistently invested in staying ahead of the curve on customer experience and protection.

"Trade Me is a great example of what happens when a platform team thinks ahead. They started with intelligent step-up authentication, proved it at scale, and now they're deploying passkeys. That's the kind of progressive approach that sets the standard for the region."

- Paul Bickley, Director of Commercial & Growth, Authsignal