What is Authentication and Authorization? | Security Concepts Explained

Authentication verifies who you are. Authorization determines what you are allowed to do. Both are required for secure access control, but they are distinct processes that happen in a specific order.

TL;DR Authentication (AuthN) is the process of verifying identity — proving that a user, service, or device is who it claims to be. Authorization (AuthZ) is the process of determining what an authenticated entity is permitted to do. Authentication always happens first. Authorization happens second, after identity is confirmed. In APIs, authentication is typically handled with API keys, JWT, or OAuth 2.0. Authorization is typically handled with role-based or attribute-based access control (RBAC/ABAC).

Authentication vs authorization

Authentication without authorization: you can verify who someone is but not control what they access. Authorization without authentication: you can set access rules but have no way to verify who is making the request.

Both are required. Authentication establishes identity. Authorization enforces access policy based on that identity.

How authentication works

Authentication answers the question: is this entity who they claim to be?

The most common authentication factors:

Multi-factor authentication (MFA) requires two or more factors from different categories. MFA reduces account compromise risk by over 99% compared to passwords alone.

Authentication methods

How authorization works

Authorization answers: what is this authenticated entity allowed to do?

After authentication confirms identity, the system checks whether that identity has permission to perform the requested action on the requested resource.

Role-Based Access Control (RBAC)

Users are assigned roles. Roles have permissions. Permissions are checked against the requested action.

User: maria@company.com
Role: admin
Permissions: read, write, delete

User: joao@company.com
Role: viewer
Permissions: read

RBAC is simple to implement and audit. It works well when permissions map cleanly to job functions.

Attribute-Based Access Control (ABAC)

Permissions are determined by evaluating attributes of the user, resource, action, and environment at the time of the request.

Allow if:
  user.department == resource.department
  AND user.clearance_level >= resource.classification
  AND request.time is within business_hours

ABAC is more flexible than RBAC and handles complex, context-sensitive policies. It is more complex to implement and audit.

Access Control Lists (ACLs)

A list of users or groups and their specific permissions on a resource. Common in file systems and network security.

Authentication in APIs

APIs use stateless authentication — the server does not maintain session state between requests.

Common API authentication patterns:

The standard HTTP response codes for access control failures:

• 401 Unauthorized — Authentication failed or missing. The client must authenticate.
• 403 Forbidden — Authentication succeeded but the client lacks permission. Changing credentials won’t help.

Single Sign-On (SSO) and federated identity

SSO allows a user to authenticate once and access multiple applications without re-entering credentials.

How SSO works:

1. User tries to access Application A.
2. Application A redirects the user to the Identity Provider (IdP).
3. User authenticates with the IdP (once).
4. IdP issues an identity token (SAML assertion or OIDC ID token).
5. Application A validates the token and grants access.
6. User accesses Application B — which also trusts the same IdP — without re-authenticating.

Common SSO protocols:

• SAML 2.0 — XML-based; common in enterprise environments.
• OpenID Connect (OIDC) — JSON/JWT-based; built on OAuth 2.0; common in modern applications and social login.

Best practices

Authentication:

• Store passwords hashed with bcrypt, Argon2, or scrypt — never plaintext or MD5/SHA1.
• Enforce MFA for all user accounts, especially privileged ones.
• Use short-lived tokens (JWT access tokens: 5–60 minutes).
• Implement account lockout after repeated failed attempts.
• Use HTTPS for all authentication traffic — never transmit credentials over HTTP.

Authorization:

• Apply principle of least privilege: grant only the permissions required for the task.
• Validate authorization server-side — never trust client-supplied role or permission claims.
• Log all authorization decisions for audit trails.
• Review and rotate API keys and tokens regularly.
• Fail closed: deny by default; grant access explicitly.

Frequently asked questions

What is the difference between authentication and authorization? Authentication verifies identity — it answers “who are you?” Authorization verifies permissions — it answers “what are you allowed to do?” Authentication always happens first. A 401 HTTP response means authentication failed. A 403 means authentication succeeded but authorization failed.

What does “401 Unauthorized” actually mean? Despite the name, 401 Unauthorized means the request is unauthenticated — the client has not provided valid credentials or none at all. It’s a naming inconsistency in the HTTP spec. 403 Forbidden means the client is authenticated but lacks permission.

What is OAuth 2.0? OAuth 2.0 is an authorization framework that allows one application to access resources on behalf of a user in another application, without the user sharing their password. For example, “Login with Google” uses OAuth 2.0 to grant the app access to your Google profile without giving it your Google password.

What is the difference between OAuth 2.0 and OpenID Connect? OAuth 2.0 handles authorization — it issues access tokens that allow an app to access resources. OpenID Connect (OIDC) adds identity on top of OAuth 2.0 — it issues ID tokens that prove who the user is. OIDC is used for authentication (SSO, social login). OAuth 2.0 is used for authorization (API access delegation).

What is RBAC? RBAC (Role-Based Access Control) is an authorization model where users are assigned roles and roles have defined permissions. A user with the role “editor” can read and write; a user with the role “viewer” can only read. RBAC is simple to understand and audit, making it the most common authorization model in enterprise applications.

What is MFA and why does it matter? MFA (Multi-Factor Authentication) requires users to verify their identity using two or more independent factors — for example, a password plus a TOTP code from an authenticator app. Even if an attacker steals a password, they cannot authenticate without the second factor. MFA reduces account compromise risk by over 99%.

What is the difference between session-based and token-based authentication? In session-based authentication, the server stores session data and gives the client a session ID (usually in a cookie). Each request looks up the session on the server. In token-based authentication (JWT), the server issues a signed token containing all necessary claims. The client sends the token with each request; the server verifies the signature without any database lookup — enabling stateless, horizontally scalable authentication.

What is a passkey? A passkey is a cryptographic key pair generated on your device (phone, computer). The private key never leaves your device. When you authenticate, the device uses the private key to sign a challenge from the server. The server verifies with the public key. Passkeys are phishing-resistant (no password to steal or type) and the primary implementation of WebAuthn.