Overview
Authentication (AuthN) confirms who a user or system claims to be, typically through credentials like passwords, biometrics, or tokens. Authorization (AuthZ) determines what an already-authenticated identity is permitted to do or access. The two are sequential and often conflated, but security bugs frequently trace back to confusing one for the other — e.g., checking that a user is logged in without checking they’re allowed to see a specific resource.
Comparison Diagram
Comparison Table
| Aspect | Authentication | Authorization |
|---|---|---|
| Question answered | Who are you? | What are you allowed to do? |
| Occurs when | At login, before any access is granted | After authentication, on every protected action or resource |
| Input | Credentials — password, biometric, hardware key, OTP | Verified identity plus roles, scopes, or attributes |
| Output | A confirmed identity (session, JWT, ID token) | An allow/deny decision |
| Failure response | 401 Unauthorized | 403 Forbidden |
| Common mechanisms | Passwords, MFA, WebAuthn/passkeys, SSO | RBAC, ABAC, ACLs, OAuth 2.0 scopes |
| Relevant standards | OpenID Connect, SAML, WebAuthn | OAuth 2.0, XACML, policy engines (e.g. OPA) |
| Enforced by | Identity provider or login boundary | Application logic, API gateway, or policy engine |
Key Differences
- Authorization always presumes authentication already happened — you can’t check permissions for an identity you haven’t verified.
- 401 vs 403 encode the distinction directly: 401 means ‘we don’t know who you are,’ 403 means ‘we know, but you can’t do that.’
- Authentication is typically a one-time event per session; authorization is re-evaluated on every sensitive request or resource access.
- OAuth 2.0 is an authorization framework, not an authentication protocol — OpenID Connect layers identity verification on top of it, a distinction frequently misunderstood in practice.
When to Use Each
Authentication — Focus on authentication when the problem is proving identity — building or hardening login flows, adding MFA, or integrating SSO/OpenID Connect.
Authorization — Focus on authorization when the problem is controlling access after identity is known — designing RBAC/ABAC models, API scopes, or per-resource permission checks.