Overview
Authentication (AuthN) confirms who a user or system claims to be, typically through credentials like passwords, biometrics, or tokens. Authorization (AuthZ) determines what an already-authenticated identity is permitted to do or access. The two are sequential and often conflated, but security bugs frequently trace back to confusing one for the other — e.g., checking that a user is logged in without checking they’re allowed to see a specific resource.
Comparison Diagram
Comparison Table
| Aspect | Authentication | Authorization |
|---|---|---|
| Question answered | Who are you? | What are you allowed to do? |
| Occurs when | At login, before any access is granted | After authentication, on every protected action or resource |
| Input | Credentials — password, biometric, hardware key, OTP | Verified identity plus roles, scopes, or attributes |
| Output | A confirmed identity (session, JWT, ID token) | An allow/deny decision |
| Failure response | 401 Unauthorized | 403 Forbidden |
| Common mechanisms | Passwords, MFA, WebAuthn/passkeys, SSO | RBAC, ABAC, ACLs, OAuth 2.0 scopes |
| Relevant standards | OpenID Connect, SAML, WebAuthn | OAuth 2.0, XACML, policy engines (e.g. OPA) |
| Enforced by | Identity provider or login boundary | Application logic, API gateway, or policy engine |
Key Differences
- Authorization always presumes authentication already happened — you can’t check permissions for an identity you haven’t verified.
- 401 vs 403 encode the distinction directly: 401 means ‘we don’t know who you are,’ 403 means ‘we know, but you can’t do that.’
- Authentication is typically a one-time event per session; authorization is re-evaluated on every sensitive request or resource access.
- OAuth 2.0 is an authorization framework, not an authentication protocol — OpenID Connect layers identity verification on top of it, a distinction frequently misunderstood in practice.
When to Use Each
Authentication
- Hardening Login Flows: Authentication is the layer to strengthen when the goal is proving identity through passwords, biometrics, or hardware keys.
- Adding Multi-Factor Authentication: Layering in MFA improves how credentials are verified, entirely on the authentication side, before any access decision is made.
- Integrating SSO or OpenID Connect: Centralizing identity verification across multiple applications is an authentication concern, built on standards like OpenID Connect and SAML.
Authorization
- Designing RBAC/ABAC Models: Once identity is confirmed, deciding what a role or attribute set can do is purely an authorization problem.
- Scoping OAuth 2.0 API Access: OAuth 2.0 is an authorization framework, making it the right tool for limiting what a token holder can do, not verifying who they are.
- Enforcing Per-Resource Permission Checks: Authorization is re-evaluated on every sensitive request, so it’s the layer to address when a specific resource needs protection beyond the initial login.