Authentication vs. Authorization

Authentication verifies which identity is making a request; authorization decides whether that identity may perform the requested action on the requested resource. A system can verify a claimed identity by checking a password, one-time code, certificate, or another authenticator. It usually carries that result forward in a server-side session or a validated token.

Suppose Alice signs in to a document service. Successful authentication means the service has verified the caller as Alice. Authorization must still decide whether Alice may read document 42, edit it, or delete it. That decision can use roles, permissions, ownership, tenant, or other policy inputs. Being logged in is not a blanket grant, and public resources may be accessible without authentication.

In a backend, authenticate the caller before trusting identity claims, then enforce authorization on every protected request for the specific action and resource. Hiding an admin button can improve the UI, but it is not access control; the API must reject an unauthorized action. The shorthand is AuthN for identity and AuthZ for permission. Bad authentication can let someone impersonate an identity, while bad authorization can let a known identity do too much.