Authentication vs Authorization

In API security discussions, you will often hear strictly about "AuthN" and "AuthZ". While they sound similar and are often used together, they solve two completely different problems. Understanding the distinction is the first step to securing an API.

Authentication (AuthN): "Who are you?"

Authentication is the process of verifying the identity of a user, device, or system. It answers the question: Is this entity who they claim to be?

Common Authentication Factors

Something you know: Password, PIN, Security Question.

Something you have: Phone (SMS code), Hardware Key, Smartphone (Authenticator app).

Something you are: Fingerprint, Face ID, Retina scan.

In APIs

In the context of APIs, authentication usually happens once (e.g., exchanging a username/password for a token) or via API Keys.

Example: The client sends a specific API Key in the header x-api-key: 12345. The server checks its database: "Does key 12345 exist? Yes, it belongs to Alice." -> Alice is Authenticated.

Authorization (AuthZ): "What can you do?"

Authorization is the process of determining what permissions an authenticated identity has. It answers the question: Is this user allowed to perform this specific action on this specific resource?

Authorization always happens after successful authentication.

In APIs

Example: Alice is authenticated (we know it's her). She tries to DELETE /users/bob.

The server checks permissions: "Is Alice an Admin? No. Does Alice own the resource 'bob'? No."

Result: 403 Forbidden. Alice is identified, but not authorized.

Comparison Table

Feature	Authentication (AuthN)	Authorization (AuthZ)
Question	Who are you?	What are you allowed to do?
Timing	Comes first.	Comes after authentication.
Mechanism	Passwords, Biometrics, API Keys.	Permissions, Roles, Scopes, Policies.
Failure Code	`401 Unauthorized`	`403 Forbidden`
Data Standard	OpenID Connect (OIDC), SAML.	OAuth 2.0 (Scopes).

Real-World Analogy: The Hotel

Authentication: You walk to the front desk and show your ID and credit card. The receptionist confirms you are who you say you are and gives you a key card.

Authorization: You take the key card to the elevator.

You tap it for the Penthouse suite (Action). It works (Permitted).

You tap it for the Staff Only room (Action). It beeps red (Denied).

The key card knows who you are, but the lock system decides where you can go.

Combining Them in APIs

Most modern APIs use OAuth 2.0 (for Authorization) often paired with OpenID Connect (for Authentication).

AuthN: The user logs in via an Identity Provider (like Google). The system verifies the credential.

AuthZ: The provider issues an Access Token containing Scopes (e.g., read:profile, write:posts).

API Call: The client sends the token to the API. The API validates the token and checks the scopes to allow or deny the request.

Key Takeaways

Authentication (AuthN) = Identity (Who are you?) -> Returns 401.

Authorization (AuthZ) = Permissions (Access rights) -> Returns 403.

They are distinct steps but work together in every secure API request.

Next Step: The industry standard for handling this flow is complex but powerful. Let's demystify Understanding OAuth 2.0 and OpenID Connect.

Authentication vs Authorization

Authentication (AuthN): "Who are you?"#

Common Authentication Factors#

In APIs#

Authorization (AuthZ): "What can you do?"#

In APIs#

Comparison Table#

Real-World Analogy: The Hotel#

Combining Them in APIs#

Key Takeaways#

Authentication (AuthN): "Who are you?"

Common Authentication Factors

In APIs

Authorization (AuthZ): "What can you do?"

In APIs

Comparison Table

Real-World Analogy: The Hotel

Combining Them in APIs

Key Takeaways