Authentication (AuthN)
It verifies the identity of the user.
Who are you? → Verify identity → Establish authenticated user
Examples:
- Login with email/password
- OTP verification
- Google login
- Session/JWT used to maintain the authenticated state
Authorization (AuthZ)
It determines the user's permissions and access rights.
What are you allowed to do? → Check permissions/access → Allow or deny action
Examples:
- Roles — Admin, Manager, User
- Permissions — delete_user, approve_leave
- Resource ownership — user can edit their own profile
- Policies/attributes — e.g. a manager can approve requests only for their team
Can you have authorization without authentication?
Yes.
For public resources, authentication isn't required because the access policy allows everyone to access them.
GET /products → Public → No authentication required → Access allowed
For protected resources:
GET /profile → Authentication required → Identify user → Check authorization → Allow/Deny
So, authentication is not always required for authorization, but it is generally required when authorization depends on the user's identity, role, or permissions.
TLDR ;)
“Authentication verifies the identity of user, while authorization determines what that authenticated user is allowed to access or perform a particular action.”
Top comments (0)