The Difference Between Authentication and Authorization

Authentication and authorization are often confused.

They answer two completely different questions.

Authentication

Authentication asks:

Who are you?

Examples include:

• Passwords
• Passkeys
• OAuth
• Multi-factor authentication
• Biometrics When a user logs in, the system authenticates their identity.

Authorization

Authorization asks:

What are you allowed to do?

Suppose Alice is authenticated.

That doesn't mean Alice should be able to:

Delete every user
View financial reports
Modify system settings

The application needs authorization rules.

Example

Imagine an API:

DELETE /users/123

Authentication determines:

Is this request associated with Alice?

Authorization determines:

Is Alice allowed to delete user 123?

Role-Based Authorization

A simple system might define:

const roles = {
  USER: ["read"],
  ADMIN: ["read", "write", "delete"]
};

Then middleware can enforce permissions.

Why This Matters

A common security mistake is:

User is logged in
        ↓
Allow everything

Authentication isn't authorization.

Resource Ownership

Authorization can also depend on ownership.

For example:

GET /users/123/profile

might be allowed only if:

request.user.id === 123

or the user has an administrative permission.

Final Thoughts

Remember the distinction:

Authentication = Who are you?
Authorization  = What can you do?

Keeping these concepts separate leads to much safer application designs.