All comparisonsSecurity
Authentication vs Authorization
Authentication (AuthN) verifies identity, a password, a passkey, a token that proves you are who you claim to be. Authorization (AuthZ) happens after that and decides what the now-verified identity is permitted to access or do. You can be authenticated and still be denied by authorization, e.g. a logged-in user trying to open someone else’s admin panel.
Left
Authentication
Right
Authorization
Question answeredWho are you?What are you allowed to do?
HappensFirst, at login/session startOn every subsequent protected action
Common mechanismsPasswords, OAuth, passkeys, MFARBAC, ABAC, permission scopes, ACLs
Typical failure401 Unauthorized403 Forbidden
ExampleSigning in with GoogleOnly admins can delete a project
Use Authentication when
You need to establish or confirm identity before granting access to anything.
Use Authorization when
Identity is already known and you need to decide whether that identity can perform a specific action.
The verdict
They are two separate layers that must both be checked on every request. A system that authenticates well but skips authorization checks is still broken.
Study this on the roadmap