API Fundamentals Course
API Fundamentals
/
Beginner

Authentication vs Authorization

Definition

The two distinct security phases of access control. Authentication verifies identity. Authorization verifies permissions.

Explain Like I'm New

Authentication is the TSA agent checking your Passport to prove you are actually John Doe. Authorization is the Flight Attendant checking your ticket to ensure John Doe is allowed to sit in First Class.

Real World Example

A user logs into a WordPress site with their email and password (Authentication). They click the 'Delete Website' button, but the server rejects the request because their account role is 'Subscriber', not 'Admin' (Authorization).

Common Use Cases

  • •System security
  • •Role-based access control (RBAC)

Interactive Example

Loading...
Console output will appear here...

Interview Questions

basic

  • Which one happens first: Authentication or Authorization?

intermediate

  • If a user tries to access a protected API route without sending a login token, should the API return a 401 or 403 status code?

Flash Cards

Question

Which happens first?

Click to reveal answer
Answer

Authentication. You cannot check what someone is allowed to do until you first prove who they are.

Question

401 vs 403?

Click to reveal answer
Answer

`401 Unauthorized` (Authentication failed - 'I don't know who you are'). If they sent a valid token but weren't an admin, it would be `403 Forbidden` (Authorization failed - 'I know who you are, but you aren't allowed to do this').