Authentication and authorization are often confused.

They answer two completely different questions.

Authentication

Authentication asks:

Who are you?

Examples include:

Passwords

Passkeys

OAuth

Multi-factor authentication

Biometrics When a user logs in, the system authenticates their identity.

Authorization

Authorization asks:

What are you allowed to do?

Suppose Alice is authenticated.

That doesn't mean Alice should be able to:

Delete every user View financial reports Modify system settings

Enter fullscreen mode

Exit fullscreen mode

The application needs authorization rules.

Example

Imagine an API:

DELETE /users/123

Enter fullscreen mode

Exit fullscreen mode

Authentication determines:

Is this request associated with Alice?

Enter fullscreen mode

Exit fullscreen mode

Authorization determines:

Is Alice allowed to delete user 123?

Enter fullscreen mode

Exit fullscreen mode

Role-Based Authorization

A simple system might define:

const roles = { USER : [ " read " ], ADMIN : [ "…