Authentication vs Authorization — What's the Difference?

Authentication verifies who a user is (proving identity, typically via login credentials); authorization determines what an already-authenticated user is allowed to do.

Why they differ

• Authentication happens first — a login form checking a password, or a token being validated
• Authorization happens after — checking whether that now-known identity has permission for a specific action or resource

How to choose

• A 401 Unauthorized response actually means an authentication failure — the identity isn't established
• A 403 Forbidden response means an authorization failure — the identity is known but lacks permission

FAQ

Can a user be authenticated but not authorized?

Yes — this is extremely common. A logged-in user (authenticated) might still lack permission to access another user's private data (not authorized).