Authentication vs authorization
Authentication is proving who you are. Authorization is deciding what you're allowed to do.
Two words developers mix up all the time, because they sound almost the same: authentication and authorization.
What they are
Authentication is proving who you are. Authorization is deciding what you're allowed to do.
How they work
Logging in with a password, a passkey or a code on your phone, that's authentication. The app now knows you're Sam. Then every time you try something, like deleting a project, the app checks your role and permissions. That's authorization. An editor can delete. A viewer can't.
Why it matters
They fail in different ways. One lets the wrong person in. The other lets the right person do the wrong thing. Secure apps get both right.
