These two words are easy to confuse because they both start with “auth” and both involve logging in. But they answer two different questions.
What is it?
- Authentication answers: “Who are you?” — proving your identity.
- Authorization answers: “What are you allowed to do?” — your permissions.
Authentication always comes first. The system confirms who you are, then decides what you may access.
Select any component in the diagram to read what it does.
Text description of this diagram
Authentication proves who you are; authorization decides what you are allowed to do.
Why is it important?
Getting these right keeps the wrong people out and stops the right people from doing more than they should. Both failures are dangerous: weak authentication lets intruders in; weak authorization lets an ordinary account cause extraordinary damage.
How does it work?
A simple hotel analogy makes it click:
- Authentication = showing your ID at the front desk to prove who you are.
- Authorization = your room key opening your room, but not everyone else’s, and not the manager’s office.
A real-world example
At work, you log in with your username and password (authentication). Once inside, you can open your own team’s files but not the finance department’s (authorization). Even a correctly authenticated user should only be authorized for what their job needs — a principle called “least privilege”.
Check what you learned
Which question does authentication answer?
“Who are you?” — it proves your identity.
Which comes first, authentication or authorization, and why?
Authentication — the system must know who you are before it can decide what you are allowed to do.
Key takeaways
- Authentication proves who you are; authorization decides what you can do.
- Authentication always happens first.
- Give each user only the access their role needs (least privilege).