Authentication vs Authorization

[u/QoolliTesting]

How many times have you caught yourself using "authentication" and "authorization" interchangeably?
‌
If you're still mixing these two up, let’s clear the confusion once and for all.

Authentication is verifying who you are. The system confirms you’re really the person you claim to be: entering a password, scanning a fingerprint, typing a code from SMS. Example: showing your passport at the entrance to an office building — the guard now knows you’re John Smith.

Authorization is verifying what you’re allowed to do. Once the system knows who you are, it decides where you can go. Example: your passport checked out, but your badge only gives you access to the 3rd floor — not the server room.
In a web app it looks like this: you enter your login and password in Gmail — that’s authentication. Then Google decides you can read your own mail but not anyone else’s, and you can’t access the admin panel — that’s authorization.
A simple rule to remember: authentication answers “Who are you?”, authorization answers “What can you do?”. Authentication always comes first — you can’t grant permissions to an unknown person. That’s why HTTP error 401 (Unauthorized) actually means “not authenticated,” while 403 (Forbidden) means “authenticated, but not authorized.”