Comparisons
Ten pairs that get conflated in real conversations. Neither column wins — what decides is the requirement. Each record leads with the confusion, because the confusion is the reason the record exists.
Authentication vs AuthorizationServer sessions vs TokensORM vs Raw SQLOptimistic vs Pessimistic concurrencySynchronous vs Asynchronous communicationOffset vs Cursor paginationLocal (in-process) vs Distributed cacheMonolith vs MicroservicesHorizontal vs Vertical scalingAt-least-once vs "Exactly-once"
Authentication vs Authorization
What people get wrong about this pair
People say "auth" for both and then ship a service where a valid token is treated as permission. A logged-in user is not an authorized user; the overwhelmingly common vulnerability is a correctly authenticated request reading a record that belongs to someone else because nothing checked ownership.
Authentication (authn)
Use it when
Establishing that the caller is who they claim to be: verifying a password, a session cookie, a signed token, an API key.
Authorization (authz)
Use it when
Deciding whether this authenticated caller may perform this action on this specific object.
| Dimension | Authentication (authn) | Authorization (authz) |
|---|---|---|
| Question answered | Who is calling? | May this caller do this, to this? |
| Runs where | Once, at the edge of the request | Everywhere a resource is touched, including inside jobs and events |
| Typical failure | 401 — token missing, expired or invalid | 403 — identity is fine, permission is not |
| What breaks when it is missing | Anyone can act as anyone | Any user can act on anyone else's data |
| Can middleware finish the job | Usually yes | Rarely — object-level checks need the object |
| Testable by | Calling without credentials | Calling with a valid credential for the wrong tenant |