🚀 Authentication vs Authorization

Both are security concepts. 
But they solve different problems.


1️⃣ Authentication (Who are you?) 🔐

Verifies the identity of a user.

➤ How: Username & password, OTP, biometrics, OAuth 
➤ Wins: Confirms user identity 
➤ Example: Logging into your account 

Flow:
User → Login → Server verifies credentials → Access granted


2️⃣ Authorization (What can you do?) 🛡️

Determines what actions a user is allowed to perform.

➤ How: Roles, permissions, access control rules 
➤ Wins: Restricts access to resources 
➤ Example: Admin can delete users, normal user cannot 

Flow:
Authenticated user → Check role → Allow / Deny action


💡 Key Difference

Authentication → Verifies identity 
Authorization → Grants permissions 

Authentication happens first. 
Authorization happens after.