What is the difference between authentication and authorization in REST APIs?
Learn the difference between authentication and authorization in REST APIs, when to use 401 vs 403, and how identity and permissions work together.
Expected Interview Answer
Authentication verifies who the caller is (identity), while authorization decides what that verified caller is allowed to do (permissions). Authentication always comes first; authorization builds on its result.
In a REST API, authentication typically happens by validating credentials such as a username/password, an API key, or a signed token, producing a trusted identity. Authorization then checks that identity's roles, scopes, or ownership against the requested resource and action, returning 401 Unauthorized when identity is missing or invalid and 403 Forbidden when the identity is known but lacks permission.
- Clear separation of identity from permissions
- Correct use of 401 vs 403 status codes
- Enables fine-grained, role-based access control
- Reduces attack surface by denying by default
- Makes security auditing and reasoning easier
AI Mentor Explanation
Authentication is the gate steward checking your match ticket and photo ID to confirm you are the person named on it before you enter the stadium. Authorization is the separate usher who reads your ticket tier and only lets you into the members' pavilion or the dressing room if your pass actually grants that level of access.
Step-by-Step Explanation
Step 1
Client sends credentials
The request carries proof of identity such as a token, API key, or login credentials, usually in the Authorization header.
Step 2
Server authenticates
The API validates the credentials and resolves them to a known identity (user, service, or client), rejecting with 401 if invalid.
Step 3
Load permissions
Roles, scopes, or claims associated with that identity are fetched, often directly from a signed token's payload.
Step 4
Server authorizes
The API checks whether that identity's permissions cover the requested resource and action, returning 403 if they do not.
Step 5
Serve the response
Only when both checks pass does the endpoint execute the business logic and return the protected data.
What Interviewer Expects
- A crisp one-line distinction: who you are vs what you can do
- Correct mapping of 401 to authentication and 403 to authorization
- That authentication always precedes authorization
- Awareness of tokens, scopes, and role-based access control
- A concrete API example tying the two together
Common Mistakes
- Using the terms interchangeably
- Returning 403 for a missing or invalid token instead of 401
- Putting authorization logic before verifying identity
- Trusting client-supplied role fields without server validation
- Assuming a logged-in user is automatically permitted everything
Best Answer (HR Friendly)
“Authentication is proving who you are, like showing an ID at a door. Authorization is what you're then allowed to do once you're inside, like which rooms your pass opens. In an API, the server first confirms your identity, then checks whether that identity has permission for the action.”
Code Example
// Authentication: verify the token and attach the identity
function authenticate(req, res, next) {
const token = (req.headers.authorization || '').replace('Bearer ', '')
const user = verifyToken(token) // returns null if invalid
if (!user) return res.status(401).json({ error: 'Not authenticated' })
req.user = user
next()
}
// Authorization: check the identity's role
function requireRole(role) {
return (req, res, next) => {
if (!req.user.roles.includes(role)) {
return res.status(403).json({ error: 'Not authorized' })
}
next()
}
}
app.delete('/api/users/:id', authenticate, requireRole('admin'), deleteUser)Follow-up Questions
- When should an API return 401 versus 403?
- How does role-based access control differ from attribute-based access control?
- How do OAuth scopes relate to authorization?
- Where should authorization checks live in a layered architecture?
- How do you prevent privilege escalation in an API?
MCQ Practice
1. Which HTTP status code indicates a valid identity that lacks permission for the resource?
403 Forbidden means the caller is authenticated but not authorized for that action; 401 is for missing or invalid authentication.
2. In a typical secured request flow, which happens first?
Authentication establishes identity first; authorization then decides what that verified identity may do.
3. Authentication answers which question?
Authentication is about verifying identity (who), while authorization is about permissions (what they can do).
Flash Cards
Authentication vs authorization in one line — Authentication = who you are; authorization = what you're allowed to do.
401 vs 403 — 401 = not authenticated (identity missing/invalid); 403 = authenticated but not permitted.
Which comes first? — Authentication always precedes authorization.
Where do permissions come from? — From roles, scopes, or claims tied to the authenticated identity, validated server-side.