Back
2026-04-02 • 6 min read
Authentication vs Authorization
Authentication is who you are. Authorization is what you can do — and where APIs most often fail.
API SecurityAuthorization
## The Distinction
AuthN proves identity. AuthZ enforces permissions — per resource, server-side.
## BOLA/IDOR
Fetching /users/:id must check ownership, not just authentication.
## Testing
Probe with second user session — expect 403/404, not data leak.