Authentication checks who you are, and authorization checks what you may do. Authentication happens first, then authorization checks the permissions of the identity it proved.
Authentication
Authorization
Question
"Are you really John Doe?"
"Can John Doe access this resource?"
Verifies
Identity
Permissions
Methods
Passwords, biometrics, certificates
Roles, permissions, ACLs
Failure status
401 Unauthorized
403 Forbidden
The status codes follow the same split. Return 401 when credentials are missing or invalid, since the client needs to authenticate. Despite its name, 401 Unauthorized means unauthenticated. Return 403 when the server knows the caller but refuses the request. Secure APIs need both checks.
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
Authentication asks who you are and authorization asks what you may do. Authentication methods differ mainly in where the identity state lives.
For this question · chapter 1 of 4One badge, two gates: identity and permission. Watch floor 9 get refused with 403 while the gate lamp and the reader still show badge 124 as valid. Identity passed, but permission did not.
1/4A badge and the floors it opens
A badge and the floors it opens
A request has to provide identity to access a resource from the server. Identity means proof of who is calling. This request has not provided any identity yet. So the server sends back the status code 401, Unauthorized.
The caller signs in. The server checks that identity and then issues badge 124 with the role staff, a proof of who the caller is. The badge allows access to floors 1 to 3, the resources this role may use, so the request gets a 200 OK. You now know who is calling, so the server can act on the caller's identity.
The server refuses the caller at Floor 9, a protected resource, and answers 403 Forbidden. Badge 124, the proof of who is calling, is still valid. Nothing about the badge changed, so a second sign-in would not help. The identity check passed, but this caller does not have the right permissions.
The two checks run in order. Authentication comes first, asks who you are, and returns 401 when that check fails. Authorization comes second, asks what you may do, and returns 403 when the caller lacks the right permissions. Usually the two checks are two pieces of middleware, in that order.
Chapter 1 · step 1 of 4
A request has to provide identity to access a resource from the server. Identity means proof of who is calling. This request has not provided any identity yet. So the server sends back the status code 401, Unauthorized.
Saved in this browser - sign in to keep your review list.
How should your speech become text?
Listening… your words appear above as you speak - tap Stop when you're done.
Recording · cr - tap Stop & transcribe when you're done.
Transcribing with AI…
Voice:
Keep going - a few more words and AI can grade it.
Interview lens
How interviewers actually use this question
Likely follow-ups
Would you return 403 or 404 when a caller asks for a record they are not allowed to see?404 avoids confirming the record exists, and 403 is clearer when the caller already knows about the resource. Name the leak you are avoiding.
A user changes /orders/42 to /orders/43 and sees someone else's order. What check was missing?Object-level authorization. Confirm the caller may access that exact record, not just that they are logged in.
Is OAuth 2.0 an authentication protocol or an authorization one, and where does OpenID Connect fit?OAuth 2.0 grants delegated access to resources. OpenID Connect adds an ID token that proves who the user is.
What you can say
Authentication checks who you are, and authorization checks what you are allowed to do.
Authentication comes first. The caller proves an identity with something like a password, a biometric or a certificate.
Then authorization takes that proven identity and checks its permissions, through roles, permission lists or ACLs, against the resource being requested.
The status codes follow the same split. I return 401 when credentials are missing or invalid, and 403 when the server knows the caller but refuses the request.
The name trips people up, because 401 Unauthorized really means unauthenticated.
A secure API needs both checks, because knowing who someone is tells you nothing about what they should be allowed to touch.
Weak answers to avoid
Uses the two words interchangeablyMixing them up suggests you would ship an API that checks login but not access. Say which question each one answers and that authentication runs first.
Swaps 401 and 403401 means the caller has not authenticated, and 403 means the server knows the caller and refuses. Sending 403 for a missing token points the client at the wrong fix.
Treats logged in as allowedChecking only identity lets any logged-in user reach any record. Say that authorization checks the caller's permissions against each resource they request.
Interview lens
Likely follow-ups, what you can say, and the weak answers to avoid.
