authentication · authn
/ aw-then-ti-KAY-shun /
Authentication is how a system proves WHO you are. It's the login step: you show a password, a one-time code, a fingerprint, and the server is satisfied you really are the person you claim to be — like a bouncer checking your ID at the door.
Crucially, it answers only 'who?', not 'what are you allowed to do?'. That second question is authorization, and people mix the two up constantly. The handy memory trick: authentication is the door, authorization is the rooms you're allowed into once you're inside.
Once you've authenticated, the server usually hands you a token or sets a cookie so you don't have to type your password on every single request — proof of identity you carry with you for the rest of the session.
POST /login
{ "email": "[email protected]", "password": "••••••••" }
→ 200 OK { "token": "eyJhbGci…" }Authentication: prove who you are, get a token back to carry on with.
Don't confuse it with authorization. They're often shortened to authn and authz precisely so people stop saying 'auth' and meaning two different things.