Backend & systems·Security and identity
you verify the caller is who they claim to be, before you have any opinion at all about what they may do.
Authentication
Also calledauthn, login
Establishing identity — proving that a request comes from a particular principal, via a password, a token, a certificate or a signature. It answers exactly one question: who is this. Everything about permissions is a separate concern, and conflating the two is how endpoints end up checking that someone is logged in and nothing else.