What is the difference between authentication and authorization in API testing?

Answer

Authentication vs Authorization

This is one of the most frequently asked API security questions in interviews.

Authentication — "Who are you?"

Authentication verifies the identity of a user or system. It answers: "Are you who you claim to be?"

Common Authentication Methods

Method	Description	Example
Basic Auth	Username + password (Base64)	`Authorization: Basic dXNlcjpwYXNz`
Bearer Token	JWT token passed in header	`Authorization: Bearer eyJhbG...`
API Key	Unique key per client	`X-API-Key: abc123key`
OAuth 2.0	Delegated access via access token	Login with Google/GitHub
Session Cookie	Server-side session ID	`Cookie: session=xyz`

Java

// Authentication example in Rest Assured
given()
    .header("Authorization", "Bearer " + getToken())
    .when()
    .get("/api/profile");

Authorization — "What can you do?"

Authorization determines what actions an authenticated user is allowed to perform. It answers: "Do you have permission?"

Common Authorization Patterns

Pattern	Description
RBAC	Role-Based Access Control (admin/user/guest)
ABAC	Attribute-Based Access Control (department, location)
ACL	Access Control Lists (per-resource permissions)
Scopes	OAuth 2.0 scopes (read:users, write:orders)

Java

// Authorization test — user role cannot delete
given()
    .header("Authorization", "Bearer " + userToken) // not admin
    .when()
    .delete("/api/users/123")
    .then()
    .statusCode(403); // Forbidden — not authorized

Key Differences

Aspect	Authentication	Authorization
Question	Who are you?	What can you do?
Happens	First	After authentication
Failure code	401 Unauthorized	403 Forbidden
Example	Login with password	Admin vs regular user access
Can work alone?	Yes	No (needs authentication first)

HTTP Status Codes

✓401 Unauthorized → Authentication failed (no token, wrong password)
✓403 Forbidden → Authenticated but not authorized (wrong role/permissions)

Interview Answer

"Authentication is verifying identity — like showing your ID at the door. Authorization is determining what you're allowed to do once you're inside — like which rooms you can enter. In API testing, a 401 means the user isn't logged in; a 403 means they're logged in but don't have permission."