Introduction to Authentication Strategies

Authentication is the step in which a server finds out who is sending a request. Authorization is the step that follows it, in which the server decides what that sender is allowed to do. Logging in to an email account is authentication, while being allowed to delete messages from that account, but not from someone else's, is authorization.

The two steps have their own HTTP status codes, and APIs often mix them up. 401 Unauthorized means the server does not know who you are: the credential is missing, expired, or invalid, and the client should log in again