FastAPI for AI Engineers - Part 5: Authentication vs Authorization (And Why Most Beginners Confuse Them)

In the previous article, we explored how Pydantic validates data before it enters our application.

For example, if an API expects a temperature value, sending text such as "Sunny" instead of a numeric value should be rejected.

Just as applications validate data before processing it, they must also validate users before granting access.

Not everyone should be able to access every endpoint or perform every action.

This brings us to two important concepts in backend development:

Although these terms are often used together, they solve different problems.

If you haven't read it already, check out the previous post to maintain continuity in the series and improve your understanding on FastAPI:

Imagine entering an airport.

At the entrance, security checks your passport or government-issued ID to verify who you are.

This process is Authentication.

Once inside, not everyone can access every area.

Passengers can access waiting lounges, restaurants, and boarding gates.

Pilots, security personnel, and airport staff can access restricted areas that ordinary passengers cannot.

This process is Authorization.

The difference becomes clearer when we compare them side by side:

The following endpoint can be accessed by anyone:

from fastapi import FastAPI
app = FastAPI()

@app.get('/profile/')
def get_profile():
    return {'message': 'Your profile is here'}

There is no mechanism to verify who is making the request.

Whether the user is logged in or not, the endpoint remains accessible.

Authentication is the process of verifying a user's identity.

A typical authentication flow looks like this:

Login
  ↓
Username + Password
  ↓
Verify User
  ↓
Generate Token
  ↓
Access Protected Routes
python
users = {
    "suman": "password123"
}

@app.post("/login")
def login(username: str, password: str):

    if users.get(username) == password:
        return {"message": "Login successful"}

    return {"message": "Invalid credentials"}

This is a simplified example used only to demonstrate the concept.

In real-world applications, passwords should never be stored in plain text and authentication is usually implemented using JWT tokens, OAuth, or other secure mechanisms.

Authentication confirms the identity of a user.

However, simply knowing who a user is does not determine what they are allowed to do.

This is where Authorization comes into play.

users = {
    "suman": {
        "role": "admin"
    },
    "rahul": {
        "role": "student"
    }
}

@app.delete("/student/{id}")
def delete_student(id: int, current_user: dict):

    if current_user["role"] != "admin":
        return {"message": "Access denied"}

    return {"message": f"Student {id} deleted"}

Authentication -> Who are you?

Authorization -> What are you allowed to do?

Suppose you're building an AI-powered learning platform.

Authentication determines:

Authorization determines:

Even if two users are authenticated, they may not have the same permissions.

This is why authentication and authorization are both essential in production AI systems.

User Request
      │
      ▼
Authentication
(Who are you?)
      │
      ▼
Authorization
(What can you do?)
      │
      ▼
Protected Resource

Authentication and Authorization are often mentioned together, but they solve different problems.

Authentication verifies identity.

Authorization determines permissions.

A user must first prove who they are before the system can decide what they are allowed to do.

In this article, we focused on understanding the concepts behind Authentication and Authorization.

JWT (JSON Web Tokens) is one of the most common approaches used to authenticate users in modern APIs.

In the next article, we'll move beyond theory and implement JWT-based Authentication in FastAPI step-by-step, allowing us to generate access tokens, protect routes, and identify users securely.