Authentication VS Authorization

Meet Tobi.

Tobi checked into a hotel on a calm Sunday afternoon to unwind. At the reception, he made his payment and was handed a key card to Room 48.

Now, here’s where it gets interesting…

Tobi’s experience at the hotel is a perfect analogy for authentication and authorization.

✅ Authentication happened the moment Tobi paid and received his key card. That card confirmed he was a legitimate guest, just like how users log into an app to verify their identity.

✅ Authorization kicked in when Tobi realized he could only enter Room 48, not Room 50 or the executive suite. The hotel granted him access based on what he paid for.

Similarly, users can only access specific pages or features in an app depending on their role.

Take Jumia, for example. When you log in as a buyer, you don’t see pages meant for sellers. That’s authorization in action.

In frontend applications, authorization shines when multiple roles are handled, e.g., Admin, Super Admin, and User. Different user types should have access to different parts of the app based on their roles. A user with the role User should never see a page to add a new admin; that’s a privilege reserved for an Admin or Super Admin.

Authentication gives users access, but authorization determines what they have access to.