FastAPI for AI Engineers – Part 5: Authentication vs Authorization (And Why Most Beginners Confuse Them)

In the previous article, we explored how Pydantic validates data before it enters our application.

For example, if an API expects a temperature value, sending text such as “Sunny” instead of a numeric value should be rejected.

Just as applications validate data before processing it, they must also validate users before granting access.

Not everyone should be able to access every endpoint or perform every action.

This brings us to two important concepts in backend development:

• Authentication
• Authorization

Although these terms are often used together, they solve different problems.

If you haven’t read it already, check out the previous post to maintain continuity in the series and improve your understanding on FastAPI:

Imagine entering an airport.

At the entrance, security checks your passport or government-issued ID to verify who you are.

This process is Authentication.

Once inside, not everyone can access every area.

Passengers can access waiting lounges, restaurants, and boarding gates.

Pilots, security personnel, and airport staff can access restricted areas that ordinary passengers cannot.

This process is Authorization.

The difference becomes clearer when we compare them side by side:

Authentication Authorization Verifies identity Determines permissions Answers “Who are you?” Answers “What can you do?” Happens first Happens after authentication Login credentials, tokens Roles and permissions Example: Logging into an app Example: Accessing the admin dashboard

The following endpoint can be accessed by anyone:

from fastapi import FastAPI
app = FastAPI()

@app.get('/profile/')
def get_profile():
    return {'message': 'Your profile is here'}

Enter fullscreen mode Exit fullscreen mode

There is no mechanism to verify who is making the request.

Whether the user is logged in or not, the endpoint remains accessible.

Authentication is the process of verifying a user’s identity.

A typical authentication flow looks like this:

Login
  ↓
Username + Password
  ↓
Verify User
  ↓
Generate Token
  ↓
Access Protected Routes

Enter fullscreen mode Exit fullscreen mode

Authentication

users = {
    "suman": "password123"
}

@app.post("/login")
def login(username: str, password: str):

    if users.get(username) == password:
        return {"message": "Login successful"}

    return {"message": "Invalid credentials"}

Enter fullscreen mode Exit fullscreen mode

This is a simplified example used only to demonstrate the concept.

In real-world applications, passwords should never be stored in plain text and authentication is usually implemented using JWT tokens, OAuth, or other secure mechanisms.

Authentication confirms the identity of a user.

However, simply knowing who a user is does not determine what they are allowed to do.

This is where Authorization comes into play.

Authorization

users = {
    "suman": {
        "role": "admin"
    },
    "rahul": {
        "role": "student"
    }
}

@app.delete("/student/{id}")
def delete_student(id: int, current_user: dict):

    if current_user["role"] != "admin":
        return {"message": "Access denied"}

    return {"message": f"Student {id} deleted"}

Enter fullscreen mode Exit fullscreen mode

To summarize:

Authentication -> Who are you?

Authorization -> What are you allowed to do?

Authentication and Authorization in AI Applications

Suppose you’re building an AI-powered learning platform.

Authentication determines:

• Which user is sending the request
• Whether the user is logged in
• Whether the access token is valid

Authorization determines:

• Whether the user can access premium AI models
• Whether the user can upload training datasets
• Whether the user can view analytics dashboards
• Whether the user can manage other users

Even if two users are authenticated, they may not have the same permissions.

This is why authentication and authorization are both essential in production AI systems.

User Request
      │
      ▼
Authentication
(Who are you?)
      │
      ▼
Authorization
(What can you do?)
      │
      ▼
Protected Resource

Enter fullscreen mode Exit fullscreen mode

Final Thoughts

Authentication and Authorization are often mentioned together, but they solve different problems.

Authentication verifies identity.

Authorization determines permissions.

A user must first prove who they are before the system can decide what they are allowed to do.

In this article, we focused on understanding the concepts behind Authentication and Authorization.
JWT (JSON Web Tokens) is one of the most common approaches used to authenticate users in modern APIs.

In the next article, we’ll move beyond theory and implement JWT-based Authentication in FastAPI step-by-step, allowing us to generate access tokens, protect routes, and identify users securely.