Auth vs Authz (Sessions, JWT, OAuth)

Authentication is proving who you are; authorization is what you're allowed to do - and after login, the server keeps you logged in with either a server-side session or a stateless token like a JWT. This guide untangles all of it, plus OAuth and 'Sign in with Google'.

1. Authentication vs Authorization Authentication (authn) answers 'who are you?' by proving identity; authorization (authz) answers 'what are you allowed to do?' by checking permissions. They're separate steps, they happen in that order, and you need both.
2. Keeping You Logged In: Sessions vs Tokens After you log in, the server has to remember you on every following request. Two approaches: a server-side session (a random id in a cookie, with the real state kept on the server) or a stateless signed token like a JWT (the client holds the data, the server just verifies the signature). Each has plain trade-offs around revocation, size, and scaling.
3. Delegated Access: OAuth & 'Sign in with…' OAuth 2.0 lets one app get limited access to your data on another service without you handing over your password - the valet-key model. This phase covers the flow, access vs refresh tokens, scopes, and the difference between OAuth (authorization) and OpenID Connect, the thin layer on top that does authentication ('Sign in with Google').