The two words are pronounced the same way at conferences and conflated in the same sentence in 90% of bug tickets. They are completely different layers and confusing them is how privilege-escalation bugs ship.
| Term | Question it answers | Failure mode |
|---|---|---|
| Authentication (AuthN) | "Who are you?" | An unverified caller is treated as you |
| Authorization (AuthZ) | "Are you allowed to do this?" | A verified caller does something they shouldn't |
What solo devs usually ship
- AuthN: skipped entirely. "It is just for me." Anyone who reaches the URL is automatically "me."
- AuthZ: not even a concept. One role: god-mode. Every endpoint trusts whoever called it.
This quest's PIN layer (Track 5) gives you AuthN. The admin endpoints (Track 8) introduce a tiny AuthZ split: only the AuthN'd PIN session can hit /admin/*. That two-tier model is enough for most solo apps.