Authentication: proving who you are (login, credentials, tokens). Authorization: proving what you're allowed to do (permissions, roles, policies). Authentication happens first. Authorization uses the authenticated identity to check access. OAuth 2.0 is an authorization framework, NOT an authentication protocol.