In the previous article, we explored how Pydantic validates data before it enters our application.
For example, if an API expects a temperature value, sending text such as "Sunny" instead of a numeric value should be rejected.
Just as applications validate data before processing it, they must also validate users before granting access.
Not everyone should be able to access every endpoint or perform every action.
This brings us to two important concepts in backend development:
- Authentication
- Authorization
Although these terms are often used together, they solve different problems.
If you haven't read it already, check out the previous post to maintain continuity in the series and improve your understanding on FastAPI:
FastAPI for AI Engineers - Part 4: Stop Bad Data Before It Breaks Your API (Pydantic and Data Validation)
Imagine entering an airport.
At the entrance, security checks your passport or government-issued ID to verify who you are.
This process is Authentication.
Once inside, not everyone can access every area.
Passengers can access waiting lounges, restaurants, and boarding gates.
Pilots, security personnel, and airport staff can access restricted areas that ordinary passengers cannot.
This process is Authorization.
The difference becomes clearer when we compare them side by side:
| Authentication | Authorization |
|---|---|
| Verifies identity | Determines permissions |
| Answers "Who are you?" | Answers "What can you do?" |
| Happens first | Happens after authentication |
| Login credentials, tokens | Roles and permissions |
| Example: Logging into an app | Example: Accessing the admin dashboard |
The following endpoint can be accessed by anyone:
from fastapi import FastAPI
app = FastAPI()
@app.get('/profile/')
def get_profile():
return {'message': 'Your profile is here'}
There is no mechanism to verify who is making the request.
Whether the user is logged in or not, the endpoint remains accessible.
Authentication is the process of verifying a user's identity.
A typical authentication flow looks like this:
Login
↓
Username + Password
↓
Verify User
↓
Generate Token
↓
Access Protected Routes
Authentication
users = {
"suman": "password123"
}
@app.post("/login")
def login(username: str, password: str):
if users.get(username) == password:
return {"message": "Login successful"}
return {"message": "Invalid credentials"}
This is a simplified example used only to demonstrate the concept.
In real-world applications, passwords should never be stored in plain text and authentication is usually implemented using JWT tokens, OAuth, or other secure mechanisms.
Authentication confirms the identity of a user.
However, simply knowing who a user is does not determine what they are allowed to do.
This is where Authorization comes into play.
Authorization
users = {
"suman": {
"role": "admin"
},
"rahul": {
"role": "student"
}
}
@app.delete("/student/{id}")
def delete_student(id: int, current_user: dict):
if current_user["role"] != "admin":
return {"message": "Access denied"}
return {"message": f"Student {id} deleted"}
To summarize:
Authentication -> Who are you?
Authorization -> What are you allowed to do?
Authentication and Authorization in AI Applications
Suppose you're building an AI-powered learning platform.
Authentication determines:
- Which user is sending the request
- Whether the user is logged in
- Whether the access token is valid
Authorization determines:
- Whether the user can access premium AI models
- Whether the user can upload training datasets
- Whether the user can view analytics dashboards
- Whether the user can manage other users
Even if two users are authenticated, they may not have the same permissions.
This is why authentication and authorization are both essential in production AI systems.
User Request
│
▼
Authentication
(Who are you?)
│
▼
Authorization
(What can you do?)
│
▼
Protected Resource
Final Thoughts
Authentication and Authorization are often mentioned together, but they solve different problems.
Authentication verifies identity.
Authorization determines permissions.
A user must first prove who they are before the system can decide what they are allowed to do.
In this article, we focused on understanding the concepts behind Authentication and Authorization.
JWT (JSON Web Tokens) is one of the most common approaches used to authenticate users in modern APIs.
In the next article, we'll move beyond theory and implement JWT-based Authentication in FastAPI step-by-step, allowing us to generate access tokens, protect routes, and identify users securely.