Application authentication establishes who is making a request by checking evidence such as a password, passkey, security token, identity-provider session, or service credential. The application then associates the verified identity with a session or request context.
Authentication is different from authorization, which decides what an authenticated identity may do. A secure application needs both, along with protected sessions, suitable expiration, account recovery, abuse controls, and careful handling of authentication data.
