Authentication
The process of verifying the claimed identity of a user, service, or device through credentials or other authentication factors.
Authentication verifies a principal's identity claim using a password, key, certificate, token context, or multi-factor mechanism. Successful authentication does not grant unrestricted access; authorization remains a separate decision about permitted actions and resources.
The security boundary is broader than checking whether a credential is valid. Replay resistance, secret storage, session lifecycle, token audience and issuer validation, and monitoring failed attempts all belong to the same flow. Using a centralized identity provider also does not remove the application's own authorization responsibilities.
Related: Authorization, WebAuthn, Passkey, mTLS.