Recommended Free Tools
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Authentication (AuthN) proves an identity; authorization (AuthZ) decides what that identity may do. A successful login does not grant access to every account, record, endpoint or operation. Your application should authenticate a person, device or service, then evaluate its permissions for the specific resource and action requested. Public resources can be authorized for anonymous users, too—for example, a login page.
Authentication and authorization are different security decisions
Authentication establishes who is calling
Authentication answers “Who are you?” It verifies that a person, device or application is the entity it claims to be. Microsoft Learn describes it as “the process of proving that you are who you say you are.” Passwords, passkeys, certificates, one-time codes and federated sign-in are examples of authentication mechanisms, but the mechanism is separate from the decision about what the caller may access.
Authorization grants or denies an action
Authorization answers “What may this identity do here?” Microsoft defines it as “the act of granting an authenticated party permission to do something.” OWASP, citing NIST, describes it as verifying that a requested action or service is approved for a specific entity. The policy can consider the identity, role, scopes, tenant, resource owner and requested operation.
| Question | Authentication | Authorization |
|---|---|---|
| Security question | Who is this caller? | Is this caller allowed to perform this action on this resource? |
| Typical input | Credential, biometric, certificate or federated assertion | Identity plus roles, scopes and resource-level policy |
| Typical result | Verified identity or failed sign-in | Allow, deny or require an additional condition |
| When it runs | At sign-in and whenever a credential or token is presented | On every protected operation, at the policy-enforcement point |
| Failure example | Invalid password or expired assertion | Authenticated user lacks permission to update the requested record |
How the two decisions fit into one request
- Present an identity. A user signs in, or a service presents its credential or token.
- Authenticate and validate the credential. Check the issuer, signature, audience, expiration and relevant claims for a token-based flow.
- Identify the operation. Determine the HTTP method, endpoint, object or record, and tenant involved.
- Evaluate policy. Compare the authenticated identity with required scopes, roles and resource-level permissions.
- Enforce the result. Process the operation only when policy allows it; otherwise return an appropriate denial without leaking protected data.
Identity and access-management (IAM) systems coordinate identities, authentication, authorization, roles, permissions and provisioning so that the right people, machines and software components reach the right resources at the right time. Authentication can occur at an identity provider, while authorization may be enforced at an API gateway, service or the resource itself. In a distributed system, the component that knows the resource owner and business rule must still make the final resource-level decision.
#1 Best Overall
Is OAuth authentication or authorization?
OAuth 2.0 delegates authorization
OAuth 2.0 is an authorization framework. It lets a resource owner grant a client limited access to protected resources. The authorization server issues an access token, and the client presents that token to the resource server. The token’s scopes describe the delegated API access; possession of an access token is not, by itself, proof of the end user’s identity.
OpenID Connect authenticates the user
OpenID Connect (OIDC) adds an identity layer to OAuth 2.0 for authentication and single sign-on. An OIDC identity provider returns an ID token containing identity claims for the relying party to validate. OWASP’s concise guidance is: “Use OIDC for authentication/SSO; use OAuth for authorization to APIs.” Use OIDC when your application needs to know who signed in, and use an OAuth access token when a client needs to call a protected API.
Use authorization code with PKCE for user-facing clients
For single-page, server-based, desktop and mobile applications, use the authorization-code flow with Proof Key for Code Exchange (PKCE), together with OIDC when user authentication is required. PKCE protects the exchanged authorization code if it is intercepted. Do not substitute an ID token for an API access token simply because both are returned by the same sign-in transaction.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsAccess tokens and ID tokens
| Property | Access token | ID token |
|---|---|---|
| Purpose | Authorizes a client’s call to a resource server | Communicates authenticated user identity to the OIDC client |
| Audience | The API or resource server | The relying-party application |
| Claims or permissions | Scopes and other authorization claims | Identity claims such as the authenticated subject |
| Where it is sent | To the API, commonly in an Authorization header | To the client that requested authentication; it should not be used as an API permission credential |
| Validation focus | Issuer, signature, audience, expiration and scopes required by the operation | Issuer, signature, audience, expiration and identity claims required by the client |
Tokens may be structured (for example, a signed JWT) or opaque. Regardless of format, the receiving component must validate the token according to the provider’s metadata and enforce the operation’s policy. Never infer authorization merely because a token parsed successfully or because login succeeded.
Design authorization at the resource and action level
Make permissions specific
Define the smallest useful scopes and roles: reading invoices is different from issuing refunds, and access to one customer’s record is different from access to every customer’s records. Check the requested action and the specific resource, not only the route prefix or a broad role name.
Enforce on every protected operation
Repeat the authorization check for each API operation, including background jobs and administrative endpoints. A gateway can reject obviously unauthenticated traffic, but the service that owns the data must enforce resource ownership and business rules.
Keep authentication and authorization failures distinct
- Use an authentication failure when the caller cannot present a valid identity or token.
- Use an authorization failure when the identity is valid but lacks the required permission.
- Do not reveal whether another user’s record exists merely because the caller is denied.
- Allow explicitly public resources without forcing an unnecessary login.
Implementation checklist for a protected API
- Choose the protocol. Use OIDC for user sign-in and SSO; use OAuth for delegated API access. For service-to-service calls, use the provider’s documented client authentication and token flow.
- Validate tokens. Verify issuer, signature, audience, expiration and the claims your policy requires. Reject tokens intended for a different API or client.
- Require TLS. Protect credentials, authorization codes and tokens in transit. Never send bearer tokens over an unencrypted connection.
- Check scopes and roles. Map each endpoint and action to explicit requirements. Treat a missing scope as a denial, not as an invitation to fall back to a broader role.
- Check the resource. Confirm that the caller may access this tenant, object or record. A valid token does not establish ownership.
- Limit token exposure. Keep access tokens short-lived and narrowly scoped when your threat model and provider support it. Store them only where the client architecture can protect them.
- Plan revocation and expiry. Decide how logout, disabled accounts, revoked grants and expired credentials affect active sessions and tokens.
- Log decisions safely. Record the subject, client, operation and allow/deny result without writing passwords or full bearer tokens to logs.
Minimal request examples
The following examples show a client presenting an OAuth access token. They do not replace server-side validation and authorization; the API must still verify the token and policy on every request.
Free tools Windows power users keep installed
One-click scans. No signup required.
cURL
curl -i -H "Authorization: Bearer ACCESS_TOKEN" https://api.example.com/v1/invoices/123Python
import os
import requests
token = os.environ['ACCESS_TOKEN']
response = requests.get(
'https://api.example.com/v1/invoices/123',
headers={'Authorization': f'Bearer {token}'},
timeout=30,
)
response.raise_for_status()
print(response.json())Node.js
const token = process.env.ACCESS_TOKEN;
const res = await fetch('https://api.example.com/v1/invoices/123', {
headers: { Authorization: `Bearer ${token}` }
});
if (!res.ok) throw new Error(`HTTP ${res.status}`);
console.log(await res.json());On the server, the equivalent policy sequence is: parse the bearer credential, validate its issuer, signature, audience and expiry, map its subject to the request context, require the endpoint’s scopes or role, then check ownership or tenant boundaries before reading or changing data.
Rank #3
- Comes with secure packaging
- It can be a gift item
- Easy to read text
Common mistakes and troubleshooting
“I logged in, but the API returns forbidden”
Authentication succeeded, but authorization failed. Inspect the access token’s audience and scopes, confirm that the API expects an access token rather than an ID token, and verify the user’s role and resource ownership.
“The API says the token is invalid”
Check issuer configuration, signature keys, audience, expiration and clock synchronization. A token issued for one API or environment cannot automatically be accepted by another.
“The browser works, but my script gets unauthorized”
The browser may be sending a session cookie or a different audience and scope. Capture the actual request, then use the documented OAuth flow and send the resulting access token in the Authorization header. Do not copy a browser’s long-lived cookies into production automation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
“A role check passes, but users can see another tenant’s data”
Role checks alone are too coarse. Add a resource-level comparison between the token subject or tenant claim and the record being accessed, and enforce it in the service that owns the data.
“Logout did not immediately invalidate an API call”
Logout, token expiry and grant revocation are separate events. Use short-lived access tokens and the provider’s revocation or session controls when immediate invalidation is required; design the API to reject expired or revoked credentials according to that provider’s rules.
Performance, reliability and operational trade-offs
Centralized IAM reduces duplicated identity logic but adds a dependency on issuer metadata, signing keys and token endpoints. Cache provider metadata and keys according to the provider’s rotation guidance, while ensuring that key changes and expiry are handled safely. Keep authorization decisions close to the resource so a network failure at a separate policy service cannot silently turn into an allow decision.
Short-lived, narrowly scoped access tokens reduce the damage from theft but increase refresh traffic. Broader or longer-lived tokens reduce refresh work but enlarge the blast radius of compromise. Choose the balance for your threat model, then monitor denied requests, expired tokens, key-rotation errors and latency at the enforcement point.
Or skip the browser setup
If you need a clean visual record of an authenticated or public web page for documentation, QA or an agent workflow, ScreenshotNeo provides a website screenshot API and MCP server. It can send custom headers and cookies, wait for a selector or network idle, hide selectors, block requests, capture full pages or PDFs, and expose take_screenshot, get_page_info and capture_pdf tools to MCP clients such as Claude and Cursor.
Cookie and consent banners, newsletter popups and chat widgets are removed before the shot. Bot checks, blank pages, timeouts, failed loads and cache hits are not billed, and response headers identify the page verdict and billing result.
One-call screenshot
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo API documentation for authentication, headers, cookies, output formats and the 63 available capture options.
Python
import requests
r = requests.get('https://api.screenshotneo.com/v1/shot', params={'access_key': 'YOUR_API_KEY', 'url': 'https://stripe.com'}, timeout=90)
open('shot.webp', 'wb').write(r.content)Node.js
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);The Free plan includes 1,000 screenshots per month with no card. Paid plans start at $5 for 3,000 screenshots; Growth is $15 for 15,000, Pro $39 for 60,000, Scale $99 for 250,000 and Business $249 for 1,000,000. Yearly billing gives two months free, and every feature is available on every plan. Create a free ScreenshotNeo account to start without a card.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Frequently Asked Questions
Can an application authorize a request that has no user login?
Yes. Authorization is a policy decision, not a synonym for human login. A service identity, device credential or explicitly public route can be authorized, provided the policy defines what that caller may do.
Should an API ever read identity claims from an ID token?
An API should receive and validate an access token issued for that API. The client uses the ID token to establish the user session; treating it as an API permission token mixes the OIDC and OAuth roles.
Where should the final authorization check live when a request crosses several services?
Gateways can perform coarse checks, but the service that owns the resource should enforce tenant, ownership and action-level rules. This prevents a valid upstream decision from being reused for a different object or operation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
