Authentication answers: "Who are you?" It's the first gate before authorization.
Basic auth
Authorization: Basic dXNlcjpwYXNzd29yZA==
// = base64("user:password")Bearer token
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9...OAuth2 + JWT
JWT payload:
{ "user_id": "123", "roles": ["admin"], "exp": 1720000000 }SSO
API keys
X-API-Key: sk_live_abc123xyz...mTLS
// Regular TLS: only server has cert
// mTLS: both have certs (mutual authentication)
Client → presents client cert → server validates
Server → presents server cert → client validates
→ Encrypted, mutually authenticated