security//authentication

Checking who you are before letting you in. Here there is a lock and a key.

Checking who you are before letting you in. Here there is a lock and a key.

Mechanisms: a password, a token, a certificate, a session cookie issued after one of them, a second factor. What they share is a verification step before access, which is what distinguishes them from a preference such as robots.txt.

Authentication answers "who are you"; authorization answers "what may you do". OAuth 2.0 is an authorization framework that is often mistaken for the first. Auth is one concrete implementation of both.

For crawlers and agents it is the real boundary: everything before it is public by construction, whatever the robots file says, and everything behind it requires credentials, which is why browser automation with a logged-in session needs the same care as a person.