security//authentication

Authentication checks who someone is before letting them in: here there is a lock and a key.

Authentication checks who someone is before letting them in: here there is a lock and a key.

Its mechanisms are a password, a token, a certificate, a session cookie issued after one of them, or a second factor. What they share is a verification step before access, which is what distinguishes them from a preference such as robots.txt.

Authentication answers the question who are you; authorization answers what may you do. OAuth 2.0 is an authorization framework that is often mistaken for the first: it only proves identity when OpenID Connect is layered on it, so logging in with Google is technically an authorization grant with an identity token attached. Auth is one concrete implementation of both.

For crawlers and agents it is the real boundary: everything before it is public by construction, whatever the robots file says, and everything behind it requires credentials, which is why browser automation with a logged-in session needs the same care as a person.