Every app eventually needs to answer two questions: "who is this person?" and "what are they allowed to do?" Many tutorials either focus on integrating a specific authentication provider like Auth0 or Cognito, or else discuss low-level details like password hashing algorithms. But both of those stop short of the real question we should be asking ourselves: who actually is this person, and what does that mean in terms of how we manage their data and access? This is not just a question of 'did this person log in?', but it's a more fundamental problem of understanding the actual human interacting with your app.
This may sound like a subtle distinction but it matters more than it might seem, and this post will help you understand the difference between identity, authentication, and authorization.
This post is part of a series on the Vesper Design Diaries, building a Production-Grade KMP App on a Bootstrap Budget. See the Series Introduction for context on the Vesper app and this blog series.
Identity vs Authentication vs. Authorization
These words get often used interchangeably, but they describe fundamentally different problems. So before we dive into Vesper's user management system, let's make sure we properly understand these terms.
