Authentication establishes who the user is (login, token); authorization determines what they are allowed to do. A logged-in user does not have access to everything: each action must be checked server-side. The 401 (unauthenticated) and 403 (forbidden) codes distinguish the two cases.