How to write about it — API security: authentication is not authorization

Recommended structure

1. IntroductionA valid login does not grant access to every customer record. Learn which checks your API needs.
2. Authentication: who are you?Authentication checks identity through a session, token or identity provider. Validate credentials and expiration on the server and use HTTPS. A token proves a login, not universal permission. Keep it out of logs.
3. Authorization: can you access this record?If a user changes /customers/12 to /customers/13, the API must check access to customer 13. In a multi-tenant CRM, scope queries to the authorized organization and verify reads and writes. Hiding frontend buttons is not sufficient.
4. Validate and limit requestsAccept only expected fields, validate types and bound uploads and list sizes. Add appropriate rate limits. Test cross-account access and privilege changes explicitly; a happy-path login test will not detect those failures.
5. ConclusionVerify identity and resource-specific permissions for every protected operation.