Authorization

With authentication, you make sure API consumers are correctly identified, and their access is controlled. Authorization happens right after, and its goal is to establish what authenticated users are allowed to do when accessing your API.

RBAC

One popular authorization model is role-based access control (RBAC). It works by first establishing a set of roles and then associating roles with permitted actions. Examples of common roles include the “administrator” and the “regular user.” Each feature then has to verify what role the API consumer has and if the requested action is listed as permitted for that role.

It’s important to highlight that, to be considered effective, RBAC has to be enforced at the interface level and then on each feature that the API server implements. Otherwise, you might end up letting users perform actions for which they don’t have the right permission. It’s possible to implement RBAC at the...