---

title: "Authentication and Authorization"
date: '2026-09-29'
excerpt: "Learn how to implement authentication and authorization in your .NET API."


---


## Introduction

Authentication and authorization are two related but distinct concepts used to secure an API.

- **Authentication** answers: "Who are you?"
- **Authorization** answers: "What are you allowed to do?"

### Lessons

1. [Authentication](/learn/dotnet-api/05-auth/01-authentication) — custom IAM, HS256 JWT, refresh rotation
2. [Authorization](/learn/dotnet-api/05-auth/02-authorization) — roles, policies, `permission` claims, resource auth
3. [Gateway JWT](/learn/dotnet-api/05-auth/03-gateway-jwt) — shared `AddMyAppAuth`, YARP, multi-service claim checks