Authentication is the process of verifying that a user, device, or system is who or what it claims to be before granting access. It’s the checkpoint between a claimed identity and the resources behind it, the step that answers "prove it" after someone says who they are.

Authentication is often confused with authorization, but they’re sequential and distinct: authentication confirms identity, authorization then decides what that confirmed identity is allowed to do. You authenticate first; you’re authorized second.

The three classic factors

Authentication relies on one or more categories of evidence, the "factors":

• Something you know: a password, PIN, or answer to a security question. The weakest category, because knowledge can be phished, guessed, or leaked in a breach.
• Something you have: a phone, a hardware security key, a registered device, or a passkey. Possession is far harder to steal at scale.
• Something you are, a biometric like a fingerprint or face. Inherent to the person and convenient, though it must be handled carefully for privacy.

Combining factors from different categories is what makes multi-factor authentication strong. Two passwords aren’t two factors; a passkey plus a fingerprint are.

Why authentication is the front line

For any customer-facing business, authentication is where attackers concentrate. Credentials leak constantly in third-party breaches, then get replayed against your login through credential stuffing. Phishing harvests passwords and even one-time codes. Once an attacker authenticates successfully, they look exactly like your customer, which is why what happens after login (behavioral and device signals) matters as much as the login itself.

The shift away from passwords

The direction of travel is clear: away from shared secrets and toward possession- and biometric-based methods that can’t be phished. Passwords are the root of most credential attacks, so removing them, not just hiding them behind a prompt, closes the largest single hole in authentication. Passkeys and FIDO2 are the standards making that practical at consumer scale.

Authentication as a continuous decision

Modern thinking treats authentication less as a one-time gate and more as an ongoing assessment. Risk-based and continuous approaches keep evaluating signals after login (the device, location, and behavior) so trust can be revisited if something looks wrong mid-session. In a fused identity-and-fraud platform, that authentication signal and the fraud engine’s judgment feed the same decision, which is how a business can grant access confidently and still catch a session that turns hostile.

How authentication has evolved

The history of authentication is a steady retreat from the shared secret. Passwords came first and dominated for decades, despite being reusable, forgettable, and phishable. When passwords alone proved insufficient, the industry layered on second factors (SMS codes, then authenticator apps, then push) to raise the bar without removing the password underneath. That helped, but attackers adapted, learning to phish one-time codes in real time and to spam push prompts until someone approved.

The current phase removes the secret entirely. Passkeys, built on FIDO2, replace "something you type" with a cryptographic proof bound to your device and the legitimate site. Each step in this arc traded a little convenience-through-familiarity for a lot of security, and the destination (no shared secret at all) is where the strongest authentication now sits.

Common authentication mistakes

A few recurring errors undermine otherwise reasonable programs. Relying on a single phishable factor (a password, or a password plus SMS) and calling it secure. Applying the same heavy authentication to every action, which trains users to click through prompts mindlessly. Hardening the login while leaving account recovery on a weak method like SMS OTP, so attackers simply attack the recovery path. And treating authentication as a one-time event, when session hijacking and device takeover happen after a legitimate login. The through-line: strong authentication is about the weakest path into an account, not the strongest one you advertise.

Authenticating machines and AI agents

Authentication used to mean proving a human. Increasingly it also means proving a non-human: a service, a workload, or (the fast-emerging case) an AI agent acting on a customer’s behalf. These identities often outnumber human accounts, and they authenticate with keys, certificates, and tokens rather than passwords or biometrics. The hard part is that a machine identity, once issued a long-lived credential, can become a standing risk if that credential leaks or the machine is compromised.

The direction for AI agents specifically is toward ephemeral, tightly scoped authentication: instead of handing an agent broad, lasting access, the system issues short-lived, narrowly-scoped authority for exactly the task at hand, then revokes it. This keeps the blast radius small if an agent is hijacked or behaves unexpectedly. For customer-facing businesses, the question is shifting from "is this the account owner?" to "is this the owner, or an agent they legitimately authorized, and is it doing only what it’s allowed to?", which pulls authentication and fine-grained authorization tightly together.

Frequently asked questions

What are the three factors of authentication?

Something you know (password), something you have (device or passkey), and something you are (biometric).

What’s the difference between authentication and authorization?

Authentication proves who you are; authorization decides what you can do.

What is the most secure form of authentication?

Phishing-resistant methods like passkeys (FIDO2/WebAuthn) are considered the strongest widely available option.

Is a password alone enough?

No, passwords are easily phished or leaked, which is why MFA and passwordless methods exist.

Related: Authentication vs. Authorization · Multi-Factor Authentication (MFA) · Passwordless Authentication · Passkeys · Credential Stuffing