Authentication is the check of who is sending this request. The server matches credentials such as a password or a token against its registered user records to identify the sender. If authentication fails, the server returns 401.

Authorization is the check of whether that identified sender may perform this operation. The server matches the permissions granted to that sender against the action being attempted. If authorization fails, the server returns 403.

A request can pass authentication and still fail authorization. For example, when a logged-in user tries to delete someone else's resource, the server can identify the sender but doesn't allow the action, so it returns 403. The two are separate checks, so the same request can pass one and fail the other.