Step 6 of 7
Authentication and authorization
Authentication is 'who are you?' (login). Authorization is 'what are you allowed to do?' JWTs are signed tokens that carry identity; OAuth is how 'Sign in with Google' works. Both must be verified on the server.
Why it matters when you build with AI: The most damaging vibe-coding bug: hiding a button in the UI but leaving the data readable through the API.
Quick check
if (user) before editing a record checks…
You also need user.id === record.owner_id: are they allowed?