Authorization

Authentication confirms who someone is. Authorization decides what someone can do. FusionAuth offers several options, from simple to complex:

Roles and groups give users permissions in each application. Your app reads the roles from the access token.
OAuth scopes limit what a client can do on behalf of a user.
Fine-grained authorization with a service such as Permify models permissions on individual resources.
Token exchange lets a service call another service on behalf of the original user.
An API gateway enforces access before requests reach your services.

For the difference between authentication and authorization, see Authentication and Authorization.

Access Control with OAuth Scopes

Learn about OAuth scope policy configuration, managing custom scopes, and using scopes in an OAuth2 workflow.

Fine-Grained Authorization

Learn how to add fine-grained authorization to FusionAuth with Permify.

OAuth Token Exchange

Learn how FusionAuth implements OAuth 2.0 Token Exchange (RFC 8693) so that a service can call another service on behalf of a user.

Delegate Access With Token Exchange

Configure FusionAuth so that one service can exchange a User's access token for a token that calls another service on that User's behalf.

Control MCP Server Access

Learn how to protect Model Context Protocol (MCP) servers with OAuth authentication using FusionAuth.

Learn about the difference between authentication and authorization in FusionAuth.

Learn about the core types in FusionAuth and how they interact to manage authentication and authorization.

API documentation for the FusionAuth Create an Application Role API.

API documentation for the FusionAuth Delete an Application Role API.