# Authorization

Learn the options FusionAuth offers for controlling what users and clients can do after they log in.

> For the index of this section of the site, see [llms.txt](https://fusionauth.io/docs/llms.txt)

Authentication confirms who someone is. Authorization decides what someone can do. FusionAuth offers several options, from simple to complex:

*   [Roles](https://fusionauth.io/docs/concepts/types/roles.md) and [groups](https://fusionauth.io/docs/concepts/types/groups.md) give users permissions in each application. Your app reads the roles from the access token.
*   [OAuth scopes](https://fusionauth.io/docs/authorization/oauth-scopes.md) limit what a client can do on behalf of a user.
*   [Fine-grained authorization](https://fusionauth.io/docs/authorization/fine-grained-authorization.md) with a service such as Permify models permissions on individual resources.
*   [Token exchange](https://fusionauth.io/docs/authorization/token-exchange.md) lets a service call another service on behalf of the original user.
*   An [API gateway](https://fusionauth.io/docs/authorization/api-gateways.md) enforces access before requests reach your services.

For the difference between authentication and authorization, see [Authentication and Authorization](https://fusionauth.io/docs/concepts/authentication-authorization.md).

[Access Control with OAuth Scopes Learn about OAuth scope policy configuration, managing custom scopes, and using scopes in an OAuth2 workflow.](https://fusionauth.io/docs/authorization/oauth-scopes.md)

[Fine-Grained Authorization Learn how to add fine-grained authorization to FusionAuth with Permify.](https://fusionauth.io/docs/authorization/fine-grained-authorization.md)

[OAuth Token Exchange Learn how FusionAuth implements OAuth 2.0 Token Exchange (RFC 8693) so that a service can call another service on behalf of a user.](https://fusionauth.io/docs/authorization/token-exchange.md)

[Delegate Access With Token Exchange Configure FusionAuth so that one service can exchange a User's access token for a token that calls another service on that User's behalf.](https://fusionauth.io/docs/authorization/token-exchange-delegation.md)

[Control MCP Server Access Learn how to protect Model Context Protocol (MCP) servers with OAuth authentication using FusionAuth.](https://fusionauth.io/docs/authorization/mcp-server-access.md)

Related

[Concepts Authentication and Authorization Learn about the difference between authentication and authorization in FusionAuth. authorizationaccess control](https://fusionauth.io/docs/concepts/authentication-authorization.md)

[Concepts Core Types Learn about the core types in FusionAuth and how they interact to manage authentication and authorization. groupsroles](https://fusionauth.io/docs/concepts/types.md)

[APIs Create an Application Role API API documentation for the FusionAuth Create an Application Role API. authorization](https://fusionauth.io/docs/apis/applications/create-an-application-role.md)

[APIs Delete an Application Role API API documentation for the FusionAuth Delete an Application Role API. authorization](https://fusionauth.io/docs/apis/applications/delete-an-application-role.md)