Authentication is the process that answers the question: Who are you?
In an API, this means: verifying that the token, password, or session credential you presented is real, valid, and actually belongs to the person making the request.
Authentication is the lock on the front door. If the lock can be picked, cloned, or bypassed entirely — it doesn't matter how good the alarm system is inside.
Broken authentication means the lock is broken. Once an attacker is inside, everything else is exposed.
• A token that can be stolen by clicking a link (Fortnite)
• A login endpoint with no limit on password attempts
• A JWT token the API accepts without verifying the signature
• A "change email" endpoint that doesn't ask for the current password
Each of these is a different way the same thing breaks: the system that's supposed to confirm your identity.