Web & APIs · SupportRoadmap Docs
Authentication basics for software support
Authentication proves who the user or integration is. In SaaS support that usually means sessions, cookies, API keys, or bearer tokens. A 401 often means “not authenticated or credential invalid”; a 403 often means “authenticated, but not allowed.” Exact behaviour is product-specific.
By Tom Ulman · Published · Last reviewed
What authentication means in SaaS tickets
Authentication answers “who is this?” Authorisation answers “what may they do?” Customers blur the two (“I can’t log in” vs “I can log in but Billing is locked”). Your job is to separate session/credential problems from permission or plan problems before escalating.
Common mechanisms you will see
- Sessions and cookies — browser stays signed in until expiry or logout; clearing cookies often “fixes” stuck sessions.
- API keys — long-lived secrets for integrations; rotation and scope mistakes cause sudden 401s.
- Bearer / access tokens — short-lived tokens on Authorization headers; expiry looks like intermittent failure.
- SSO / OAuth — identity lives with another provider; misconfigured redirects or claim mapping break only SSO users.
401 vs 403 in practice
A 401 usually means the product does not accept the credential (missing, expired, or wrong). A 403 usually means the identity is known but blocked by role, org, feature flag, or plan. Confirm which user and org you are inspecting before changing passwords or roles. Details: HTTP status codes for software support.
Safety
- Never ask customers to paste full session cookies or raw tokens into email.
- HARs often contain auth material—review before sharing (HAR files).
- Prefer product-safe repro steps: incognito, second user, API key last-four, request ID.
Common mistakes
- Resetting passwords for a 403 that is really a role or plan limit.
- Testing while still signed in as yourself in another org.
- Assuming SSO failures are “password problems” without checking the IdP error.
Related concepts
Primary sources
Prefer an ordered path? Open the related roadmap skill and work through it with the curated resources.
Practise this skill