The core idea

Proving who is making a request.

Authentication answers 'who are you?' — verifying identity before the backend trusts a request to act on someone's behalf.