Definition
Authentication is the act of proving identity. In a VPN context, two distinct authentications happen in every connection. First, the client authenticates the server — confirming you are connecting to the real VPN server and not an attacker impersonating it. This is normally done by validating the server's TLS certificate against a known Certificate Authority. Second, the server authenticates the client — confirming you are an entitled subscriber. This is done with a username and password, a pre-shared key, a certificate, a token, or a combination.
Authentication vs Authorization
These two terms are often confused. Authentication answers 'who are you?' Authorization answers 'what are you allowed to do?' A VPN session must clear both checks: you prove who you are, and the server then decides which servers, regions, or features your account is permitted to access.
Strengthening Authentication
Username and password alone are weak. Modern VPN deployments add a second factor: a time-based one-time password from an authenticator app (TOTP), a hardware security key (FIDO2/WebAuthn), or a push notification. Enterprise VPNs frequently integrate with single sign-on systems and may require client-side certificates installed on managed devices. The shift toward Zero Trust architectures has made continuous authentication — re-verifying identity throughout a session, not just at login — increasingly common.