I learned about Authentication and Authorization for Backend Engineering.
Their types and common practices to use the different types,

1. Stateful - web
2. Stateless - APIs , scalable systems
3. OAuth - Third party integration
4. API key based - server to server

and some Best Security Practices:

1. Error Message - provide generic message.

eg. "Authentication Failed" not "Incorrect Password"

1. Timing Attack - Attackers may find what's failing based on the response time.

eg. if username/email fails , server will respond faster than password failure, because for password hashing take some time. We can implement simulate response delay for username failure response to avoid this.