Embodiments of the present invention disclose a terminal authentication method in a passive optical network. The passive optical network includes an optical line terminal and at least one optical network terminal, where the optical line terminal is connected to the at least one optical network terminal by using an optical distribution network, and an authentication parameter is preconfigured on the optical line terminal. The method includes: receiving, by the optical line terminal, a registration request that carries an authentication parameter and is sent by the optical network terminal, where the authentication parameter is used to identify the optical network terminal of a same type; and determining, by the optical line terminal, that the authentication parameter sent by the optical network terminal matches the authentication parameter preconfigured on the optical line terminal, and authorizing that the optical network terminal is an authorized terminal. By using the foregoing technical solutions, an optical line terminal may be, during ONU registration and authentication, plug-and-play, without needing to manually input authentication information, which improves automation and flexibility of authentication.