diff --git a/plugins/auth-backend/api-report.md b/plugins/auth-backend/api-report.md
index 8cfc55c513..fb5f8ce86d 100644
--- a/plugins/auth-backend/api-report.md
+++ b/plugins/auth-backend/api-report.md
@@ -44,8 +44,6 @@ export class AtlassianAuthProvider implements OAuthHandlers {
   start(req: OAuthStartRequest): Promise<RedirectInfo>;
 }
 
-// Warning: (ae-missing-release-tag) "AtlassianProviderOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public @deprecated (undocumented)
 export type AtlassianProviderOptions = {
   authHandler?: AuthHandler<OAuthResult>;
@@ -54,8 +52,6 @@ export type AtlassianProviderOptions = {
   };
 };
 
-// Warning: (ae-missing-release-tag) "Auth0ProviderOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public @deprecated (undocumented)
 export type Auth0ProviderOptions = {
   authHandler?: AuthHandler<OAuthResult>;
@@ -75,8 +71,6 @@ export type AuthHandlerResult = {
   profile: ProfileInfo;
 };
 
-// Warning: (ae-missing-release-tag) "AuthProviderConfig" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public (undocumented)
 export type AuthProviderConfig = {
   baseUrl: string;
@@ -124,8 +118,6 @@ export interface AuthProviderRouteHandlers {
   start(req: express.Request, res: express.Response): Promise<void>;
 }
 
-// Warning: (ae-missing-release-tag) "AuthResolverCatalogUserQuery" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public
 export type AuthResolverCatalogUserQuery =
   | {
@@ -160,8 +152,6 @@ export type AuthResolverContext = {
   ): Promise<BackstageSignInResult>;
 };
 
-// Warning: (ae-missing-release-tag) "AuthResponse" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public (undocumented)
 export type AuthResponse<ProviderInfo> = {
   providerInfo: ProviderInfo;
@@ -169,8 +159,6 @@ export type AuthResponse<ProviderInfo> = {
   backstageIdentity?: BackstageIdentityResponse;
 };
 
-// Warning: (ae-missing-release-tag) "AwsAlbProviderOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public @deprecated (undocumented)
 export type AwsAlbProviderOptions = {
   authHandler?: AuthHandler<AwsAlbResult>;
@@ -179,6 +167,13 @@ export type AwsAlbProviderOptions = {
   };
 };
 
+// @public (undocumented)
+export type AwsAlbResult = {
+  fullProfile: Profile;
+  expiresInSeconds?: number;
+  accessToken: string;
+};
+
 // Warning: (ae-missing-release-tag) "BitbucketOAuthResult" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -210,8 +205,6 @@ export type BitbucketPassportProfile = Profile & {
   };
 };
 
-// Warning: (ae-missing-release-tag) "BitbucketProviderOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public @deprecated (undocumented)
 export type BitbucketProviderOptions = {
   authHandler?: AuthHandler<OAuthResult>;
@@ -262,8 +255,6 @@ export const createAtlassianProvider: (
     | undefined,
 ) => AuthProviderFactory;
 
-// Warning: (ae-missing-release-tag) "createAuth0Provider" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public @deprecated (undocumented)
 export const createAuth0Provider: (
   options?:
@@ -278,9 +269,7 @@ export const createAuth0Provider: (
     | undefined,
 ) => AuthProviderFactory;
 
-// Warning: (ae-missing-release-tag) "createAwsAlbProvider" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
+// @public @deprecated (undocumented)
 export const createAwsAlbProvider: (
   options?:
     | {
@@ -476,8 +465,6 @@ export const encodeState: (state: OAuthState) => string;
 // @public (undocumented)
 export const ensuresXRequestedWith: (req: express.Request) => boolean;
 
-// Warning: (ae-missing-release-tag) "GcpIapProviderOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public @deprecated (undocumented)
 export type GcpIapProviderOptions = {
   authHandler?: AuthHandler<GcpIapResult>;
@@ -520,8 +507,6 @@ export type GithubOAuthResult = {
   refreshToken?: string;
 };
 
-// Warning: (ae-missing-release-tag) "GithubProviderOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public @deprecated (undocumented)
 export type GithubProviderOptions = {
   authHandler?: AuthHandler<GithubOAuthResult>;
@@ -531,8 +516,6 @@ export type GithubProviderOptions = {
   stateEncoder?: StateEncoder;
 };
 
-// Warning: (ae-missing-release-tag) "GitlabProviderOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public @deprecated (undocumented)
 export type GitlabProviderOptions = {
   authHandler?: AuthHandler<OAuthResult>;
@@ -544,8 +527,6 @@ export type GitlabProviderOptions = {
 // @public @deprecated (undocumented)
 export const googleEmailSignInResolver: SignInResolver<OAuthResult>;
 
-// Warning: (ae-missing-release-tag) "GoogleProviderOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public @deprecated (undocumented)
 export type GoogleProviderOptions = {
   authHandler?: AuthHandler<OAuthResult>;
@@ -557,8 +538,6 @@ export type GoogleProviderOptions = {
 // @public @deprecated (undocumented)
 export const microsoftEmailSignInResolver: SignInResolver<OAuthResult>;
 
-// Warning: (ae-missing-release-tag) "MicrosoftProviderOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public @deprecated (undocumented)
 export type MicrosoftProviderOptions = {
   authHandler?: AuthHandler<OAuthResult>;
@@ -567,8 +546,6 @@ export type MicrosoftProviderOptions = {
   };
 };
 
-// Warning: (ae-missing-release-tag) "OAuth2ProviderOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public @deprecated (undocumented)
 export type OAuth2ProviderOptions = {
   authHandler?: AuthHandler<OAuthResult>;
@@ -577,8 +554,6 @@ export type OAuth2ProviderOptions = {
   };
 };
 
-// Warning: (ae-missing-release-tag) "Oauth2ProxyProviderOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public @deprecated (undocumented)
 export type Oauth2ProxyProviderOptions<JWTPayload> = {
   authHandler: AuthHandler<OAuth2ProxyResult<JWTPayload>>;
@@ -729,8 +704,6 @@ export type OidcAuthResult = {
   userinfo: UserinfoResponse;
 };
 
-// Warning: (ae-missing-release-tag) "OidcProviderOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public @deprecated (undocumented)
 export type OidcProviderOptions = {
   authHandler?: AuthHandler<OidcAuthResult>;
@@ -742,8 +715,6 @@ export type OidcProviderOptions = {
 // @public @deprecated (undocumented)
 export const oktaEmailSignInResolver: SignInResolver<OAuthResult>;
 
-// Warning: (ae-missing-release-tag) "OktaProviderOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public @deprecated (undocumented)
 export type OktaProviderOptions = {
   authHandler?: AuthHandler<OAuthResult>;
@@ -752,8 +723,6 @@ export type OktaProviderOptions = {
   };
 };
 
-// Warning: (ae-missing-release-tag) "OneLoginProviderOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public @deprecated (undocumented)
 export type OneLoginProviderOptions = {
   authHandler?: AuthHandler<OAuthResult>;
@@ -783,9 +752,7 @@ export type ProfileInfo = {
   picture?: string;
 };
 
-// Warning: (ae-missing-release-tag) "providers" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
+// @public
 export const providers: Readonly<{
   atlassian: Readonly<{
     create: (
@@ -1048,8 +1015,6 @@ export type SamlAuthResult = {
 // @public @deprecated (undocumented)
 export const samlNameIdEntityNameSignInResolver: SignInResolver<SamlAuthResult>;
 
-// Warning: (ae-missing-release-tag) "SamlProviderOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public @deprecated (undocumented)
 export type SamlProviderOptions = {
   authHandler?: AuthHandler<SamlAuthResult>;
@@ -1070,9 +1035,12 @@ export type SignInResolver<TAuthResult> = (
   context: AuthResolverContext,
 ) => Promise<BackstageSignInResult>;
 
-// Warning: (ae-missing-release-tag) "TokenIssuer" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public
+// @public (undocumented)
+export type StateEncoder = (req: OAuthStartRequest) => Promise<{
+  encodedState: string;
+}>;
+
+// @public @deprecated
 export type TokenIssuer = {
   issueToken(params: TokenParams): Promise<string>;
   listPublicKeys(): Promise<{
@@ -1080,8 +1048,6 @@ export type TokenIssuer = {
   }>;
 };
 
-// Warning: (ae-missing-release-tag) "TokenParams" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public
 export type TokenParams = {
   claims: {
@@ -1110,7 +1076,5 @@ export type WebMessageResponse =
 
 // Warnings were encountered during analysis:
 //
-// src/identity/types.d.ts:31:9 - (ae-forgotten-export) The symbol "AnyJWK" needs to be exported by the entry point index.d.ts
-// src/providers/aws-alb/provider.d.ts:73:5 - (ae-forgotten-export) The symbol "AwsAlbResult" needs to be exported by the entry point index.d.ts
-// src/providers/github/provider.d.ts:175:5 - (ae-forgotten-export) The symbol "StateEncoder" needs to be exported by the entry point index.d.ts
+// src/identity/types.d.ts:38:9 - (ae-forgotten-export) The symbol "AnyJWK" needs to be exported by the entry point index.d.ts
 ```
diff --git a/plugins/auth-backend/src/identity/types.ts b/plugins/auth-backend/src/identity/types.ts
index faafd2b68e..5a350284e5 100644
--- a/plugins/auth-backend/src/identity/types.ts
+++ b/plugins/auth-backend/src/identity/types.ts
@@ -22,7 +22,11 @@ export interface AnyJWK extends Record<string, string> {
   kty: string;
 }
 
-/** Parameters used to issue new ID Tokens */
+/**
+ * Parameters used to issue new ID Tokens
+ *
+ * @public
+ */
 export type TokenParams = {
   /** The claims that will be embedded within the token */
   claims: {
@@ -33,8 +37,12 @@ export type TokenParams = {
   };
 };
 
+// TODO(Rugvip): This should at least be made internal
 /**
  * A TokenIssuer is able to issue verifiable ID Tokens on demand.
+ *
+ * @public
+ * @deprecated This interface is deprecated and will be removed in a future release.
  */
 export type TokenIssuer = {
   /**
diff --git a/plugins/auth-backend/src/providers/atlassian/provider.ts b/plugins/auth-backend/src/providers/atlassian/provider.ts
index 1cb83d4589..2aa85dab96 100644
--- a/plugins/auth-backend/src/providers/atlassian/provider.ts
+++ b/plugins/auth-backend/src/providers/atlassian/provider.ts
@@ -162,6 +162,7 @@ export class AtlassianAuthProvider implements OAuthHandlers {
 }
 
 /**
+ * @public
  * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type AtlassianProviderOptions = {
diff --git a/plugins/auth-backend/src/providers/auth0/provider.ts b/plugins/auth-backend/src/providers/auth0/provider.ts
index beb2b5fba4..b4446caa95 100644
--- a/plugins/auth-backend/src/providers/auth0/provider.ts
+++ b/plugins/auth-backend/src/providers/auth0/provider.ts
@@ -168,6 +168,7 @@ export class Auth0AuthProvider implements OAuthHandlers {
 }
 
 /**
+ * @public
  * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type Auth0ProviderOptions = {
@@ -249,6 +250,7 @@ export const auth0 = createAuthProviderIntegration({
 });
 
 /**
+ * @public
  * @deprecated Use `providers.auth0.create` instead.
  */
 export const createAuth0Provider = auth0.create;
diff --git a/plugins/auth-backend/src/providers/aws-alb/index.ts b/plugins/auth-backend/src/providers/aws-alb/index.ts
index a8130b3575..710d86ca3d 100644
--- a/plugins/auth-backend/src/providers/aws-alb/index.ts
+++ b/plugins/auth-backend/src/providers/aws-alb/index.ts
@@ -15,4 +15,4 @@
  */
 
 export { createAwsAlbProvider } from './provider';
-export type { AwsAlbProviderOptions } from './provider';
+export type { AwsAlbProviderOptions, AwsAlbResult } from './provider';
diff --git a/plugins/auth-backend/src/providers/aws-alb/provider.ts b/plugins/auth-backend/src/providers/aws-alb/provider.ts
index ac699d6eda..741058ac7a 100644
--- a/plugins/auth-backend/src/providers/aws-alb/provider.ts
+++ b/plugins/auth-backend/src/providers/aws-alb/provider.ts
@@ -69,6 +69,7 @@ export type AwsAlbClaims = {
   iss: string;
 };
 
+/** @public */
 export type AwsAlbResult = {
   fullProfile: PassportProfile;
   expiresInSeconds?: number;
@@ -209,6 +210,7 @@ export class AwsAlbAuthProvider implements AuthProviderRouteHandlers {
 }
 
 /**
+ * @public
  * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type AwsAlbProviderOptions = {
@@ -279,4 +281,8 @@ export const awsAlb = createAuthProviderIntegration({
   },
 });
 
+/**
+ * @public
+ * @deprecated Use `providers.awsAlb.create` instead
+ */
 export const createAwsAlbProvider = awsAlb.create;
diff --git a/plugins/auth-backend/src/providers/bitbucket/provider.ts b/plugins/auth-backend/src/providers/bitbucket/provider.ts
index c448c222b4..c26c501666 100644
--- a/plugins/auth-backend/src/providers/bitbucket/provider.ts
+++ b/plugins/auth-backend/src/providers/bitbucket/provider.ts
@@ -193,6 +193,7 @@ export class BitbucketAuthProvider implements OAuthHandlers {
 }
 
 /**
+ * @public
  * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type BitbucketProviderOptions = {
diff --git a/plugins/auth-backend/src/providers/gcp-iap/types.ts b/plugins/auth-backend/src/providers/gcp-iap/types.ts
index 3ef8c049b9..6e5a022a3d 100644
--- a/plugins/auth-backend/src/providers/gcp-iap/types.ts
+++ b/plugins/auth-backend/src/providers/gcp-iap/types.ts
@@ -71,6 +71,7 @@ export type GcpIapProviderInfo = {
 export type GcpIapResponse = AuthResponse<GcpIapProviderInfo>;
 
 /**
+ * @public
  * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type GcpIapProviderOptions = {
diff --git a/plugins/auth-backend/src/providers/github/provider.ts b/plugins/auth-backend/src/providers/github/provider.ts
index 5f095ea414..9cc3a32b90 100644
--- a/plugins/auth-backend/src/providers/github/provider.ts
+++ b/plugins/auth-backend/src/providers/github/provider.ts
@@ -228,6 +228,7 @@ export class GithubAuthProvider implements OAuthHandlers {
 }
 
 /**
+ * @public
  * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type GithubProviderOptions = {
diff --git a/plugins/auth-backend/src/providers/gitlab/provider.ts b/plugins/auth-backend/src/providers/gitlab/provider.ts
index b8de3845a5..0cff94a0d5 100644
--- a/plugins/auth-backend/src/providers/gitlab/provider.ts
+++ b/plugins/auth-backend/src/providers/gitlab/provider.ts
@@ -179,6 +179,7 @@ export class GitlabAuthProvider implements OAuthHandlers {
 }
 
 /**
+ * @public
  * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type GitlabProviderOptions = {
diff --git a/plugins/auth-backend/src/providers/google/provider.ts b/plugins/auth-backend/src/providers/google/provider.ts
index bc05104ec6..277c3144b0 100644
--- a/plugins/auth-backend/src/providers/google/provider.ts
+++ b/plugins/auth-backend/src/providers/google/provider.ts
@@ -168,6 +168,7 @@ export class GoogleAuthProvider implements OAuthHandlers {
 }
 
 /**
+ * @public
  * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type GoogleProviderOptions = {
diff --git a/plugins/auth-backend/src/providers/index.ts b/plugins/auth-backend/src/providers/index.ts
index c3ecfe8913..1f33a60e55 100644
--- a/plugins/auth-backend/src/providers/index.ts
+++ b/plugins/auth-backend/src/providers/index.ts
@@ -34,8 +34,6 @@ export { providers } from './providers';
 
 export { factories as defaultAuthProviderFactories } from './factories';
 
-// Export the minimal interface required for implementing a
-// custom Authorization Handler
 export type {
   AuthProviderConfig,
   AuthProviderRouteHandlers,
@@ -48,10 +46,9 @@ export type {
   SignInResolver,
   SignInInfo,
   CookieConfigurer,
+  StateEncoder,
+  AuthResponse,
+  ProfileInfo,
 } from './types';
 
-// These types are needed for a postMessage from the login pop-up
-// to the frontend
-export type { AuthResponse, ProfileInfo } from './types';
-
 export { prepareBackstageIdentityResponse } from './prepareBackstageIdentityResponse';
diff --git a/plugins/auth-backend/src/providers/microsoft/provider.ts b/plugins/auth-backend/src/providers/microsoft/provider.ts
index bbb4afae40..bbd17944ee 100644
--- a/plugins/auth-backend/src/providers/microsoft/provider.ts
+++ b/plugins/auth-backend/src/providers/microsoft/provider.ts
@@ -187,6 +187,7 @@ export class MicrosoftAuthProvider implements OAuthHandlers {
 }
 
 /**
+ * @public
  * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type MicrosoftProviderOptions = {
diff --git a/plugins/auth-backend/src/providers/oauth2-proxy/provider.ts b/plugins/auth-backend/src/providers/oauth2-proxy/provider.ts
index a7a8befd5e..374811198f 100644
--- a/plugins/auth-backend/src/providers/oauth2-proxy/provider.ts
+++ b/plugins/auth-backend/src/providers/oauth2-proxy/provider.ts
@@ -49,6 +49,7 @@ export type OAuth2ProxyResult<JWTPayload> = {
 };
 
 /**
+ * @public
  * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type Oauth2ProxyProviderOptions<JWTPayload> = {
diff --git a/plugins/auth-backend/src/providers/oauth2/provider.ts b/plugins/auth-backend/src/providers/oauth2/provider.ts
index 7af10a522f..8b0eac948a 100644
--- a/plugins/auth-backend/src/providers/oauth2/provider.ts
+++ b/plugins/auth-backend/src/providers/oauth2/provider.ts
@@ -186,6 +186,7 @@ export class OAuth2AuthProvider implements OAuthHandlers {
 }
 
 /**
+ * @public
  * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type OAuth2ProviderOptions = {
diff --git a/plugins/auth-backend/src/providers/oidc/provider.ts b/plugins/auth-backend/src/providers/oidc/provider.ts
index 71f58df354..ed6bdf8c34 100644
--- a/plugins/auth-backend/src/providers/oidc/provider.ts
+++ b/plugins/auth-backend/src/providers/oidc/provider.ts
@@ -199,6 +199,7 @@ export class OidcAuthProvider implements OAuthHandlers {
 }
 
 /**
+ * @public
  * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type OidcProviderOptions = {
diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts
index edbca32c7c..471052b832 100644
--- a/plugins/auth-backend/src/providers/okta/provider.ts
+++ b/plugins/auth-backend/src/providers/okta/provider.ts
@@ -189,6 +189,7 @@ export class OktaAuthProvider implements OAuthHandlers {
 }
 
 /**
+ * @public
  * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type OktaProviderOptions = {
diff --git a/plugins/auth-backend/src/providers/onelogin/provider.ts b/plugins/auth-backend/src/providers/onelogin/provider.ts
index 09e3eeeddb..06a57e4560 100644
--- a/plugins/auth-backend/src/providers/onelogin/provider.ts
+++ b/plugins/auth-backend/src/providers/onelogin/provider.ts
@@ -167,6 +167,7 @@ export class OneLoginProvider implements OAuthHandlers {
 }
 
 /**
+ * @public
  * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type OneLoginProviderOptions = {
diff --git a/plugins/auth-backend/src/providers/providers.ts b/plugins/auth-backend/src/providers/providers.ts
index 002a8eb9ae..3d49e2bbbb 100644
--- a/plugins/auth-backend/src/providers/providers.ts
+++ b/plugins/auth-backend/src/providers/providers.ts
@@ -30,6 +30,11 @@ import { okta } from './okta/provider';
 import { onelogin } from './onelogin/provider';
 import { saml } from './saml/provider';
 
+/**
+ * All built-in auth provider integrations.
+ *
+ * @public
+ */
 export const providers = Object.freeze({
   atlassian,
   auth0,
diff --git a/plugins/auth-backend/src/providers/saml/provider.ts b/plugins/auth-backend/src/providers/saml/provider.ts
index 3f4b7a960d..597dd24687 100644
--- a/plugins/auth-backend/src/providers/saml/provider.ts
+++ b/plugins/auth-backend/src/providers/saml/provider.ts
@@ -133,6 +133,7 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
 type SignatureAlgorithm = 'sha1' | 'sha256' | 'sha512';
 
 /**
+ * @public
  * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type SamlProviderOptions = {
diff --git a/plugins/auth-backend/src/providers/types.ts b/plugins/auth-backend/src/providers/types.ts
index b1e45bc8a9..128dea12ef 100644
--- a/plugins/auth-backend/src/providers/types.ts
+++ b/plugins/auth-backend/src/providers/types.ts
@@ -43,6 +43,8 @@ import { Entity } from '@backstage/catalog-model';
  *
  * Regardless of the query method, the query must match exactly one entity
  * in the catalog, or an error will be thrown.
+ *
+ * @public
  */
 export type AuthResolverCatalogUserQuery =
   | {
@@ -112,6 +114,7 @@ export type CookieConfigurer = (ctx: {
   callbackUrl: string;
 }) => { domain: string; path: string; secure: boolean };
 
+/** @public */
 export type AuthProviderConfig = {
   /**
    * The protocol://domain[:port] where the app is hosted. This is used to construct the
@@ -232,6 +235,7 @@ export type AuthProviderFactory = (options: {
   catalogApi: CatalogApi;
 }) => AuthProviderRouteHandlers;
 
+/** @public */
 export type AuthResponse<ProviderInfo> = {
   providerInfo: ProviderInfo;
   profile: ProfileInfo;
@@ -319,6 +323,7 @@ export type AuthHandler<TAuthResult> = (
   context: AuthResolverContext,
 ) => Promise<AuthHandlerResult>;
 
+/** @public */
 export type StateEncoder = (
   req: OAuthStartRequest,
 ) => Promise<{ encodedState: string }>;