diff --git a/packages/cli/src/lib/bundler/config.ts b/packages/cli/src/lib/bundler/config.ts
index aab244f7e9..0eaac9ad2d 100644
--- a/packages/cli/src/lib/bundler/config.ts
+++ b/packages/cli/src/lib/bundler/config.ts
@@ -34,7 +34,7 @@ import { BundlingOptions, BackendBundlingOptions } from './types';
 export function resolveBaseUrl(config: Config): URL {
   const baseUrl = config.getString('app.baseUrl');
   try {
-    return new URL(baseUrl, 'http://localhost:3000');
+    return new URL(baseUrl);
   } catch (error) {
     throw new Error(`Invalid app.baseUrl, ${error}`);
   }
@@ -49,7 +49,7 @@ export function createConfig(
   const { plugins, loaders } = transforms(options);
 
   const baseUrl = options.config.getString('app.baseUrl');
-  const validBaseUrl = new URL(baseUrl, 'https://backstage-app.dev');
+  const validBaseUrl = new URL(baseUrl);
 
   if (checksEnabled) {
     plugins.push(
diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index 973b78858f..6b296cba2d 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -36,14 +36,18 @@ export async function createRouter(
   const router = Router();
   const logger = options.logger.child({ plugin: 'auth' });
 
-  const baseUrl = `${options.config.getString('backend.baseUrl')}/auth`;
+  const appUrl = new URL(options.config.getString('app.baseUrl'));
+  const appOrigin = appUrl.origin;
+  const backendUrl = options.config.getString('backend.baseUrl');
+  const authUrl = `${backendUrl}/auth`;
+
   const keyDurationSeconds = 3600;
 
   const keyStore = await DatabaseKeyStore.create({
     database: options.database,
   });
   const tokenIssuer = new TokenFactory({
-    issuer: baseUrl,
+    issuer: authUrl,
     keyStore,
     keyDurationSeconds,
     logger: logger.child({ component: 'token-factory' }),
@@ -53,16 +57,15 @@ export async function createRouter(
   router.use(bodyParser.urlencoded({ extended: false }));
   router.use(bodyParser.json());
 
-  // TODO: read from app config
   const config = {
     backend: {
-      baseUrl: options.config.getString('backend.baseUrl'),
+      baseUrl: backendUrl,
     },
     auth: {
       providers: {
         google: {
           development: {
-            appOrigin: 'http://localhost:3000',
+            appOrigin,
             secure: false,
             clientId: process.env.AUTH_GOOGLE_CLIENT_ID!,
             clientSecret: process.env.AUTH_GOOGLE_CLIENT_SECRET!,
@@ -70,7 +73,7 @@ export async function createRouter(
         },
         github: {
           development: {
-            appOrigin: 'http://localhost:3000',
+            appOrigin,
             secure: false,
             clientId: process.env.AUTH_GITHUB_CLIENT_ID!,
             clientSecret: process.env.AUTH_GITHUB_CLIENT_SECRET!,
@@ -78,7 +81,7 @@ export async function createRouter(
         },
         gitlab: {
           development: {
-            appOrigin: 'http://localhost:3000',
+            appOrigin,
             secure: false,
             clientId: process.env.AUTH_GITLAB_CLIENT_ID!,
             clientSecret: process.env.AUTH_GITLAB_CLIENT_SECRET!,
@@ -93,7 +96,7 @@ export async function createRouter(
         },
         okta: {
           development: {
-            appOrigin: 'http://localhost:3000',
+            appOrigin,
             secure: false,
             clientId: process.env.AUTH_OKTA_CLIENT_ID!,
             clientSecret: process.env.AUTH_OKTA_CLIENT_SECRET!,
@@ -102,7 +105,7 @@ export async function createRouter(
         },
         oauth2: {
           development: {
-            appOrigin: 'http://localhost:3000',
+            appOrigin,
             secure: false,
             clientId: process.env.AUTH_OAUTH2_CLIENT_ID!,
             clientSecret: process.env.AUTH_OAUTH2_CLIENT_SECRET!,
@@ -121,7 +124,7 @@ export async function createRouter(
     try {
       const providerRouter = createAuthProviderRouter(
         providerId,
-        { baseUrl },
+        { baseUrl: authUrl },
         providerConfig,
         logger,
         tokenIssuer,
@@ -135,7 +138,7 @@ export async function createRouter(
   router.use(
     createOidcRouter({
       tokenIssuer,
-      baseUrl,
+      baseUrl: authUrl,
     }),
   );