diff --git a/plugins/auth-node/src/oauth/createOAuthProviderFactory.ts b/plugins/auth-node/src/oauth/createOAuthProviderFactory.ts
index 6120bb528a..282fa6fad9 100644
--- a/plugins/auth-node/src/oauth/createOAuthProviderFactory.ts
+++ b/plugins/auth-node/src/oauth/createOAuthProviderFactory.ts
@@ -35,11 +35,11 @@ export function createOAuthProviderFactory<TProfile>(options: {
     return OAuthEnvironmentHandler.mapConfig(ctx.config, envConfig => {
       return createOAuthRouteHandlers<TProfile>({
         authenticator: options.authenticator,
-        appUrl: ctx.globalConfig.appUrl,
-        baseUrl: ctx.globalConfig.baseUrl,
+        appUrl: ctx.appUrl,
+        baseUrl: ctx.baseUrl,
         config: envConfig,
-        isOriginAllowed: ctx.globalConfig.isOriginAllowed,
-        cookieConfigurer: ctx.globalConfig.cookieConfigurer,
+        isOriginAllowed: ctx.isOriginAllowed,
+        cookieConfigurer: ctx.cookieConfigurer,
         providerId: ctx.providerId,
         resolverContext: ctx.resolverContext,
         stateTransform: options.stateTransform,
diff --git a/plugins/auth-node/src/types.ts b/plugins/auth-node/src/types.ts
index 409ad71ff9..f1d7063700 100644
--- a/plugins/auth-node/src/types.ts
+++ b/plugins/auth-node/src/types.ts
@@ -215,7 +215,10 @@ export interface AuthProviderRouteHandlers {
   logout?(req: Request, res: Response): Promise<void>;
 }
 
-/** @public */
+/**
+ * @public
+ * @deprecated Use top-level properties passed to `AuthProviderFactory` instead
+ */
 export type AuthProviderConfig = {
   /**
    * The protocol://domain[:port] where the app is hosted. This is used to construct the
@@ -242,15 +245,36 @@ export type AuthProviderConfig = {
 /** @public */
 export type AuthProviderFactory = (options: {
   providerId: string;
+  /** @deprecated Use top-level properties instead */
   globalConfig: AuthProviderConfig;
   config: Config;
   logger: LoggerService;
   resolverContext: AuthResolverContext;
+  /**
+   * The protocol://domain[:port] where the app is hosted. This is used to construct the
+   * callbackURL to redirect to once the user signs in to the auth provider.
+   */
+  baseUrl: string;
+
+  /**
+   * The base URL of the app as provided by app.baseUrl
+   */
+  appUrl: string;
+
+  /**
+   * A function that is called to check whether an origin is allowed to receive the authentication result.
+   */
+  isOriginAllowed: (origin: string) => boolean;
+
+  /**
+   * The function used to resolve cookie configuration based on the auth provider options.
+   */
+  cookieConfigurer?: CookieConfigurer;
 }) => AuthProviderRouteHandlers;
 
 /** @public */
-export type ClientAuthResponse<ProviderInfo> = {
-  providerInfo: ProviderInfo;
+export type ClientAuthResponse<TProviderInfo> = {
+  providerInfo: TProviderInfo;
   profile: ProfileInfo;
   backstageIdentity?: BackstageIdentityResponse;
 };