diff --git a/plugins/permission-node/src/ServerPermissionClient.test.ts b/plugins/permission-node/src/ServerPermissionClient.test.ts
index eb8abefc95..9cff45a5aa 100644
--- a/plugins/permission-node/src/ServerPermissionClient.test.ts
+++ b/plugins/permission-node/src/ServerPermissionClient.test.ts
@@ -22,7 +22,11 @@ import {
   DefinitivePolicyDecision,
   ConditionalPolicyDecision,
 } from '@backstage/plugin-permission-common';
-import { setupRequestMockHandlers } from '@backstage/backend-test-utils';
+import {
+  mockCredentials,
+  mockServices,
+  setupRequestMockHandlers,
+} from '@backstage/backend-test-utils';
 import { ConfigReader } from '@backstage/config';
 import {
   getVoidLogger,
@@ -201,4 +205,146 @@ describe('ServerPermissionClient', () => {
       expect(mockAuthorizeHandler).toHaveBeenCalled();
     });
   });
+
+  describe('with credentials', () => {
+    describe('authorize', () => {
+      let mockAuthorizeHandler: jest.Mock;
+
+      beforeEach(() => {
+        mockAuthorizeHandler = jest.fn((req, res, { json }: RestContext) => {
+          const responses = req.body.items.map(
+            (r: IdentifiedPermissionMessage<DefinitivePolicyDecision>) => ({
+              id: r.id,
+              result: AuthorizeResult.ALLOW,
+            }),
+          );
+
+          return res(json({ items: responses }));
+        });
+
+        server.use(rest.post(`${mockBaseUrl}/authorize`, mockAuthorizeHandler));
+      });
+
+      it('should bypass the permission backend if permissions are disabled', async () => {
+        const client = ServerPermissionClient.fromConfig(new ConfigReader({}), {
+          discovery,
+          tokenManager: ServerTokenManager.noop(),
+          auth: mockServices.auth(),
+        });
+
+        await client.authorize(
+          [
+            {
+              permission: testBasicPermission,
+            },
+          ],
+          { credentials: mockCredentials.none() },
+        );
+
+        expect(mockAuthorizeHandler).not.toHaveBeenCalled();
+      });
+
+      it('should bypass the permission backend if permissions are enabled and request has valid server token', async () => {
+        const tokenManager = ServerTokenManager.fromConfig(config, { logger });
+        const client = ServerPermissionClient.fromConfig(config, {
+          discovery,
+          tokenManager,
+          auth: mockServices.auth(),
+        });
+
+        await client.authorize([{ permission: testBasicPermission }], {
+          credentials: mockCredentials.service(),
+        });
+
+        expect(mockAuthorizeHandler).not.toHaveBeenCalled();
+      });
+
+      it('should call the permission backend if permissions are enabled and request does not have valid server token', async () => {
+        const tokenManager = ServerTokenManager.fromConfig(config, { logger });
+        const client = ServerPermissionClient.fromConfig(config, {
+          discovery,
+          tokenManager,
+          auth: mockServices.auth(),
+        });
+
+        await client.authorize([{ permission: testBasicPermission }], {
+          credentials: mockCredentials.user(),
+        });
+
+        expect(mockAuthorizeHandler).toHaveBeenCalled();
+      });
+    });
+
+    describe('authorizeConditional', () => {
+      let mockAuthorizeHandler: jest.Mock;
+
+      beforeEach(() => {
+        mockAuthorizeHandler = jest.fn((req, res, { json }: RestContext) => {
+          const responses = req.body.items.map(
+            (r: IdentifiedPermissionMessage<ConditionalPolicyDecision>) => ({
+              id: r.id,
+              result: AuthorizeResult.ALLOW,
+            }),
+          );
+
+          return res(json({ items: responses }));
+        });
+
+        server.use(rest.post(`${mockBaseUrl}/authorize`, mockAuthorizeHandler));
+      });
+
+      it('should bypass the permission backend if permissions are disabled', async () => {
+        const client = ServerPermissionClient.fromConfig(new ConfigReader({}), {
+          discovery,
+          tokenManager: ServerTokenManager.noop(),
+          auth: mockServices.auth(),
+        });
+
+        await client.authorizeConditional(
+          [{ permission: testResourcePermission }],
+          {
+            credentials: mockCredentials.none(),
+          },
+        );
+
+        expect(mockAuthorizeHandler).not.toHaveBeenCalled();
+      });
+
+      it('should bypass the permission backend if permissions are enabled and request has valid server token', async () => {
+        const tokenManager = ServerTokenManager.fromConfig(config, { logger });
+        const client = ServerPermissionClient.fromConfig(config, {
+          discovery,
+          tokenManager,
+          auth: mockServices.auth(),
+        });
+
+        await client.authorizeConditional(
+          [{ permission: testResourcePermission }],
+          {
+            credentials: mockCredentials.service(),
+          },
+        );
+
+        expect(mockAuthorizeHandler).not.toHaveBeenCalled();
+      });
+
+      it('should call the permission backend if permissions are enabled and request does not have valid server token', async () => {
+        const tokenManager = ServerTokenManager.fromConfig(config, { logger });
+        const client = ServerPermissionClient.fromConfig(config, {
+          discovery,
+          tokenManager,
+          auth: mockServices.auth(),
+        });
+
+        await client.authorizeConditional(
+          [{ permission: testResourcePermission }],
+          {
+            credentials: mockCredentials.user(),
+          },
+        );
+
+        expect(mockAuthorizeHandler).toHaveBeenCalled();
+      });
+    });
+  });
 });