diff --git a/packages/backend-app-api/api-report.md b/packages/backend-app-api/api-report.md
index 5ea5b2bcc9..88fa34e6e4 100644
--- a/packages/backend-app-api/api-report.md
+++ b/packages/backend-app-api/api-report.md
@@ -4,9 +4,7 @@
 
 ```ts
 import { BackendFeature } from '@backstage/backend-plugin-api';
-import { IdentityService } from '@backstage/backend-plugin-api';
 import { ServiceFactory } from '@backstage/backend-plugin-api';
-import { TokenManagerService } from '@backstage/backend-plugin-api';
 
 // @public (undocumented)
 export interface Backend {
@@ -34,18 +32,4 @@ export interface CreateSpecializedBackendOptions {
   // (undocumented)
   defaultServiceFactories: ServiceFactory[];
 }
-
-// @public @deprecated (undocumented)
-export const identityServiceFactory: ServiceFactory<
-  IdentityService,
-  'plugin',
-  'singleton'
->;
-
-// @public @deprecated (undocumented)
-export const tokenManagerServiceFactory: ServiceFactory<
-  TokenManagerService,
-  'plugin',
-  'singleton'
->;
 ```
diff --git a/packages/backend-app-api/src/index.ts b/packages/backend-app-api/src/index.ts
index 02633f3732..c58379c3e4 100644
--- a/packages/backend-app-api/src/index.ts
+++ b/packages/backend-app-api/src/index.ts
@@ -21,4 +21,3 @@
  */
 
 export * from './wiring';
-export * from './services/implementations';
diff --git a/packages/backend-app-api/src/services/implementations/identity/identityServiceFactory.ts b/packages/backend-app-api/src/services/implementations/identity/identityServiceFactory.ts
deleted file mode 100644
index ccae77affa..0000000000
--- a/packages/backend-app-api/src/services/implementations/identity/identityServiceFactory.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Copyright 2022 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import {
-  coreServices,
-  createServiceFactory,
-} from '@backstage/backend-plugin-api';
-import { DefaultIdentityClient } from '@backstage/plugin-auth-node';
-
-/**
- * @public
- * @deprecated Please migrate to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead
- */
-export const identityServiceFactory = createServiceFactory({
-  service: coreServices.identity,
-  deps: {
-    discovery: coreServices.discovery,
-  },
-  async factory({ discovery }) {
-    return DefaultIdentityClient.create({ discovery });
-  },
-});
diff --git a/packages/backend-app-api/src/services/implementations/identity/index.ts b/packages/backend-app-api/src/services/implementations/identity/index.ts
deleted file mode 100644
index 4c92217e6a..0000000000
--- a/packages/backend-app-api/src/services/implementations/identity/index.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright 2023 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-export { identityServiceFactory } from './identityServiceFactory';
diff --git a/packages/backend-app-api/src/services/implementations/index.ts b/packages/backend-app-api/src/services/implementations/index.ts
deleted file mode 100644
index 5f9bb9479a..0000000000
--- a/packages/backend-app-api/src/services/implementations/index.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright 2022 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-export * from './identity';
-export * from './tokenManager';
diff --git a/packages/backend-app-api/src/services/implementations/tokenManager/index.ts b/packages/backend-app-api/src/services/implementations/tokenManager/index.ts
deleted file mode 100644
index 3ae3d45d2f..0000000000
--- a/packages/backend-app-api/src/services/implementations/tokenManager/index.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright 2023 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-export { tokenManagerServiceFactory } from './tokenManagerServiceFactory';
diff --git a/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.test.ts b/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.test.ts
deleted file mode 100644
index dc52130ec6..0000000000
--- a/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.test.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Copyright 2022 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import { tokenManagerServiceFactory } from './tokenManagerServiceFactory';
-import { ServiceFactoryTester } from '@backstage/backend-test-utils';
-
-describe('tokenManagerFactory', () => {
-  it('should create a disabled manager without configuration', async () => {
-    const tokenManager = await ServiceFactoryTester.from(
-      tokenManagerServiceFactory,
-    ).getSubject();
-
-    await expect(tokenManager.authenticate('abc')).rejects.toThrow(
-      'no legacy keys are configured',
-    );
-    await expect(tokenManager.getToken()).rejects.toThrow(
-      'no legacy keys are configured',
-    );
-  });
-});
diff --git a/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.ts b/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.ts
deleted file mode 100644
index e7c4ce7af0..0000000000
--- a/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.ts
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright 2022 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import {
-  coreServices,
-  createServiceFactory,
-} from '@backstage/backend-plugin-api';
-import { ServerTokenManager } from '@backstage/backend-common';
-
-/**
- * @public
- * @deprecated Please migrate to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead
- */
-export const tokenManagerServiceFactory = createServiceFactory({
-  service: coreServices.tokenManager,
-  deps: {
-    config: coreServices.rootConfig,
-    logger: coreServices.rootLogger,
-  },
-  createRootContext({ config, logger }) {
-    return ServerTokenManager.fromConfig(config, {
-      logger,
-      allowDisabledTokenManager: true,
-    });
-  },
-  async factory(_deps, tokenManager) {
-    return tokenManager;
-  },
-});
diff --git a/packages/backend-common/api-report.md b/packages/backend-common/api-report.md
index d0b84edaa6..7de2731518 100644
--- a/packages/backend-common/api-report.md
+++ b/packages/backend-common/api-report.md
@@ -22,7 +22,6 @@ import Docker from 'dockerode';
 import { ErrorRequestHandler } from 'express';
 import express from 'express';
 import { HttpAuthService } from '@backstage/backend-plugin-api';
-import { IdentityService } from '@backstage/backend-plugin-api';
 import { isChildPath as isChildPath_2 } from '@backstage/backend-plugin-api';
 import { isDatabaseConflictError as isDatabaseConflictError_2 } from '@backstage/backend-plugin-api';
 import { KubeConfig } from '@kubernetes/client-node';
@@ -44,7 +43,6 @@ import { Router } from 'express';
 import { SchedulerService } from '@backstage/backend-plugin-api';
 import { Server } from 'http';
 import { ServiceRef } from '@backstage/backend-plugin-api';
-import { TokenManagerService } from '@backstage/backend-plugin-api';
 import { TransportStreamOptions } from 'winston-transport';
 import { UrlReaderService } from '@backstage/backend-plugin-api';
 import { UserInfoService } from '@backstage/backend-plugin-api';
@@ -101,7 +99,7 @@ export function createLegacyAuthAdapters<
     auth?: AuthService;
     httpAuth?: HttpAuthService;
     userInfo?: UserInfoService;
-    identity?: IdentityService;
+    identity?: LegacyIdentityService;
     tokenManager?: TokenManager;
     discovery: PluginEndpointDiscovery;
   },
@@ -547,7 +545,12 @@ export interface StatusCheckHandlerOptions {
 }
 
 // @public @deprecated (undocumented)
-export type TokenManager = TokenManagerService;
+export interface TokenManager {
+  authenticate(token: string): Promise<void>;
+  getToken(): Promise<{
+    token: string;
+  }>;
+}
 
 // @public @deprecated
 export function useHotCleanup(
diff --git a/packages/backend-common/src/compat/auth/createLegacyAuthAdapters.test.ts b/packages/backend-common/src/compat/auth/createLegacyAuthAdapters.test.ts
index 354b4a57dc..49494761bf 100644
--- a/packages/backend-common/src/compat/auth/createLegacyAuthAdapters.test.ts
+++ b/packages/backend-common/src/compat/auth/createLegacyAuthAdapters.test.ts
@@ -14,18 +14,28 @@
  * limitations under the License.
  */
 
-import { mockServices } from '@backstage/backend-test-utils';
 import { createLegacyAuthAdapters } from './createLegacyAuthAdapters';
 import { Request } from 'express';
+import { TokenManager } from '../../deprecated';
+
+const mockTokenManager: TokenManager = {
+  async getToken(): Promise<{ token: string }> {
+    return { token: 'mock-token' };
+  },
+  async authenticate(token: string): Promise<void> {
+    if (token !== 'mock-token') {
+      throw new Error('Invalid token');
+    }
+  },
+};
 
 describe('createLegacyAuthAdapters', () => {
   it('should pass through auth if only auth is provided', () => {
     const auth = {};
     const ret = createLegacyAuthAdapters({
       auth: auth as any,
-      tokenManager: mockServices.tokenManager(),
+      tokenManager: mockTokenManager,
       discovery: {} as any,
-      identity: mockServices.identity(),
     });
 
     expect(ret.auth).toBe(auth);
@@ -35,9 +45,8 @@ describe('createLegacyAuthAdapters', () => {
     const httpAuth = {};
     const ret = createLegacyAuthAdapters({
       httpAuth: httpAuth as any,
-      tokenManager: mockServices.tokenManager(),
+      tokenManager: mockTokenManager,
       discovery: {} as any,
-      identity: mockServices.identity(),
     });
 
     expect(ret.httpAuth).toBe(httpAuth);
@@ -49,9 +58,8 @@ describe('createLegacyAuthAdapters', () => {
     const ret = createLegacyAuthAdapters({
       auth: auth as any,
       httpAuth: httpAuth as any,
-      tokenManager: mockServices.tokenManager(),
+      tokenManager: mockTokenManager,
       discovery: {} as any,
-      identity: mockServices.identity(),
     });
 
     expect(ret.auth).toBe(auth);
@@ -64,9 +72,8 @@ describe('createLegacyAuthAdapters', () => {
     const ret = createLegacyAuthAdapters({
       auth: auth as any,
       userInfo: userInfo as any,
-      tokenManager: mockServices.tokenManager(),
+      tokenManager: mockTokenManager,
       discovery: {} as any,
-      identity: mockServices.identity(),
     });
 
     expect(ret.auth).toBe(auth);
@@ -77,9 +84,8 @@ describe('createLegacyAuthAdapters', () => {
     const ret = createLegacyAuthAdapters({
       auth: undefined,
       httpAuth: undefined,
-      tokenManager: mockServices.tokenManager(),
+      tokenManager: mockTokenManager,
       discovery: {} as any,
-      identity: mockServices.identity(),
     });
 
     expect(ret).toEqual({
@@ -94,7 +100,6 @@ describe('createLegacyAuthAdapters', () => {
       auth: undefined,
       httpAuth: undefined,
       discovery: {} as any,
-      identity: mockServices.identity(),
     });
 
     const credentials = await httpAuth.credentials({
@@ -116,13 +121,12 @@ describe('createLegacyAuthAdapters', () => {
       auth: undefined,
       httpAuth: undefined,
       tokenManager: {
-        ...mockServices.tokenManager(),
+        ...mockTokenManager,
         async getToken() {
           return { token: 'new-token' };
         },
       },
       discovery: {} as any,
-      identity: mockServices.identity(),
     });
 
     const credentials = await httpAuth.credentials({
diff --git a/packages/backend-common/src/compat/auth/createLegacyAuthAdapters.ts b/packages/backend-common/src/compat/auth/createLegacyAuthAdapters.ts
index 15cd881649..fc02d936d1 100644
--- a/packages/backend-common/src/compat/auth/createLegacyAuthAdapters.ts
+++ b/packages/backend-common/src/compat/auth/createLegacyAuthAdapters.ts
@@ -23,8 +23,6 @@ import {
   BackstageUserInfo,
   BackstageUserPrincipal,
   HttpAuthService,
-  IdentityService,
-  TokenManagerService,
   UserInfoService,
 } from '@backstage/backend-plugin-api';
 import { AuthenticationError, NotAllowedError } from '@backstage/errors';
@@ -44,11 +42,12 @@ import {
 import { decodeJwt } from 'jose';
 import { TokenManager, PluginEndpointDiscovery } from '../../deprecated';
 import { JsonObject } from '@backstage/types';
+import { LegacyIdentityService } from '../legacy';
 
 class AuthCompat implements AuthService {
   constructor(
-    private readonly identity: IdentityService,
-    private readonly tokenManager?: TokenManagerService,
+    private readonly identity: LegacyIdentityService,
+    private readonly tokenManager?: TokenManager,
   ) {}
 
   isPrincipal<TType extends keyof BackstagePrincipalTypes>(
@@ -299,7 +298,7 @@ export function createLegacyAuthAdapters<
     auth?: AuthService;
     httpAuth?: HttpAuthService;
     userInfo?: UserInfoService;
-    identity?: IdentityService;
+    identity?: LegacyIdentityService;
     tokenManager?: TokenManager;
     discovery: PluginEndpointDiscovery;
   },
diff --git a/packages/backend-common/src/deprecated/tokens/types.ts b/packages/backend-common/src/deprecated/tokens/types.ts
index 09dc0bb211..41a2000868 100644
--- a/packages/backend-common/src/deprecated/tokens/types.ts
+++ b/packages/backend-common/src/deprecated/tokens/types.ts
@@ -14,10 +14,25 @@
  * limitations under the License.
  */
 
-import { TokenManagerService } from '@backstage/backend-plugin-api';
-
 /**
  * @public
  * @deprecated Please {@link https://backstage.io/docs/tutorials/auth-service-migration | migrate} to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead.
  */
-export type TokenManager = TokenManagerService;
+export interface TokenManager {
+  /**
+   * Fetches a valid token.
+   *
+   * @remarks
+   *
+   * Tokens are valid for roughly one hour; the actual deadline is set in the
+   * payload `exp` claim. Never hold on to tokens for reuse; always ask for a
+   * new one for each outgoing request. This ensures that you always get a
+   * valid, fresh one.
+   */
+  getToken(): Promise<{ token: string }>;
+
+  /**
+   * Validates a given token.
+   */
+  authenticate(token: string): Promise<void>;
+}
diff --git a/packages/backend-defaults/src/CreateBackend.ts b/packages/backend-defaults/src/CreateBackend.ts
index 47fa09da49..4b0f497980 100644
--- a/packages/backend-defaults/src/CreateBackend.ts
+++ b/packages/backend-defaults/src/CreateBackend.ts
@@ -14,12 +14,7 @@
  * limitations under the License.
  */
 
-import {
-  Backend,
-  createSpecializedBackend,
-  identityServiceFactory,
-  tokenManagerServiceFactory,
-} from '@backstage/backend-app-api';
+import { Backend, createSpecializedBackend } from '@backstage/backend-app-api';
 import { authServiceFactory } from '@backstage/backend-defaults/auth';
 import { cacheServiceFactory } from '@backstage/backend-defaults/cache';
 import { databaseServiceFactory } from '@backstage/backend-defaults/database';
@@ -47,7 +42,6 @@ export const defaultServiceFactories = [
   discoveryServiceFactory,
   httpAuthServiceFactory,
   httpRouterServiceFactory,
-  identityServiceFactory,
   lifecycleServiceFactory,
   loggerServiceFactory,
   permissionsServiceFactory,
@@ -56,7 +50,6 @@ export const defaultServiceFactories = [
   rootLifecycleServiceFactory,
   rootLoggerServiceFactory,
   schedulerServiceFactory,
-  tokenManagerServiceFactory,
   userInfoServiceFactory,
   urlReaderServiceFactory,
   eventsServiceFactory,
diff --git a/packages/backend-defaults/src/entrypoints/auth/authServiceFactory.test.ts b/packages/backend-defaults/src/entrypoints/auth/authServiceFactory.test.ts
index d37e4d1443..cb672ed7f1 100644
--- a/packages/backend-defaults/src/entrypoints/auth/authServiceFactory.test.ts
+++ b/packages/backend-defaults/src/entrypoints/auth/authServiceFactory.test.ts
@@ -19,7 +19,6 @@ import {
   mockServices,
   registerMswTestHooks,
 } from '@backstage/backend-test-utils';
-import { tokenManagerServiceFactory } from '@backstage/backend-app-api';
 import { authServiceFactory } from './authServiceFactory';
 import { base64url, decodeJwt } from 'jose';
 import { discoveryServiceFactory } from '../discovery';
@@ -32,7 +31,6 @@ const server = setupServer();
 // TODO: Ship discovery mock service in the service factory tester
 const mockDeps = [
   discoveryServiceFactory,
-  tokenManagerServiceFactory,
   mockServices.rootConfig.factory({
     data: {
       backend: {
diff --git a/packages/backend-defaults/src/entrypoints/permissions/permissionsServiceFactory.ts b/packages/backend-defaults/src/entrypoints/permissions/permissionsServiceFactory.ts
index 873d6a4fa0..000d71965b 100644
--- a/packages/backend-defaults/src/entrypoints/permissions/permissionsServiceFactory.ts
+++ b/packages/backend-defaults/src/entrypoints/permissions/permissionsServiceFactory.ts
@@ -35,13 +35,11 @@ export const permissionsServiceFactory = createServiceFactory({
     auth: coreServices.auth,
     config: coreServices.rootConfig,
     discovery: coreServices.discovery,
-    tokenManager: coreServices.tokenManager,
   },
-  async factory({ auth, config, discovery, tokenManager }) {
+  async factory({ auth, config, discovery }) {
     return ServerPermissionClient.fromConfig(config, {
       auth,
       discovery,
-      tokenManager,
     });
   },
 });
diff --git a/packages/backend-plugin-api/api-report.md b/packages/backend-plugin-api/api-report.md
index 4b1ffc81e7..85e3562a4d 100644
--- a/packages/backend-plugin-api/api-report.md
+++ b/packages/backend-plugin-api/api-report.md
@@ -12,7 +12,6 @@ import { Duration } from 'luxon';
 import { EvaluatorRequestOptions } from '@backstage/plugin-permission-common';
 import { Handler } from 'express';
 import { HumanDuration } from '@backstage/types';
-import { IdentityApi } from '@backstage/plugin-auth-node';
 import { isChildPath } from '@backstage/cli-common';
 import { JsonObject } from '@backstage/types';
 import { JsonValue } from '@backstage/types';
@@ -194,11 +193,7 @@ export namespace coreServices {
   const rootLifecycle: ServiceRef<RootLifecycleService, 'root', 'singleton'>;
   const rootLogger: ServiceRef<RootLoggerService, 'root', 'singleton'>;
   const scheduler: ServiceRef<SchedulerService, 'plugin', 'singleton'>;
-  const // @deprecated
-    tokenManager: ServiceRef<TokenManagerService, 'plugin', 'singleton'>;
   const urlReader: ServiceRef<UrlReaderService, 'plugin', 'singleton'>;
-  const // @deprecated
-    identity: ServiceRef<IdentityService, 'plugin', 'singleton'>;
 }
 
 // @public
@@ -383,9 +378,6 @@ export interface HttpRouterServiceAuthPolicy {
   path: string;
 }
 
-// @public @deprecated
-export interface IdentityService extends IdentityApi {}
-
 export { isChildPath };
 
 // @public
@@ -657,14 +649,6 @@ export interface ServiceRefOptions<
   scope?: TScope;
 }
 
-// @public @deprecated
-export interface TokenManagerService {
-  authenticate(token: string): Promise<void>;
-  getToken(): Promise<{
-    token: string;
-  }>;
-}
-
 // @public
 export interface UrlReaderService {
   readTree(
diff --git a/packages/backend-plugin-api/src/services/definitions/IdentityService.ts b/packages/backend-plugin-api/src/services/definitions/IdentityService.ts
deleted file mode 100644
index daa45b8200..0000000000
--- a/packages/backend-plugin-api/src/services/definitions/IdentityService.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Copyright 2020 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import { IdentityApi } from '@backstage/plugin-auth-node';
-
-/**
- * This is the legacy service for identity handling in Backstage. Please migrate to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead.
- *
- * See the {@link https://backstage.io/docs/backend-system/core-services/identity | service documentation} for more details.
- *
- * @public
- * @deprecated Please {@link https://backstage.io/docs/tutorials/auth-service-migration | migrate} to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead.
- */
-export interface IdentityService extends IdentityApi {}
diff --git a/packages/backend-plugin-api/src/services/definitions/TokenManagerService.ts b/packages/backend-plugin-api/src/services/definitions/TokenManagerService.ts
deleted file mode 100644
index 52d5d1ff9f..0000000000
--- a/packages/backend-plugin-api/src/services/definitions/TokenManagerService.ts
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright 2022 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * This is the legacy service for creating and validating tokens. Please migrate to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead.
- *
- * See the {@link https://backstage.io/docs/backend-system/core-services/token-manager | service documentation} for more details.
- *
- * @public
- * @deprecated Please {@link https://backstage.io/docs/tutorials/auth-service-migration | migrate} to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead.
- */
-export interface TokenManagerService {
-  /**
-   * Fetches a valid token.
-   *
-   * @remarks
-   *
-   * Tokens are valid for roughly one hour; the actual deadline is set in the
-   * payload `exp` claim. Never hold on to tokens for reuse; always ask for a
-   * new one for each outgoing request. This ensures that you always get a
-   * valid, fresh one.
-   */
-  getToken(): Promise<{ token: string }>;
-
-  /**
-   * Validates a given token.
-   */
-  authenticate(token: string): Promise<void>;
-}
diff --git a/packages/backend-plugin-api/src/services/definitions/coreServices.ts b/packages/backend-plugin-api/src/services/definitions/coreServices.ts
index 33d1da2903..f87bff023c 100644
--- a/packages/backend-plugin-api/src/services/definitions/coreServices.ts
+++ b/packages/backend-plugin-api/src/services/definitions/coreServices.ts
@@ -239,20 +239,6 @@ export namespace coreServices {
     import('./SchedulerService').SchedulerService
   >({ id: 'core.scheduler' });
 
-  /**
-   * Deprecated service authentication service, use the `auth` service instead.
-   *
-   * See {@link TokenManagerService}
-   * and {@link https://backstage.io/docs/backend-system/core-services/token-manager | the service docs}
-   * for more information.
-   *
-   * @public
-   * @deprecated Please migrate to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead
-   */
-  export const tokenManager = createServiceRef<
-    import('./TokenManagerService').TokenManagerService
-  >({ id: 'core.tokenManager' });
-
   /**
    * Reading content from external systems.
    *
@@ -265,18 +251,4 @@ export namespace coreServices {
   export const urlReader = createServiceRef<
     import('./UrlReaderService').UrlReaderService
   >({ id: 'core.urlReader' });
-
-  /**
-   * Deprecated user authentication service, use the `auth` service instead.
-   *
-   * See {@link IdentityService}
-   * and {@link https://backstage.io/docs/backend-system/core-services/identity | the service docs}
-   * for more information.
-   *
-   * @public
-   * @deprecated Please migrate to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead
-   */
-  export const identity = createServiceRef<
-    import('./IdentityService').IdentityService
-  >({ id: 'core.identity' });
 }
diff --git a/packages/backend-plugin-api/src/services/definitions/index.ts b/packages/backend-plugin-api/src/services/definitions/index.ts
index 194658dc0e..1df00bdead 100644
--- a/packages/backend-plugin-api/src/services/definitions/index.ts
+++ b/packages/backend-plugin-api/src/services/definitions/index.ts
@@ -64,7 +64,6 @@ export type {
   SchedulerServiceTaskScheduleDefinition,
   SchedulerServiceTaskScheduleDefinitionConfig,
 } from './SchedulerService';
-export type { TokenManagerService } from './TokenManagerService';
 export type {
   UrlReaderServiceReadTreeOptions,
   UrlReaderServiceReadTreeResponse,
@@ -78,4 +77,3 @@ export type {
   UrlReaderService,
 } from './UrlReaderService';
 export type { BackstageUserInfo, UserInfoService } from './UserInfoService';
-export type { IdentityService } from './IdentityService';
diff --git a/packages/backend-test-utils/api-report.md b/packages/backend-test-utils/api-report.md
index cbc1cbde26..109ddbece3 100644
--- a/packages/backend-test-utils/api-report.md
+++ b/packages/backend-test-utils/api-report.md
@@ -23,7 +23,6 @@ import { ExtendedHttpServer } from '@backstage/backend-defaults/rootHttpRouter';
 import { ExtensionPoint } from '@backstage/backend-plugin-api';
 import { HttpAuthService } from '@backstage/backend-plugin-api';
 import { HttpRouterService } from '@backstage/backend-plugin-api';
-import { IdentityService } from '@backstage/backend-plugin-api';
 import { JsonObject } from '@backstage/types';
 import Keyv from 'keyv';
 import { Knex } from 'knex';
@@ -39,7 +38,6 @@ import { RootLoggerService } from '@backstage/backend-plugin-api';
 import { SchedulerService } from '@backstage/backend-plugin-api';
 import { ServiceFactory } from '@backstage/backend-plugin-api';
 import { ServiceRef } from '@backstage/backend-plugin-api';
-import { TokenManagerService } from '@backstage/backend-plugin-api';
 import { UrlReaderService } from '@backstage/backend-plugin-api';
 import { UserInfoService } from '@backstage/backend-plugin-api';
 
@@ -217,17 +215,6 @@ export namespace mockServices {
       ) => ServiceMock<HttpRouterService>;
   }
   // (undocumented)
-  export function identity(): IdentityService;
-  // (undocumented)
-  export namespace identity {
-    const // (undocumented)
-      factory: () => ServiceFactory<IdentityService, 'plugin', 'singleton'>;
-    const // (undocumented)
-      mock: (
-        partialImpl?: Partial<IdentityService> | undefined,
-      ) => ServiceMock<IdentityService>;
-  }
-  // (undocumented)
   export namespace lifecycle {
     const // (undocumented)
       factory: () => ServiceFactory<LifecycleService, 'plugin', 'singleton'>;
@@ -324,17 +311,6 @@ export namespace mockServices {
       ) => ServiceMock<SchedulerService>;
   }
   // (undocumented)
-  export function tokenManager(): TokenManagerService;
-  // (undocumented)
-  export namespace tokenManager {
-    const // (undocumented)
-      factory: () => ServiceFactory<TokenManagerService, 'plugin', 'singleton'>;
-    const // (undocumented)
-      mock: (
-        partialImpl?: Partial<TokenManagerService> | undefined,
-      ) => ServiceMock<TokenManagerService>;
-  }
-  // (undocumented)
   export namespace urlReader {
     const // (undocumented)
       factory: () => ServiceFactory<UrlReaderService, 'plugin', 'singleton'>;
diff --git a/packages/backend-test-utils/src/next/services/MockIdentityService.ts b/packages/backend-test-utils/src/next/services/MockIdentityService.ts
deleted file mode 100644
index ff424f79c2..0000000000
--- a/packages/backend-test-utils/src/next/services/MockIdentityService.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Copyright 2023 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import { IdentityService } from '@backstage/backend-plugin-api';
-import {
-  IdentityApiGetIdentityRequest,
-  BackstageIdentityResponse,
-} from '@backstage/plugin-auth-node';
-
-export class MockIdentityService implements IdentityService {
-  getIdentity(
-    _options: IdentityApiGetIdentityRequest,
-  ): Promise<BackstageIdentityResponse | undefined> {
-    return Promise.resolve({
-      token: 'mock-token',
-      identity: {
-        type: 'user',
-        userEntityRef: 'user:default/mock-user',
-        ownershipEntityRefs: [],
-      },
-    });
-  }
-}
diff --git a/packages/backend-test-utils/src/next/services/mockServices.ts b/packages/backend-test-utils/src/next/services/mockServices.ts
index 9833c6c45c..d3ec8fb18d 100644
--- a/packages/backend-test-utils/src/next/services/mockServices.ts
+++ b/packages/backend-test-utils/src/next/services/mockServices.ts
@@ -35,12 +35,10 @@ import {
   BackstageUserInfo,
   DiscoveryService,
   HttpAuthService,
-  IdentityService,
   LoggerService,
   RootConfigService,
   ServiceFactory,
   ServiceRef,
-  TokenManagerService,
   UserInfoService,
   coreServices,
   createServiceFactory,
@@ -53,7 +51,6 @@ import {
 import { JsonObject } from '@backstage/types';
 import { MockAuthService } from './MockAuthService';
 import { MockHttpAuthService } from './MockHttpAuthService';
-import { MockIdentityService } from './MockIdentityService';
 import { MockRootLoggerService } from './MockRootLoggerService';
 import { MockUserInfoService } from './MockUserInfoService';
 import { mockCredentials } from './mockCredentials';
@@ -167,46 +164,6 @@ export namespace mockServices {
     }));
   }
 
-  export function tokenManager(): TokenManagerService {
-    return {
-      async getToken(): Promise<{ token: string }> {
-        return { token: 'mock-token' };
-      },
-      async authenticate(token: string): Promise<void> {
-        if (token !== 'mock-token') {
-          throw new Error('Invalid token');
-        }
-      },
-    };
-  }
-  export namespace tokenManager {
-    export const factory = () =>
-      createServiceFactory({
-        service: coreServices.tokenManager,
-        deps: {},
-        factory: () => tokenManager(),
-      });
-    export const mock = simpleMock(coreServices.tokenManager, () => ({
-      authenticate: jest.fn(),
-      getToken: jest.fn(),
-    }));
-  }
-
-  export function identity(): IdentityService {
-    return new MockIdentityService();
-  }
-  export namespace identity {
-    export const factory = () =>
-      createServiceFactory({
-        service: coreServices.identity,
-        deps: {},
-        factory: () => identity(),
-      });
-    export const mock = simpleMock(coreServices.identity, () => ({
-      getIdentity: jest.fn(),
-    }));
-  }
-
   export function auth(options?: {
     pluginId?: string;
     disableDefaultAuthPolicy?: boolean;
diff --git a/packages/backend-test-utils/src/next/wiring/TestBackend.test.ts b/packages/backend-test-utils/src/next/wiring/TestBackend.test.ts
index 52ef3705a6..7bf3887c93 100644
--- a/packages/backend-test-utils/src/next/wiring/TestBackend.test.ts
+++ b/packages/backend-test-utils/src/next/wiring/TestBackend.test.ts
@@ -198,13 +198,12 @@ describe('TestBackend', () => {
             rootLifecycle: coreServices.rootLifecycle,
             rootLogger: coreServices.rootLogger,
             scheduler: coreServices.scheduler,
-            tokenManager: coreServices.tokenManager,
             urlReader: coreServices.urlReader,
             auth: coreServices.auth,
             httpAuth: coreServices.httpAuth,
           },
           async init(deps) {
-            expect(Object.keys(deps)).toHaveLength(17);
+            expect(Object.keys(deps)).toHaveLength(16);
             expect(Object.values(deps)).not.toContain(undefined);
           },
         });
diff --git a/packages/backend-test-utils/src/next/wiring/TestBackend.ts b/packages/backend-test-utils/src/next/wiring/TestBackend.ts
index 6b4110d4de..96bf0f7dc1 100644
--- a/packages/backend-test-utils/src/next/wiring/TestBackend.ts
+++ b/packages/backend-test-utils/src/next/wiring/TestBackend.ts
@@ -72,7 +72,6 @@ export const defaultServiceFactories = [
   mockServices.database.factory(),
   mockServices.httpAuth.factory(),
   mockServices.httpRouter.factory(),
-  mockServices.identity.factory(),
   mockServices.lifecycle.factory(),
   mockServices.logger.factory(),
   mockServices.permissions.factory(),
@@ -80,7 +79,6 @@ export const defaultServiceFactories = [
   mockServices.rootLifecycle.factory(),
   mockServices.rootLogger.factory(),
   mockServices.scheduler.factory(),
-  mockServices.tokenManager.factory(),
   mockServices.userInfo.factory(),
   mockServices.urlReader.factory(),
   mockServices.events.factory(),
diff --git a/plugins/auth-backend/api-report.md b/plugins/auth-backend/api-report.md
index 5478ccc323..1f33886759 100644
--- a/plugins/auth-backend/api-report.md
+++ b/plugins/auth-backend/api-report.md
@@ -41,7 +41,6 @@ import { RootConfigService } from '@backstage/backend-plugin-api';
 import { SignInInfo as SignInInfo_2 } from '@backstage/plugin-auth-node';
 import { SignInResolver as SignInResolver_2 } from '@backstage/plugin-auth-node';
 import { TokenManager } from '@backstage/backend-common';
-import { TokenManagerService } from '@backstage/backend-plugin-api';
 import { TokenParams as TokenParams_2 } from '@backstage/plugin-auth-node';
 import { UserEntity } from '@backstage/catalog-model';
 import { WebMessageResponse as WebMessageResponse_2 } from '@backstage/plugin-auth-node';
@@ -126,7 +125,7 @@ export type BitbucketServerOAuthResult = {
 export class CatalogIdentityClient {
   constructor(options: {
     catalogApi: CatalogApi;
-    tokenManager: TokenManager;
+    tokenManager?: TokenManager;
     discovery: DiscoveryService;
     auth?: AuthService;
     httpAuth?: HttpAuthService;
@@ -673,7 +672,7 @@ export interface RouterOptions {
   // (undocumented)
   tokenFactoryAlgorithm?: string;
   // (undocumented)
-  tokenManager: TokenManagerService;
+  tokenManager?: TokenManager;
 }
 
 // @public (undocumented)
diff --git a/plugins/auth-backend/src/authPlugin.ts b/plugins/auth-backend/src/authPlugin.ts
index 7687462d32..89b7e9a780 100644
--- a/plugins/auth-backend/src/authPlugin.ts
+++ b/plugins/auth-backend/src/authPlugin.ts
@@ -65,7 +65,6 @@ export const authPlugin = createBackendPlugin({
         config: coreServices.rootConfig,
         database: coreServices.database,
         discovery: coreServices.discovery,
-        tokenManager: coreServices.tokenManager,
         auth: coreServices.auth,
         httpAuth: coreServices.httpAuth,
         catalogApi: catalogServiceRef,
@@ -76,7 +75,6 @@ export const authPlugin = createBackendPlugin({
         config,
         database,
         discovery,
-        tokenManager,
         auth,
         httpAuth,
         catalogApi,
@@ -86,7 +84,6 @@ export const authPlugin = createBackendPlugin({
           config,
           database,
           discovery,
-          tokenManager,
           auth,
           httpAuth,
           catalogApi,
diff --git a/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.ts b/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.ts
index 51c72eeb63..e91108dbf2 100644
--- a/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.ts
+++ b/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.ts
@@ -45,7 +45,7 @@ export class CatalogIdentityClient {
 
   constructor(options: {
     catalogApi: CatalogApi;
-    tokenManager: TokenManager;
+    tokenManager?: TokenManager;
     discovery: DiscoveryService;
     auth?: AuthService;
     httpAuth?: HttpAuthService;
diff --git a/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.test.ts b/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.test.ts
index a69c9c90d4..7fb759200c 100644
--- a/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.test.ts
+++ b/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.test.ts
@@ -34,7 +34,6 @@ describe('CatalogAuthResolverContext', () => {
       logger: mockServices.logger.mock(),
       catalogApi: mockCatalogApi as CatalogApi,
       tokenIssuer: {} as TokenIssuer,
-      tokenManager: mockServices.tokenManager(),
       discovery: {} as DiscoveryService,
       auth: mockServices.auth(),
       httpAuth: mockServices.httpAuth(),
diff --git a/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.ts b/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.ts
index c81ac4c355..51b374b468 100644
--- a/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.ts
+++ b/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.ts
@@ -66,7 +66,7 @@ export class CatalogAuthResolverContext implements AuthResolverContext {
     logger: LoggerService;
     catalogApi: CatalogApi;
     tokenIssuer: TokenIssuer;
-    tokenManager: TokenManager;
+    tokenManager?: TokenManager;
     discovery: DiscoveryService;
     auth: AuthService;
     httpAuth: HttpAuthService;
diff --git a/plugins/auth-backend/src/providers/router.ts b/plugins/auth-backend/src/providers/router.ts
index d84133685c..e449372143 100644
--- a/plugins/auth-backend/src/providers/router.ts
+++ b/plugins/auth-backend/src/providers/router.ts
@@ -50,7 +50,7 @@ export function bindProviderRouters(
     discovery: PluginEndpointDiscovery;
     auth: AuthService;
     httpAuth: HttpAuthService;
-    tokenManager: TokenManager;
+    tokenManager?: TokenManager;
     tokenIssuer: TokenIssuer;
     ownershipResolver?: AuthOwnershipResolver;
     catalogApi?: CatalogApi;
diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index b954eb4dbb..af34ffc310 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -24,11 +24,13 @@ import {
   HttpAuthService,
   LoggerService,
   RootConfigService,
-  TokenManagerService,
 } from '@backstage/backend-plugin-api';
 import { defaultAuthProviderFactories } from '../providers';
 import { AuthOwnershipResolver } from '@backstage/plugin-auth-node';
-import { createLegacyAuthAdapters } from '@backstage/backend-common';
+import {
+  TokenManager,
+  createLegacyAuthAdapters,
+} from '@backstage/backend-common';
 import { NotFoundError } from '@backstage/errors';
 import { CatalogApi } from '@backstage/catalog-client';
 import {
@@ -56,7 +58,7 @@ export interface RouterOptions {
   database: DatabaseService;
   config: RootConfigService;
   discovery: DiscoveryService;
-  tokenManager: TokenManagerService;
+  tokenManager?: TokenManager;
   auth?: AuthService;
   httpAuth?: HttpAuthService;
   tokenFactoryAlgorithm?: string;
diff --git a/plugins/catalog-backend-module-bitbucket-cloud/src/module/catalogModuleBitbucketCloudEntityProvider.ts b/plugins/catalog-backend-module-bitbucket-cloud/src/module/catalogModuleBitbucketCloudEntityProvider.ts
index 21d86ce8e6..179e74b8c0 100644
--- a/plugins/catalog-backend-module-bitbucket-cloud/src/module/catalogModuleBitbucketCloudEntityProvider.ts
+++ b/plugins/catalog-backend-module-bitbucket-cloud/src/module/catalogModuleBitbucketCloudEntityProvider.ts
@@ -40,23 +40,13 @@ export const catalogModuleBitbucketCloudEntityProvider = createBackendModule({
         events: eventsServiceRef,
         logger: coreServices.logger,
         scheduler: coreServices.scheduler,
-        tokenManager: coreServices.tokenManager,
       },
-      async init({
-        catalog,
-        catalogApi,
-        config,
-        events,
-        logger,
-        scheduler,
-        tokenManager,
-      }) {
+      async init({ catalog, catalogApi, config, events, logger, scheduler }) {
         const providers = BitbucketCloudEntityProvider.fromConfig(config, {
           catalogApi,
           events,
           logger,
           scheduler,
-          tokenManager,
         });
 
         catalog.addEntityProvider(providers);
diff --git a/plugins/example-todo-list-backend/api-report.md b/plugins/example-todo-list-backend/api-report.md
index 1dd4880323..8fa39f0cec 100644
--- a/plugins/example-todo-list-backend/api-report.md
+++ b/plugins/example-todo-list-backend/api-report.md
@@ -5,7 +5,7 @@
 ```ts
 import { BackendFeature } from '@backstage/backend-plugin-api';
 import express from 'express';
-import { IdentityApi } from '@backstage/plugin-auth-node';
+import { HttpAuthService } from '@backstage/backend-plugin-api';
 import { LoggerService } from '@backstage/backend-plugin-api';
 
 // @public
@@ -18,7 +18,7 @@ export default exampleTodoListPlugin;
 // @public
 export interface RouterOptions {
   // (undocumented)
-  identity: IdentityApi;
+  httpAuth: HttpAuthService;
   // (undocumented)
   logger: LoggerService;
 }
diff --git a/plugins/example-todo-list-backend/src/plugin.ts b/plugins/example-todo-list-backend/src/plugin.ts
index ccff192d4c..1c7bba929a 100644
--- a/plugins/example-todo-list-backend/src/plugin.ts
+++ b/plugins/example-todo-list-backend/src/plugin.ts
@@ -30,14 +30,14 @@ export const exampleTodoListPlugin = createBackendPlugin({
   register(env) {
     env.registerInit({
       deps: {
-        identity: coreServices.identity,
+        httpAuth: coreServices.httpAuth,
         logger: coreServices.logger,
         httpRouter: coreServices.httpRouter,
       },
-      async init({ identity, logger, httpRouter }) {
+      async init({ httpAuth, logger, httpRouter }) {
         httpRouter.use(
           await createRouter({
-            identity,
+            httpAuth,
             logger,
           }),
         );
diff --git a/plugins/example-todo-list-backend/src/service/router.test.ts b/plugins/example-todo-list-backend/src/service/router.test.ts
index e9abb5a76c..50bacac203 100644
--- a/plugins/example-todo-list-backend/src/service/router.test.ts
+++ b/plugins/example-todo-list-backend/src/service/router.test.ts
@@ -14,7 +14,6 @@
  * limitations under the License.
  */
 
-import { DefaultIdentityClient } from '@backstage/plugin-auth-node';
 import express from 'express';
 import request from 'supertest';
 
@@ -27,7 +26,7 @@ describe('createRouter', () => {
   beforeAll(async () => {
     const router = await createRouter({
       logger: mockServices.logger.mock(),
-      identity: {} as DefaultIdentityClient,
+      httpAuth: mockServices.httpAuth.mock(),
     });
     app = express().use(router);
   });
diff --git a/plugins/example-todo-list-backend/src/service/router.ts b/plugins/example-todo-list-backend/src/service/router.ts
index 09b8669507..5f2d9fd37c 100644
--- a/plugins/example-todo-list-backend/src/service/router.ts
+++ b/plugins/example-todo-list-backend/src/service/router.ts
@@ -19,8 +19,7 @@ import express from 'express';
 import Router from 'express-promise-router';
 import { add, getAll, update } from './todos';
 import { InputError } from '@backstage/errors';
-import { IdentityApi } from '@backstage/plugin-auth-node';
-import { LoggerService } from '@backstage/backend-plugin-api';
+import { HttpAuthService, LoggerService } from '@backstage/backend-plugin-api';
 
 /**
  * Dependencies of the todo-list router
@@ -29,7 +28,7 @@ import { LoggerService } from '@backstage/backend-plugin-api';
  */
 export interface RouterOptions {
   logger: LoggerService;
-  identity: IdentityApi;
+  httpAuth: HttpAuthService;
 }
 
 /**
@@ -44,7 +43,7 @@ export interface RouterOptions {
 export async function createRouter(
   options: RouterOptions,
 ): Promise<express.Router> {
-  const { logger, identity } = options;
+  const { logger, httpAuth } = options;
 
   const router = Router();
   router.use(express.json());
@@ -59,16 +58,16 @@ export async function createRouter(
   });
 
   router.post('/todos', async (req, res) => {
-    let author: string | undefined = undefined;
-
-    const user = await identity.getIdentity({ request: req });
-    author = user?.identity.userEntityRef;
+    const credentials = await httpAuth.credentials(req, { allow: ['user'] });
 
     if (!isTodoCreateRequest(req.body)) {
       throw new InputError('Invalid payload');
     }
 
-    const todo = add({ title: req.body.title, author });
+    const todo = add({
+      title: req.body.title,
+      author: credentials.principal.userEntityRef,
+    });
     res.json(todo);
   });
 
diff --git a/plugins/permission-node/api-report.md b/plugins/permission-node/api-report.md
index 36483bd342..0f0885e180 100644
--- a/plugins/permission-node/api-report.md
+++ b/plugins/permission-node/api-report.md
@@ -29,7 +29,7 @@ import { PermissionsServiceRequestOptions } from '@backstage/backend-plugin-api'
 import { PolicyDecision } from '@backstage/plugin-permission-common';
 import { QueryPermissionRequest } from '@backstage/plugin-permission-common';
 import { ResourcePermission } from '@backstage/plugin-permission-common';
-import { TokenManagerService } from '@backstage/backend-plugin-api';
+import { TokenManager } from '@backstage/backend-common';
 import { z } from 'zod';
 
 // @public
@@ -290,7 +290,7 @@ export class ServerPermissionClient implements PermissionsService {
     config: Config,
     options: {
       discovery: DiscoveryService;
-      tokenManager: TokenManagerService;
+      tokenManager?: TokenManager;
       auth?: AuthService;
     },
   ): ServerPermissionClient;
diff --git a/plugins/permission-node/src/ServerPermissionClient.test.ts b/plugins/permission-node/src/ServerPermissionClient.test.ts
index 5c6328ae44..772f1b95d7 100644
--- a/plugins/permission-node/src/ServerPermissionClient.test.ts
+++ b/plugins/permission-node/src/ServerPermissionClient.test.ts
@@ -82,7 +82,6 @@ describe('ServerPermissionClient', () => {
     it('should bypass the permission backend if permissions are disabled', async () => {
       const client = ServerPermissionClient.fromConfig(new ConfigReader({}), {
         discovery,
-        tokenManager: mockServices.tokenManager.mock(),
         auth: mockServices.auth(),
       });
 
@@ -101,7 +100,6 @@ describe('ServerPermissionClient', () => {
     it('should bypass the permission backend if permissions are enabled and request has valid server credentials', async () => {
       const client = ServerPermissionClient.fromConfig(config, {
         discovery,
-        tokenManager: mockServices.tokenManager.mock(),
         auth: mockServices.auth(),
       });
 
@@ -115,7 +113,6 @@ describe('ServerPermissionClient', () => {
     it('should call the permission backend if permissions are enabled and request does not have valid server credentials', async () => {
       const client = ServerPermissionClient.fromConfig(config, {
         discovery,
-        tokenManager: mockServices.tokenManager.mock(),
         auth: mockServices.auth(),
       });
 
@@ -156,7 +153,6 @@ describe('ServerPermissionClient', () => {
     it('should bypass the permission backend if permissions are disabled', async () => {
       const client = ServerPermissionClient.fromConfig(new ConfigReader({}), {
         discovery,
-        tokenManager: mockServices.tokenManager.mock(),
         auth: mockServices.auth(),
       });
 
@@ -173,7 +169,6 @@ describe('ServerPermissionClient', () => {
     it('should bypass the permission backend if permissions are enabled and request has valid server credentials', async () => {
       const client = ServerPermissionClient.fromConfig(config, {
         discovery,
-        tokenManager: mockServices.tokenManager.mock(),
         auth: mockServices.auth(),
       });
 
@@ -190,7 +185,6 @@ describe('ServerPermissionClient', () => {
     it('should call the permission backend if permissions are enabled and request does not have valid server credentials', async () => {
       const client = ServerPermissionClient.fromConfig(config, {
         discovery,
-        tokenManager: mockServices.tokenManager.mock(),
         auth: mockServices.auth(),
       });
 
@@ -223,7 +217,6 @@ describe('ServerPermissionClient', () => {
           }),
           {
             discovery,
-            tokenManager: mockServices.tokenManager(),
             auth: mockServices.auth(),
           },
         );
diff --git a/plugins/permission-node/src/ServerPermissionClient.ts b/plugins/permission-node/src/ServerPermissionClient.ts
index e21067bfa1..c34a8fe930 100644
--- a/plugins/permission-node/src/ServerPermissionClient.ts
+++ b/plugins/permission-node/src/ServerPermissionClient.ts
@@ -14,7 +14,10 @@
  * limitations under the License.
  */
 
-import { createLegacyAuthAdapters } from '@backstage/backend-common';
+import {
+  TokenManager,
+  createLegacyAuthAdapters,
+} from '@backstage/backend-common';
 import {
   AuthService,
   BackstageCredentials,
@@ -22,7 +25,6 @@ import {
   DiscoveryService,
   PermissionsService,
   PermissionsServiceRequestOptions,
-  TokenManagerService,
 } from '@backstage/backend-plugin-api';
 import { Config } from '@backstage/config';
 import {
@@ -51,7 +53,8 @@ export class ServerPermissionClient implements PermissionsService {
     config: Config,
     options: {
       discovery: DiscoveryService;
-      tokenManager: TokenManagerService;
+      /** @deprecated This option will be removed in the future, provide a the auth option instead */
+      tokenManager?: TokenManager;
       auth?: AuthService;
     },
   ) {
@@ -62,6 +65,7 @@ export class ServerPermissionClient implements PermissionsService {
 
     if (
       permissionEnabled &&
+      tokenManager &&
       (tokenManager as any).isInsecureServerTokenManager
     ) {
       throw new Error(
diff --git a/plugins/search-backend-module-catalog/src/alpha.ts b/plugins/search-backend-module-catalog/src/alpha.ts
index 2ae9cd8af9..03e5bcb226 100644
--- a/plugins/search-backend-module-catalog/src/alpha.ts
+++ b/plugins/search-backend-module-catalog/src/alpha.ts
@@ -80,7 +80,6 @@ export default createBackendModule({
         auth: coreServices.auth,
         config: coreServices.rootConfig,
         discovery: coreServices.discovery,
-        tokenManager: coreServices.tokenManager,
         scheduler: coreServices.scheduler,
         indexRegistry: searchIndexRegistryExtensionPoint,
         catalog: catalogServiceRef,
@@ -89,7 +88,6 @@ export default createBackendModule({
         auth,
         config,
         discovery,
-        tokenManager,
         scheduler,
         indexRegistry,
         catalog,
@@ -102,7 +100,6 @@ export default createBackendModule({
             auth,
             entityTransformer,
             discovery,
-            tokenManager,
             catalogClient: catalog,
           }),
         });
diff --git a/plugins/search-backend-module-explore/src/alpha.ts b/plugins/search-backend-module-explore/src/alpha.ts
index ee4bedde21..63a13c273b 100644
--- a/plugins/search-backend-module-explore/src/alpha.ts
+++ b/plugins/search-backend-module-explore/src/alpha.ts
@@ -43,7 +43,6 @@ export default createBackendModule({
         logger: coreServices.logger,
         discovery: coreServices.discovery,
         scheduler: coreServices.scheduler,
-        tokenManager: coreServices.tokenManager,
         auth: coreServices.auth,
         indexRegistry: searchIndexRegistryExtensionPoint,
       },
@@ -52,7 +51,6 @@ export default createBackendModule({
         logger,
         discovery,
         scheduler,
-        tokenManager,
         auth,
         indexRegistry,
       }) {
@@ -74,7 +72,6 @@ export default createBackendModule({
             discovery,
             logger,
             auth,
-            tokenManager,
           }),
         });
       },
diff --git a/plugins/search-backend-module-techdocs/src/alpha.ts b/plugins/search-backend-module-techdocs/src/alpha.ts
index 77cf6af47b..344a50c59d 100644
--- a/plugins/search-backend-module-techdocs/src/alpha.ts
+++ b/plugins/search-backend-module-techdocs/src/alpha.ts
@@ -78,7 +78,6 @@ export default createBackendModule({
         auth: coreServices.auth,
         httpAuth: coreServices.httpAuth,
         discovery: coreServices.discovery,
-        tokenManager: coreServices.tokenManager,
         scheduler: coreServices.scheduler,
         catalog: catalogServiceRef,
         indexRegistry: searchIndexRegistryExtensionPoint,
@@ -89,7 +88,6 @@ export default createBackendModule({
         auth,
         httpAuth,
         discovery,
-        tokenManager,
         scheduler,
         catalog,
         indexRegistry,
@@ -110,7 +108,6 @@ export default createBackendModule({
           schedule: scheduler.createScheduledTaskRunner(schedule),
           factory: DefaultTechDocsCollatorFactory.fromConfig(config, {
             discovery,
-            tokenManager,
             auth,
             httpAuth,
             logger,
diff --git a/plugins/signals-backend/api-report.md b/plugins/signals-backend/api-report.md
index b7d3255239..442b923851 100644
--- a/plugins/signals-backend/api-report.md
+++ b/plugins/signals-backend/api-report.md
@@ -28,7 +28,7 @@ export interface RouterOptions {
   // (undocumented)
   events: EventsService;
   // (undocumented)
-  identity: IdentityApi;
+  identity?: IdentityApi;
   // (undocumented)
   lifecycle?: LifecycleService;
   // (undocumented)
diff --git a/plugins/signals-backend/src/plugin.ts b/plugins/signals-backend/src/plugin.ts
index 0963b79ccb..a627f7019b 100644
--- a/plugins/signals-backend/src/plugin.ts
+++ b/plugins/signals-backend/src/plugin.ts
@@ -34,7 +34,6 @@ export const signalsPlugin = createBackendPlugin({
         logger: coreServices.logger,
         config: coreServices.rootConfig,
         lifecycle: coreServices.rootLifecycle,
-        identity: coreServices.identity,
         discovery: coreServices.discovery,
         userInfo: coreServices.userInfo,
         auth: coreServices.auth,
@@ -45,7 +44,6 @@ export const signalsPlugin = createBackendPlugin({
         logger,
         config,
         lifecycle,
-        identity,
         discovery,
         userInfo,
         auth,
@@ -55,7 +53,6 @@ export const signalsPlugin = createBackendPlugin({
           await createRouter({
             logger,
             config,
-            identity,
             lifecycle,
             discovery,
             userInfo,
diff --git a/plugins/signals-backend/src/service/router.ts b/plugins/signals-backend/src/service/router.ts
index ea706ebf1a..aaf981aa34 100644
--- a/plugins/signals-backend/src/service/router.ts
+++ b/plugins/signals-backend/src/service/router.ts
@@ -40,7 +40,7 @@ import { Config } from '@backstage/config';
 export interface RouterOptions {
   logger: LoggerService;
   events: EventsService;
-  identity: IdentityApi;
+  identity?: IdentityApi;
   discovery: PluginEndpointDiscovery;
   config: Config;
   lifecycle?: LifecycleService;
diff --git a/plugins/user-settings-backend/dev/index.ts b/plugins/user-settings-backend/dev/index.ts
index 49fa7cb6bd..43c75d24df 100644
--- a/plugins/user-settings-backend/dev/index.ts
+++ b/plugins/user-settings-backend/dev/index.ts
@@ -15,9 +15,7 @@
  */
 
 import { createBackend } from '@backstage/backend-defaults';
-import { mockServices } from '@backstage/backend-test-utils';
 
 const backend = createBackend();
-backend.add(mockServices.identity.factory());
 backend.add(import('../src/alpha'));
 backend.start();