diff --git a/packages/backend-common/src/tokens/AuthIdentityTokenManager.test.ts b/packages/backend-common/src/tokens/AuthIdentityTokenManager.test.ts
new file mode 100644
index 0000000000..e8df55cb3b
--- /dev/null
+++ b/packages/backend-common/src/tokens/AuthIdentityTokenManager.test.ts
@@ -0,0 +1,61 @@
+/*
+ * Copyright 2021 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { PluginEndpointDiscovery } from '..';
+import { IdentityClient } from '../identity';
+import { AuthIdentityTokenManager } from './AuthIdentityTokenManager';
+
+const discovery: PluginEndpointDiscovery = {
+  async getBaseUrl() {
+    return 'url';
+  },
+  async getExternalBaseUrl() {
+    return 'url';
+  },
+};
+
+beforeAll(() => {
+  jest
+    .spyOn(IdentityClient.prototype, 'authenticate')
+    .mockImplementation(async (_token?: string) => {
+      throw new Error('No');
+    });
+});
+
+describe('AuthIdentityTokenManager', () => {
+  it('should validate a valid server token', async () => {
+    const tokenManager = AuthIdentityTokenManager.create({
+      discovery,
+      secret: 'a-secret-key',
+    });
+    const { token } = await tokenManager.getServerToken();
+    await expect(tokenManager.validateToken(token)).resolves.toBeUndefined();
+  });
+
+  it('should reject an invalid server token', async () => {
+    const tokenManager = AuthIdentityTokenManager.create({
+      discovery,
+      secret: 'a-secret-key',
+    });
+    const differentTokenManager = AuthIdentityTokenManager.create({
+      discovery,
+      secret: 'a-different-key',
+    });
+    const { token } = await tokenManager.getServerToken();
+    await expect(differentTokenManager.validateToken(token)).rejects.toThrow(
+      'Invalid token',
+    );
+  });
+});