diff --git a/packages/backend-common/src/tokens/AuthIdentityTokenManager.test.ts b/packages/backend-common/src/tokens/AuthIdentityTokenManager.test.ts
index e8df55cb3b..b52acbe300 100644
--- a/packages/backend-common/src/tokens/AuthIdentityTokenManager.test.ts
+++ b/packages/backend-common/src/tokens/AuthIdentityTokenManager.test.ts
@@ -36,23 +36,23 @@ beforeAll(() => {
 
 describe('AuthIdentityTokenManager', () => {
   it('should validate a valid server token', async () => {
-    const tokenManager = AuthIdentityTokenManager.create({
+    const tokenManager = new AuthIdentityTokenManager(
       discovery,
-      secret: 'a-secret-key',
-    });
+      'a-secret-key',
+    );
     const { token } = await tokenManager.getServerToken();
     await expect(tokenManager.validateToken(token)).resolves.toBeUndefined();
   });
 
   it('should reject an invalid server token', async () => {
-    const tokenManager = AuthIdentityTokenManager.create({
+    const tokenManager = new AuthIdentityTokenManager(
       discovery,
-      secret: 'a-secret-key',
-    });
-    const differentTokenManager = AuthIdentityTokenManager.create({
+      'a-secret-key',
+    );
+    const differentTokenManager = new AuthIdentityTokenManager(
       discovery,
-      secret: 'a-different-key',
-    });
+      'a-different-key',
+    );
     const { token } = await tokenManager.getServerToken();
     await expect(differentTokenManager.validateToken(token)).rejects.toThrow(
       'Invalid token',
diff --git a/packages/backend-common/src/tokens/AuthIdentityTokenManager.ts b/packages/backend-common/src/tokens/AuthIdentityTokenManager.ts
index 72bec24448..42c52b84fa 100644
--- a/packages/backend-common/src/tokens/AuthIdentityTokenManager.ts
+++ b/packages/backend-common/src/tokens/AuthIdentityTokenManager.ts
@@ -24,19 +24,11 @@ export class AuthIdentityTokenManager implements TokenManager {
   private identityClient: IdentityClient;
   private key: JWK.OctKey;
 
-  static create(options: {
-    discovery: PluginEndpointDiscovery;
-    secret: string;
-  }) {
-    const identityClient = new IdentityClient({
-      discovery: options.discovery,
+  constructor(discovery: PluginEndpointDiscovery, secret: string) {
+    this.identityClient = new IdentityClient({
+      discovery: discovery,
       issuer: 'auth-identity-token-manager',
     });
-    return new AuthIdentityTokenManager(identityClient, options.secret);
-  }
-
-  private constructor(identityClient: IdentityClient, secret: string) {
-    this.identityClient = identityClient;
     // TODO: (b2b-auth) how do we get this to be the right JWK type
     this.key = JWK.asKey(Buffer.from(secret)) as JWK.OctKey;
   }
diff --git a/packages/backend/src/index.ts b/packages/backend/src/index.ts
index 35d6365851..ffcd52a1dd 100644
--- a/packages/backend/src/index.ts
+++ b/packages/backend/src/index.ts
@@ -66,10 +66,7 @@ function makeCreateEnv(config: Config) {
   const root = getRootLogger();
   const reader = UrlReaders.default({ logger: root, config });
   const discovery = SingleHostDiscovery.fromConfig(config);
-  const tokenManager = AuthIdentityTokenManager.create({
-    discovery,
-    secret: 'secret-tehe',
-  });
+  const tokenManager = new AuthIdentityTokenManager(discovery, 'secret-tehe');
 
   root.info(`Created UrlReader ${reader}`);