diff --git a/plugins/auth-backend/src/providers/atlassian/provider.ts b/plugins/auth-backend/src/providers/atlassian/provider.ts
index 26eea420fc..91e18c7e10 100644
--- a/plugins/auth-backend/src/providers/atlassian/provider.ts
+++ b/plugins/auth-backend/src/providers/atlassian/provider.ts
@@ -174,6 +174,9 @@ export class AtlassianAuthProvider implements OAuthHandlers {
   }
 }
 
+/**
+ * @deprecated This type has been inlined into the create method and will be removed.
+ */
 export type AtlassianProviderOptions = {
   /**
    * The profile transformation function used to verify and convert the auth response
@@ -189,9 +192,20 @@ export type AtlassianProviderOptions = {
   };
 };
 
-export const createAtlassianProvider = (
-  options?: AtlassianProviderOptions,
-): AuthProviderFactory => {
+export const createAtlassianProvider = (options?: {
+  /**
+   * The profile transformation function used to verify and convert the auth response
+   * into the profile that will be presented to the user.
+   */
+  authHandler?: AuthHandler<OAuthResult>;
+
+  /**
+   * Configure sign-in for this provider, without it the provider can not be used to sign users in.
+   */
+  signIn?: {
+    resolver: SignInResolver<OAuthResult>;
+  };
+}): AuthProviderFactory => {
   return ({
     providerId,
     globalConfig,
diff --git a/plugins/auth-backend/src/providers/auth0/provider.ts b/plugins/auth-backend/src/providers/auth0/provider.ts
index cfe4110b4a..8536c97420 100644
--- a/plugins/auth-backend/src/providers/auth0/provider.ts
+++ b/plugins/auth-backend/src/providers/auth0/provider.ts
@@ -180,7 +180,9 @@ export class Auth0AuthProvider implements OAuthHandlers {
   }
 }
 
-/** @public */
+/**
+ * @deprecated This type has been inlined into the create method and will be removed.
+ */
 export type Auth0ProviderOptions = {
   /**
    * The profile transformation function used to verify and convert the auth response
@@ -200,9 +202,23 @@ export type Auth0ProviderOptions = {
 };
 
 /** @public */
-export const createAuth0Provider = (
-  options?: Auth0ProviderOptions,
-): AuthProviderFactory => {
+export const createAuth0Provider = (options?: {
+  /**
+   * The profile transformation function used to verify and convert the auth response
+   * into the profile that will be presented to the user.
+   */
+  authHandler?: AuthHandler<OAuthResult>;
+
+  /**
+   * Configure sign-in for this provider, without it the provider can not be used to sign users in.
+   */
+  signIn?: {
+    /**
+     * Maps an auth result to a Backstage identity for the user.
+     */
+    resolver: SignInResolver<OAuthResult>;
+  };
+}): AuthProviderFactory => {
   return ({
     providerId,
     globalConfig,
diff --git a/plugins/auth-backend/src/providers/aws-alb/provider.ts b/plugins/auth-backend/src/providers/aws-alb/provider.ts
index 12f7c7f4b4..20b6f6f2ef 100644
--- a/plugins/auth-backend/src/providers/aws-alb/provider.ts
+++ b/plugins/auth-backend/src/providers/aws-alb/provider.ts
@@ -220,6 +220,9 @@ export class AwsAlbAuthProvider implements AuthProviderRouteHandlers {
   }
 }
 
+/**
+ * @deprecated This type has been inlined into the create method and will be removed.
+ */
 export type AwsAlbProviderOptions = {
   /**
    * The profile transformation function used to verify and convert the auth response
@@ -238,9 +241,23 @@ export type AwsAlbProviderOptions = {
   };
 };
 
-export const createAwsAlbProvider = (
-  options?: AwsAlbProviderOptions,
-): AuthProviderFactory => {
+export const createAwsAlbProvider = (options?: {
+  /**
+   * The profile transformation function used to verify and convert the auth response
+   * into the profile that will be presented to the user.
+   */
+  authHandler?: AuthHandler<AwsAlbResult>;
+
+  /**
+   * Configure sign-in for this provider, without it the provider can not be used to sign users in.
+   */
+  signIn: {
+    /**
+     * Maps an auth result to a Backstage identity for the user.
+     */
+    resolver: SignInResolver<AwsAlbResult>;
+  };
+}): AuthProviderFactory => {
   return ({ config, tokenIssuer, catalogApi, logger, tokenManager }) => {
     const region = config.getString('region');
     const issuer = config.getOptionalString('iss');
diff --git a/plugins/auth-backend/src/providers/bitbucket/provider.ts b/plugins/auth-backend/src/providers/bitbucket/provider.ts
index 1cc0e60bd8..30ea877843 100644
--- a/plugins/auth-backend/src/providers/bitbucket/provider.ts
+++ b/plugins/auth-backend/src/providers/bitbucket/provider.ts
@@ -247,6 +247,9 @@ export const bitbucketUserIdSignInResolver: SignInResolver<
   return { id: entity.metadata.name, entity, token };
 };
 
+/**
+ * @deprecated This type has been inlined into the create method and will be removed.
+ */
 export type BitbucketProviderOptions = {
   /**
    * The profile transformation function used to verify and convert the auth response
@@ -265,9 +268,23 @@ export type BitbucketProviderOptions = {
   };
 };
 
-export const createBitbucketProvider = (
-  options?: BitbucketProviderOptions,
-): AuthProviderFactory => {
+export const createBitbucketProvider = (options?: {
+  /**
+   * The profile transformation function used to verify and convert the auth response
+   * into the profile that will be presented to the user.
+   */
+  authHandler?: AuthHandler<OAuthResult>;
+
+  /**
+   * Configure sign-in for this provider, without it the provider can not be used to sign users in.
+   */
+  signIn?: {
+    /**
+     * Maps an auth result to a Backstage identity for the user.
+     */
+    resolver: SignInResolver<OAuthResult>;
+  };
+}): AuthProviderFactory => {
   return ({
     providerId,
     globalConfig,
diff --git a/plugins/auth-backend/src/providers/gcp-iap/provider.ts b/plugins/auth-backend/src/providers/gcp-iap/provider.ts
index 7816f68b76..388d1902c4 100644
--- a/plugins/auth-backend/src/providers/gcp-iap/provider.ts
+++ b/plugins/auth-backend/src/providers/gcp-iap/provider.ts
@@ -99,9 +99,25 @@ export class GcpIapProvider implements AuthProviderRouteHandlers {
  *
  * @public
  */
-export function createGcpIapProvider(
-  options: GcpIapProviderOptions,
-): AuthProviderFactory {
+export function createGcpIapProvider(options: {
+  /**
+   * The profile transformation function used to verify and convert the auth
+   * response into the profile that will be presented to the user. The default
+   * implementation just provides the authenticated email that the IAP
+   * presented.
+   */
+  authHandler?: AuthHandler<GcpIapResult>;
+
+  /**
+   * Configures sign-in for this provider.
+   */
+  signIn: {
+    /**
+     * Maps an auth result to a Backstage identity for the user.
+     */
+    resolver: SignInResolver<GcpIapResult>;
+  };
+}): AuthProviderFactory {
   return ({ config, tokenIssuer, catalogApi, logger, tokenManager }) => {
     const audience = config.getString('audience');
 
diff --git a/plugins/auth-backend/src/providers/gcp-iap/types.ts b/plugins/auth-backend/src/providers/gcp-iap/types.ts
index 9ef1935442..3ef8c049b9 100644
--- a/plugins/auth-backend/src/providers/gcp-iap/types.ts
+++ b/plugins/auth-backend/src/providers/gcp-iap/types.ts
@@ -71,9 +71,7 @@ export type GcpIapProviderInfo = {
 export type GcpIapResponse = AuthResponse<GcpIapProviderInfo>;
 
 /**
- * Options for {@link createGcpIapProvider}.
- *
- * @public
+ * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type GcpIapProviderOptions = {
   /**
diff --git a/plugins/auth-backend/src/providers/github/provider.ts b/plugins/auth-backend/src/providers/github/provider.ts
index e57722d611..44db24772b 100644
--- a/plugins/auth-backend/src/providers/github/provider.ts
+++ b/plugins/auth-backend/src/providers/github/provider.ts
@@ -273,6 +273,9 @@ export const githubUsernameEntityNameSignInResolver: SignInResolver<
   return { id: userId, token };
 };
 
+/**
+ * @deprecated This type has been inlined into the create method and will be removed.
+ */
 export type GithubProviderOptions = {
   /**
    * The profile transformation function used to verify and convert the auth response
@@ -309,9 +312,41 @@ export type GithubProviderOptions = {
   stateEncoder?: StateEncoder;
 };
 
-export const createGithubProvider = (
-  options?: GithubProviderOptions,
-): AuthProviderFactory => {
+export const createGithubProvider = (options?: {
+  /**
+   * The profile transformation function used to verify and convert the auth response
+   * into the profile that will be presented to the user.
+   */
+  authHandler?: AuthHandler<GithubOAuthResult>;
+
+  /**
+   * Configure sign-in for this provider, without it the provider can not be used to sign users in.
+   */
+  signIn?: {
+    /**
+     * Maps an auth result to a Backstage identity for the user.
+     */
+    resolver: SignInResolver<GithubOAuthResult>;
+  };
+
+  /**
+   * The state encoder used to encode the 'state' parameter on the OAuth request.
+   *
+   * It should return a string that takes the state params (from the request), url encodes the params
+   * and finally base64 encodes them.
+   *
+   * Providing your own stateEncoder will allow you to add addition parameters to the state field.
+   *
+   * It is typed as follows:
+   *   `export type StateEncoder = (input: OAuthState) => Promise<{encodedState: string}>;`
+   *
+   * Note: the stateEncoder must encode a 'nonce' value and an 'env' value. Without this, the OAuth flow will fail
+   * (These two values will be set by the req.state by default)
+   *
+   * For more information, please see the helper module in ../../oauth/helpers #readState
+   */
+  stateEncoder?: StateEncoder;
+}): AuthProviderFactory => {
   return ({
     providerId,
     globalConfig,
diff --git a/plugins/auth-backend/src/providers/gitlab/provider.ts b/plugins/auth-backend/src/providers/gitlab/provider.ts
index 91a9b5d8f6..a26313fe95 100644
--- a/plugins/auth-backend/src/providers/gitlab/provider.ts
+++ b/plugins/auth-backend/src/providers/gitlab/provider.ts
@@ -211,6 +211,9 @@ export class GitlabAuthProvider implements OAuthHandlers {
   }
 }
 
+/**
+ * @deprecated This type has been inlined into the create method and will be removed.
+ */
 export type GitlabProviderOptions = {
   /**
    * The profile transformation function used to verify and convert the auth response
@@ -232,9 +235,26 @@ export type GitlabProviderOptions = {
   };
 };
 
-export const createGitlabProvider = (
-  options?: GitlabProviderOptions,
-): AuthProviderFactory => {
+export const createGitlabProvider = (options?: {
+  /**
+   * The profile transformation function used to verify and convert the auth response
+   * into the profile that will be presented to the user.
+   */
+  authHandler?: AuthHandler<OAuthResult>;
+
+  /**
+   * Configure sign-in for this provider, without it the provider can not be used to sign users in.
+   */
+  /**
+   * Maps an auth result to a Backstage identity for the user.
+   *
+   * Set to `'email'` to use the default email-based sign in resolver, which will search
+   * the catalog for a single user entity that has a matching `microsoft.com/email` annotation.
+   */
+  signIn?: {
+    resolver: SignInResolver<OAuthResult>;
+  };
+}): AuthProviderFactory => {
   return ({
     providerId,
     globalConfig,
diff --git a/plugins/auth-backend/src/providers/microsoft/provider.ts b/plugins/auth-backend/src/providers/microsoft/provider.ts
index 4bc16fdbef..954f7742c4 100644
--- a/plugins/auth-backend/src/providers/microsoft/provider.ts
+++ b/plugins/auth-backend/src/providers/microsoft/provider.ts
@@ -220,6 +220,9 @@ export const microsoftEmailSignInResolver: SignInResolver<OAuthResult> = async (
   return { id: entity.metadata.name, entity, token };
 };
 
+/**
+ * @deprecated This type has been inlined into the create method and will be removed.
+ */
 export type MicrosoftProviderOptions = {
   /**
    * The profile transformation function used to verify and convert the auth response
@@ -238,9 +241,23 @@ export type MicrosoftProviderOptions = {
   };
 };
 
-export const createMicrosoftProvider = (
-  options?: MicrosoftProviderOptions,
-): AuthProviderFactory => {
+export const createMicrosoftProvider = (options?: {
+  /**
+   * The profile transformation function used to verify and convert the auth response
+   * into the profile that will be presented to the user.
+   */
+  authHandler?: AuthHandler<OAuthResult>;
+
+  /**
+   * Configure sign-in for this provider, without it the provider can not be used to sign users in.
+   */
+  signIn?: {
+    /**
+     * Maps an auth result to a Backstage identity for the user.
+     */
+    resolver: SignInResolver<OAuthResult>;
+  };
+}): AuthProviderFactory => {
   return ({
     providerId,
     globalConfig,
diff --git a/plugins/auth-backend/src/providers/oauth2-proxy/provider.ts b/plugins/auth-backend/src/providers/oauth2-proxy/provider.ts
index 8c4dcc3249..f89f759270 100644
--- a/plugins/auth-backend/src/providers/oauth2-proxy/provider.ts
+++ b/plugins/auth-backend/src/providers/oauth2-proxy/provider.ts
@@ -51,9 +51,7 @@ export type OAuth2ProxyResult<JWTPayload> = {
 };
 
 /**
- * Options for the oauth2-proxy provider factory
- *
- * @public
+ * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type Oauth2ProxyProviderOptions<JWTPayload> = {
   /**
@@ -179,9 +177,22 @@ export class Oauth2ProxyAuthProvider<JWTPayload>
  * @public
  */
 export const createOauth2ProxyProvider =
-  <JWTPayload>(
-    options: Oauth2ProxyProviderOptions<JWTPayload>,
-  ): AuthProviderFactory =>
+  <JWTPayload>(options: {
+    /**
+     * Configure an auth handler to generate a profile for the user.
+     */
+    authHandler: AuthHandler<OAuth2ProxyResult<JWTPayload>>;
+
+    /**
+     * Configure sign-in for this provider, without it the provider can not be used to sign users in.
+     */
+    signIn: {
+      /**
+       * Maps an auth result to a Backstage identity for the user.
+       */
+      resolver: SignInResolver<OAuth2ProxyResult<JWTPayload>>;
+    };
+  }): AuthProviderFactory =>
   ({ catalogApi, logger, tokenIssuer, tokenManager }) => {
     const signInResolver = options.signIn.resolver;
     const authHandler = options.authHandler;
diff --git a/plugins/auth-backend/src/providers/oauth2/provider.ts b/plugins/auth-backend/src/providers/oauth2/provider.ts
index efe7dbe82b..5c5df2a748 100644
--- a/plugins/auth-backend/src/providers/oauth2/provider.ts
+++ b/plugins/auth-backend/src/providers/oauth2/provider.ts
@@ -198,6 +198,9 @@ export class OAuth2AuthProvider implements OAuthHandlers {
   }
 }
 
+/**
+ * @deprecated This type has been inlined into the create method and will be removed.
+ */
 export type OAuth2ProviderOptions = {
   authHandler?: AuthHandler<OAuthResult>;
 
@@ -206,9 +209,13 @@ export type OAuth2ProviderOptions = {
   };
 };
 
-export const createOAuth2Provider = (
-  options?: OAuth2ProviderOptions,
-): AuthProviderFactory => {
+export const createOAuth2Provider = (options?: {
+  authHandler?: AuthHandler<OAuthResult>;
+
+  signIn?: {
+    resolver: SignInResolver<OAuthResult>;
+  };
+}): AuthProviderFactory => {
   return ({
     providerId,
     globalConfig,
diff --git a/plugins/auth-backend/src/providers/oidc/provider.ts b/plugins/auth-backend/src/providers/oidc/provider.ts
index f90adb2922..82f6df8faf 100644
--- a/plugins/auth-backend/src/providers/oidc/provider.ts
+++ b/plugins/auth-backend/src/providers/oidc/provider.ts
@@ -212,16 +212,7 @@ export class OidcAuthProvider implements OAuthHandlers {
 }
 
 /**
- * OIDC provider callback options. An auth handler and a sign in resolver
- * can be passed while creating a OIDC provider.
- *
- * authHandler : called after sign in was successful, a new object must be returned which includes a profile
- * signInResolver: called after sign in was successful, expects to return a new {@link @backstage/plugin-auth-node#BackstageSignInResult}
- *
- * Both options are optional. There is fallback for authHandler where the default handler expect an e-mail explicitly
- * otherwise it throws an error
- *
- * @public
+ * @deprecated This type has been inlined into the create method and will be removed.
  */
 export type OidcProviderOptions = {
   authHandler?: AuthHandler<OidcAuthResult>;
@@ -231,9 +222,13 @@ export type OidcProviderOptions = {
   };
 };
 
-export const createOidcProvider = (
-  options?: OidcProviderOptions,
-): AuthProviderFactory => {
+export const createOidcProvider = (options?: {
+  authHandler?: AuthHandler<OidcAuthResult>;
+
+  signIn?: {
+    resolver: SignInResolver<OidcAuthResult>;
+  };
+}): AuthProviderFactory => {
   return ({
     providerId,
     globalConfig,
diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts
index 36f1e00ee2..74fbe8159c 100644
--- a/plugins/auth-backend/src/providers/okta/provider.ts
+++ b/plugins/auth-backend/src/providers/okta/provider.ts
@@ -223,6 +223,9 @@ export const oktaEmailSignInResolver: SignInResolver<OAuthResult> = async (
   return { id: entity.metadata.name, entity, token };
 };
 
+/**
+ * @deprecated This type has been inlined into the create method and will be removed.
+ */
 export type OktaProviderOptions = {
   /**
    * The profile transformation function used to verify and convert the auth response
@@ -241,9 +244,23 @@ export type OktaProviderOptions = {
   };
 };
 
-export const createOktaProvider = (
-  _options?: OktaProviderOptions,
-): AuthProviderFactory => {
+export const createOktaProvider = (_options?: {
+  /**
+   * The profile transformation function used to verify and convert the auth response
+   * into the profile that will be presented to the user.
+   */
+  authHandler?: AuthHandler<OAuthResult>;
+
+  /**
+   * Configure sign-in for this provider, without it the provider can not be used to sign users in.
+   */
+  signIn?: {
+    /**
+     * Maps an auth result to a Backstage identity for the user.
+     */
+    resolver: SignInResolver<OAuthResult>;
+  };
+}): AuthProviderFactory => {
   return ({
     providerId,
     globalConfig,
diff --git a/plugins/auth-backend/src/providers/onelogin/provider.ts b/plugins/auth-backend/src/providers/onelogin/provider.ts
index 8e354aeb60..526d432b82 100644
--- a/plugins/auth-backend/src/providers/onelogin/provider.ts
+++ b/plugins/auth-backend/src/providers/onelogin/provider.ts
@@ -179,7 +179,9 @@ export class OneLoginProvider implements OAuthHandlers {
   }
 }
 
-/** @public */
+/**
+ * @deprecated This type has been inlined into the create method and will be removed.
+ */
 export type OneLoginProviderOptions = {
   /**
    * The profile transformation function used to verify and convert the auth response
@@ -199,9 +201,23 @@ export type OneLoginProviderOptions = {
 };
 
 /** @public */
-export const createOneLoginProvider = (
-  options?: OneLoginProviderOptions,
-): AuthProviderFactory => {
+export const createOneLoginProvider = (options?: {
+  /**
+   * The profile transformation function used to verify and convert the auth response
+   * into the profile that will be presented to the user.
+   */
+  authHandler?: AuthHandler<OAuthResult>;
+
+  /**
+   * Configure sign-in for this provider, without it the provider can not be used to sign users in.
+   */
+  signIn?: {
+    /**
+     * Maps an auth result to a Backstage identity for the user.
+     */
+    resolver: SignInResolver<OAuthResult>;
+  };
+}): AuthProviderFactory => {
   return ({
     providerId,
     globalConfig,
diff --git a/plugins/auth-backend/src/providers/saml/provider.ts b/plugins/auth-backend/src/providers/saml/provider.ts
index c3b4fc59e8..bcd77fb7d3 100644
--- a/plugins/auth-backend/src/providers/saml/provider.ts
+++ b/plugins/auth-backend/src/providers/saml/provider.ts
@@ -174,7 +174,9 @@ export const samlNameIdEntityNameSignInResolver: SignInResolver<
 
 type SignatureAlgorithm = 'sha1' | 'sha256' | 'sha512';
 
-/** @public */
+/**
+ * @deprecated This type has been inlined into the create method and will be removed.
+ */
 export type SamlProviderOptions = {
   /**
    * The profile transformation function used to verify and convert the auth response
@@ -194,9 +196,23 @@ export type SamlProviderOptions = {
 };
 
 /** @public */
-export const createSamlProvider = (
-  options?: SamlProviderOptions,
-): AuthProviderFactory => {
+export const createSamlProvider = (options?: {
+  /**
+   * The profile transformation function used to verify and convert the auth response
+   * into the profile that will be presented to the user.
+   */
+  authHandler?: AuthHandler<SamlAuthResult>;
+
+  /**
+   * Configure sign-in for this provider, without it the provider can not be used to sign users in.
+   */
+  signIn?: {
+    /**
+     * Maps an auth result to a Backstage identity for the user.
+     */
+    resolver: SignInResolver<SamlAuthResult>;
+  };
+}): AuthProviderFactory => {
   return ({
     providerId,
     globalConfig,