diff --git a/docs/auth/github/provider.md b/docs/auth/github/provider.md
index 05726e8a4e..bcd6f3092e 100644
--- a/docs/auth/github/provider.md
+++ b/docs/auth/github/provider.md
@@ -41,6 +41,8 @@ auth:
         clientSecret: ${AUTH_GITHUB_CLIENT_SECRET}
         ## uncomment if using GitHub Enterprise
         # enterpriseInstanceUrl: ${AUTH_GITHUB_ENTERPRISE_INSTANCE_URL}
+        ## uncomment if intermediate service is used when using github apps
+        # callbackUrl: ${AUTH_GITHUB_CALLBACK_URL}
 ```
 
 The GitHub provider is a structure with three configuration keys:
@@ -50,6 +52,10 @@ The GitHub provider is a structure with three configuration keys:
 - `clientSecret`: The client secret tied to the generated client ID.
 - `enterpriseInstanceUrl` (optional): The base URL for a GitHub Enterprise
   instance, e.g. `https://ghe.<company>.com`. Only needed for GitHub Enterprise.
+- `callbackUrl` (optional): The callback url that GitHub will use when
+  initiating an OAuth flow, e.g.
+  `https://your-intermediate-service.com/handler`. Only needed if Backstage is
+  not the immediate receiver (e.g. one OAuth app for many backstage instances).
 
 ## Adding the provider to the Backstage frontend
 
diff --git a/plugins/auth-backend/src/providers/github/provider.ts b/plugins/auth-backend/src/providers/github/provider.ts
index 41d08b9230..f1949eafa3 100644
--- a/plugins/auth-backend/src/providers/github/provider.ts
+++ b/plugins/auth-backend/src/providers/github/provider.ts
@@ -223,8 +223,7 @@ export const createGithubProvider = (
       const enterpriseInstanceUrl = envConfig.getOptionalString(
         'enterpriseInstanceUrl',
       );
-      const customCallbackUrl =
-        envConfig.getOptionalString('customCallbackUrl');
+      const customCallbackUrl = envConfig.getOptionalString('callbackUrl');
       const authorizationUrl = enterpriseInstanceUrl
         ? `${enterpriseInstanceUrl}/login/oauth/authorize`
         : undefined;