diff --git a/packages/core-plugin-api/src/apis/definitions/AuthErrorApi.ts b/packages/core-plugin-api/src/apis/definitions/AuthErrorApi.ts
index 57c6b1088f..558c1202a8 100644
--- a/packages/core-plugin-api/src/apis/definitions/AuthErrorApi.ts
+++ b/packages/core-plugin-api/src/apis/definitions/AuthErrorApi.ts
@@ -41,5 +41,5 @@ export type AuthErrorApi = {
  * @public
  */
 export const authErrorApiRef: ApiRef<AuthErrorApi> = createApiRef({
-  id: 'core.authError',
+  id: 'core.auth-error',
 });
diff --git a/plugins/auth-backend/src/service/createCookieAuthErrorMiddleware.ts b/plugins/auth-backend/src/service/createCookieAuthErrorMiddleware.ts
index cf7645b081..325126d831 100644
--- a/plugins/auth-backend/src/service/createCookieAuthErrorMiddleware.ts
+++ b/plugins/auth-backend/src/service/createCookieAuthErrorMiddleware.ts
@@ -22,17 +22,25 @@ const AUTH_ERROR_COOKIE = 'auth-error';
  * @public
  * Creates a middleware that can be used to get auth errors in redirect flow
  */
-export function createCookieAuthErrorMiddleware(authUrl: string) {
+export function createCookieAuthErrorMiddleware(
+  appUrl: string,
+  authUrl: string,
+) {
   const router = Router();
 
   router.get('/.backstage/error', async (req, res) => {
     const error = req.cookies[AUTH_ERROR_COOKIE];
     if (error) {
-      const { hostname: domain } = new URL(authUrl);
+      const { hostname: domain, protocol } = new URL(authUrl);
+      const secure = protocol === 'https:';
+      const sameSite =
+        new URL(appUrl).hostname !== domain && secure ? 'none' : 'lax';
 
       res.clearCookie(AUTH_ERROR_COOKIE, {
         path: '/api/auth/.backstage/error',
         domain,
+        sameSite,
+        secure,
       });
       res.status(200).json(error);
     } else {
diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index 0f6e7d201a..b1952755ca 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -179,7 +179,7 @@ export async function createRouter(
     throw new NotFoundError(`Unknown auth provider '${provider}'`);
   });
 
-  router.use(createCookieAuthErrorMiddleware(authUrl));
+  router.use(createCookieAuthErrorMiddleware(appUrl, authUrl));
 
   return router;
 }