diff --git a/packages/backend-defaults/src/entrypoints/auth/DefaultAuthService.ts b/packages/backend-defaults/src/entrypoints/auth/DefaultAuthService.ts
index 189976ed7d..511c11ce40 100644
--- a/packages/backend-defaults/src/entrypoints/auth/DefaultAuthService.ts
+++ b/packages/backend-defaults/src/entrypoints/auth/DefaultAuthService.ts
@@ -87,6 +87,7 @@ export class DefaultAuthService implements AuthService {
         userResult.userEntityRef,
         token,
         this.#getJwtExpiration(token),
+        this.pluginId,
       );
     }
 
diff --git a/packages/backend-defaults/src/entrypoints/auth/helpers.ts b/packages/backend-defaults/src/entrypoints/auth/helpers.ts
index 266d3e86b8..2023cb9c2c 100644
--- a/packages/backend-defaults/src/entrypoints/auth/helpers.ts
+++ b/packages/backend-defaults/src/entrypoints/auth/helpers.ts
@@ -51,7 +51,7 @@ export function createCredentialsWithUserPrincipal(
   sub: string,
   token: string,
   expiresAt?: Date,
-  viaSubject?: string,
+  issuedBySubject?: string,
 ): InternalBackstageCredentials<BackstageUserPrincipal> {
   return Object.defineProperty(
     {
@@ -61,7 +61,9 @@ export function createCredentialsWithUserPrincipal(
       principal: {
         type: 'user',
         userEntityRef: sub,
-        ...(viaSubject && { via: { type: 'service', subject: viaSubject } }),
+        ...(issuedBySubject && {
+          issuedBy: { type: 'service', subject: issuedBySubject },
+        }),
       },
     },
     'token',
diff --git a/packages/backend-plugin-api/src/services/definitions/AuthService.ts b/packages/backend-plugin-api/src/services/definitions/AuthService.ts
index eeac3ea924..976e5ed1a5 100644
--- a/packages/backend-plugin-api/src/services/definitions/AuthService.ts
+++ b/packages/backend-plugin-api/src/services/definitions/AuthService.ts
@@ -36,7 +36,16 @@ export type BackstageUserPrincipal = {
    */
   userEntityRef: string;
 
-  via?: BackstageServicePrincipal;
+  /**
+   * The service principal that issued the token on behalf of the user.
+   *
+   * @remarks
+   *
+   * This field is present in scenarios where a backend service acts on behalf
+   * of a user. It provides context about the intermediary service that
+   * facilitated the authentication.
+   */
+  issuedBy?: BackstageServicePrincipal;
 };
 
 /**