diff --git a/.changeset/itchy-kiwis-warn.md b/.changeset/itchy-kiwis-warn.md
index e69aeecfa1..6f5289d074 100644
--- a/.changeset/itchy-kiwis-warn.md
+++ b/.changeset/itchy-kiwis-warn.md
@@ -3,3 +3,50 @@
 ---
 
 Adds `IdentityApi` configuration to `create-app` scaffolding templates.
+
+To migrate to the new `IdentityApi`, edit the `packages/backend/src/index.ts` adding the following import:
+
+```typescript
+import { DefaultIdentityClient } from '@backstage/plugin-auth-node';
+```
+
+Use the factory function to create an `IdentityApi` in the `makeCreateEnv` function and return it from the
+function as follows:
+
+```typescript
+function makeCreateEnv(config: Config) {
+...
+  const identity = DefaultIdentityClient.create({
+    discovery,
+  });
+...
+
+  return {
+    ...,
+    identity
+  }
+}
+```
+
+Backend plugins can be upgraded to work with this new `IdentityApi`.
+
+Add `identity` to the `RouterOptions` type.
+
+```typescript
+export interface RouterOptions {
+  ...
+  identity: IdentityApi;
+}
+```
+
+Then you can use the `IdentityApi` from the plugin.
+
+```typescript
+export async function createRouter(
+  options: RouterOptions,
+): Promise<express.Router> {
+  const { identity } = options;
+
+  const user = identity.getIdentity(req);
+  ...
+```
diff --git a/.changeset/thin-cows-watch.md b/.changeset/thin-cows-watch.md
index aedac54c8f..675a27769b 100644
--- a/.changeset/thin-cows-watch.md
+++ b/.changeset/thin-cows-watch.md
@@ -1,5 +1,4 @@
 ---
-'@internal/plugin-todo-list-backend': patch
 '@backstage/plugin-permission-backend': patch
 '@backstage/plugin-scaffolder-backend': patch
 ---
diff --git a/packages/create-app/templates/default-app/packages/backend/src/index.ts b/packages/create-app/templates/default-app/packages/backend/src/index.ts
index 492c05d556..7232a1afe6 100644
--- a/packages/create-app/templates/default-app/packages/backend/src/index.ts
+++ b/packages/create-app/templates/default-app/packages/backend/src/index.ts
@@ -43,8 +43,6 @@ function makeCreateEnv(config: Config) {
 
   const identity = DefaultIdentityClient.create({
     discovery,
-    issuer: undefined,
-    algorithms: undefined,
   });
 
   const permissions = ServerPermissionClient.fromConfig(config, {
diff --git a/plugins/auth-node/api-report.md b/plugins/auth-node/api-report.md
index 0f1c5bb934..902a3ad0b0 100644
--- a/plugins/auth-node/api-report.md
+++ b/plugins/auth-node/api-report.md
@@ -4,7 +4,6 @@
 
 ```ts
 import { PluginEndpointDiscovery } from '@backstage/backend-common';
-import { Request as Request_2 } from 'express';
 
 // @public
 export interface BackstageIdentityResponse extends BackstageSignInResult {
@@ -29,7 +28,7 @@ export class DefaultIdentityClient implements IdentityApi {
   authenticate(token: string | undefined): Promise<BackstageIdentityResponse>;
   static create(options: IdentityClientOptions): DefaultIdentityClient;
   // (undocumented)
-  getIdentity(req: Request_2): Promise<BackstageIdentityResponse | undefined>;
+  getIdentity(req: Request): Promise<BackstageIdentityResponse | undefined>;
 }
 
 // @public
@@ -39,9 +38,7 @@ export function getBearerTokenFromAuthorizationHeader(
 
 // @public
 export interface IdentityApi {
-  getIdentity(
-    req: Request_2<any>,
-  ): Promise<BackstageIdentityResponse | undefined>;
+  getIdentity(req: Request): Promise<BackstageIdentityResponse | undefined>;
 }
 
 // @public @deprecated
diff --git a/plugins/auth-node/package.json b/plugins/auth-node/package.json
index 38bb96d214..294bc08889 100644
--- a/plugins/auth-node/package.json
+++ b/plugins/auth-node/package.json
@@ -26,8 +26,6 @@
     "@backstage/backend-common": "^0.15.0-next.0",
     "@backstage/config": "^1.0.1",
     "@backstage/errors": "^1.1.0",
-    "@types/express": "^4.17.6",
-    "express": "^4.18.1",
     "jose": "^4.6.0",
     "node-fetch": "^2.6.7",
     "winston": "^3.2.1"
diff --git a/plugins/auth-node/src/DefaultIdentityClient.ts b/plugins/auth-node/src/DefaultIdentityClient.ts
index 93fdb5542b..6d1394bd55 100644
--- a/plugins/auth-node/src/DefaultIdentityClient.ts
+++ b/plugins/auth-node/src/DefaultIdentityClient.ts
@@ -27,7 +27,6 @@ import { GetKeyFunction } from 'jose/dist/types/types';
 
 import { BackstageIdentityResponse } from './types';
 import { getBearerTokenFromAuthorizationHeader, IdentityApi } from '.';
-import { Request } from 'express';
 
 const CLOCK_MARGIN_S = 10;
 
@@ -78,7 +77,7 @@ export class DefaultIdentityClient implements IdentityApi {
   async getIdentity(req: Request) {
     try {
       return await this.authenticate(
-        getBearerTokenFromAuthorizationHeader(req.headers.authorization),
+        getBearerTokenFromAuthorizationHeader(req.headers.get('authorization')),
       );
     } catch (e) {
       return undefined;
diff --git a/plugins/auth-node/src/IdentityApi.ts b/plugins/auth-node/src/IdentityApi.ts
index 2387d01f65..7aec553101 100644
--- a/plugins/auth-node/src/IdentityApi.ts
+++ b/plugins/auth-node/src/IdentityApi.ts
@@ -13,7 +13,6 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { Request } from 'express';
 import { BackstageIdentityResponse } from './types';
 
 /**
@@ -29,7 +28,5 @@ export interface IdentityApi {
    * Returns a BackstageIdentity (user) matching the token.
    * The method throws an error if verification fails.
    */
-  getIdentity(
-    req: Request<any>,
-  ): Promise<BackstageIdentityResponse | undefined>;
+  getIdentity(req: Request): Promise<BackstageIdentityResponse | undefined>;
 }
diff --git a/plugins/scaffolder-backend/src/service/router.ts b/plugins/scaffolder-backend/src/service/router.ts
index ebc9dfc69d..a20d3f6ae3 100644
--- a/plugins/scaffolder-backend/src/service/router.ts
+++ b/plugins/scaffolder-backend/src/service/router.ts
@@ -60,6 +60,7 @@ export interface RouterOptions {
   reader: UrlReader;
   database: PluginDatabaseManager;
   catalogClient: CatalogApi;
+
   actions?: TemplateAction<any>[];
   taskWorkers?: number;
   taskBroker?: TaskBroker;