diff --git a/.changeset/gentle-llamas-press.md b/.changeset/gentle-llamas-press.md
new file mode 100644
index 0000000000..9c922d396f
--- /dev/null
+++ b/.changeset/gentle-llamas-press.md
@@ -0,0 +1,6 @@
+---
+'@backstage/backend-defaults': patch
+'@backstage/backend-test-utils': minor
+---
+
+Add a standard `toString` on credentials objects
diff --git a/packages/backend-defaults/src/entrypoints/auth/helpers.test.ts b/packages/backend-defaults/src/entrypoints/auth/helpers.test.ts
index 8454aa3ecc..fdc6e26c3a 100644
--- a/packages/backend-defaults/src/entrypoints/auth/helpers.test.ts
+++ b/packages/backend-defaults/src/entrypoints/auth/helpers.test.ts
@@ -42,6 +42,23 @@ describe('credentials', () => {
       },
     });
 
+    expect(
+      createCredentialsWithUserPrincipal(
+        'user:default/mock',
+        'my-token',
+        undefined,
+        'my-actor',
+      ),
+    ).toEqual({
+      $$type: '@backstage/BackstageCredentials',
+      version: 'v1',
+      principal: {
+        type: 'user',
+        userEntityRef: 'user:default/mock',
+        actor: { type: 'service', subject: 'my-actor' },
+      },
+    });
+
     expect(createCredentialsWithNonePrincipal()).toEqual({
       $$type: '@backstage/BackstageCredentials',
       version: 'v1',
@@ -64,4 +81,63 @@ describe('credentials', () => {
       ),
     ).not.toMatch(/my-token/);
   });
+
+  it('should have a serializable form both as strings and as JSON', () => {
+    const simpleService = createCredentialsWithServicePrincipal('my-service');
+    expect(String(simpleService)).toMatchInlineSnapshot(
+      `"backstageCredentials{servicePrincipal{my-service}}"`,
+    );
+    expect(JSON.stringify(simpleService)).toMatchInlineSnapshot(
+      `"{"$$type":"@backstage/BackstageCredentials","version":"v1","principal":{"type":"service","subject":"my-service"}}"`,
+    );
+
+    const serviceWithAccessRestrictions = createCredentialsWithServicePrincipal(
+      'my-service',
+      undefined,
+      {
+        permissionNames: ['perm'],
+        permissionAttributes: {
+          action: ['read'],
+        },
+      },
+    );
+    expect(String(serviceWithAccessRestrictions)).toMatchInlineSnapshot(
+      `"backstageCredentials{servicePrincipal{my-service,accessRestrictions=cXWOJgUirHkHNZIowUi/YO5nwEwhTicC38iXi2XTYCk}}"`,
+    );
+    expect(JSON.stringify(serviceWithAccessRestrictions)).toMatchInlineSnapshot(
+      `"{"$$type":"@backstage/BackstageCredentials","version":"v1","principal":{"type":"service","subject":"my-service","accessRestrictions":{"permissionNames":["perm"],"permissionAttributes":{"action":["read"]}}}}"`,
+    );
+
+    const simpleUser = createCredentialsWithUserPrincipal(
+      'user:default/mock',
+      'my-token',
+    );
+    expect(String(simpleUser)).toMatchInlineSnapshot(
+      `"backstageCredentials{userPrincipal{user:default/mock}}"`,
+    );
+    expect(JSON.stringify(simpleUser)).toMatchInlineSnapshot(
+      `"{"$$type":"@backstage/BackstageCredentials","version":"v1","principal":{"type":"user","userEntityRef":"user:default/mock"}}"`,
+    );
+
+    const userWithActor = createCredentialsWithUserPrincipal(
+      'user:default/mock',
+      'my-token',
+      undefined,
+      'my-actor',
+    );
+    expect(String(userWithActor)).toMatchInlineSnapshot(
+      `"backstageCredentials{userPrincipal{user:default/mock,actor={servicePrincipal{my-actor}}}}"`,
+    );
+    expect(JSON.stringify(userWithActor)).toMatchInlineSnapshot(
+      `"{"$$type":"@backstage/BackstageCredentials","version":"v1","principal":{"type":"user","userEntityRef":"user:default/mock","actor":{"type":"service","subject":"my-actor"}}}"`,
+    );
+
+    const none = createCredentialsWithNonePrincipal();
+    expect(String(none)).toMatchInlineSnapshot(
+      `"backstageCredentials{nonePrincipal}"`,
+    );
+    expect(JSON.stringify(none)).toMatchInlineSnapshot(
+      `"{"$$type":"@backstage/BackstageCredentials","version":"v1","principal":{"type":"none"}}"`,
+    );
+  });
 });
diff --git a/packages/backend-defaults/src/entrypoints/auth/helpers.ts b/packages/backend-defaults/src/entrypoints/auth/helpers.ts
index 58e2bcff74..02840112a9 100644
--- a/packages/backend-defaults/src/entrypoints/auth/helpers.ts
+++ b/packages/backend-defaults/src/entrypoints/auth/helpers.ts
@@ -22,29 +22,34 @@ import {
   BackstageUserPrincipal,
 } from '@backstage/backend-plugin-api';
 import { InternalBackstageCredentials } from './types';
+import { createHash } from 'crypto';
 
 export function createCredentialsWithServicePrincipal(
   sub: string,
   token?: string,
   accessRestrictions?: BackstagePrincipalAccessRestrictions,
 ): InternalBackstageCredentials<BackstageServicePrincipal> {
-  return Object.defineProperty(
-    {
-      $$type: '@backstage/BackstageCredentials',
-      version: 'v1',
-      principal: {
-        type: 'service',
-        subject: sub,
-        accessRestrictions,
-      },
-    },
-    'token',
-    {
+  const principal = createServicePrincipal(sub, accessRestrictions);
+  const result = {
+    $$type: '@backstage/BackstageCredentials',
+    version: 'v1',
+    principal,
+  } as const;
+  Object.defineProperties(result, {
+    token: {
       enumerable: false,
       configurable: true,
+      writable: true,
       value: token,
     },
-  );
+    toString: {
+      enumerable: false,
+      configurable: true,
+      writable: true,
+      value: () => `backstageCredentials{${principal}}`,
+    },
+  });
+  return result;
 }
 
 export function createCredentialsWithUserPrincipal(
@@ -53,36 +58,49 @@ export function createCredentialsWithUserPrincipal(
   expiresAt?: Date,
   actor?: string,
 ): InternalBackstageCredentials<BackstageUserPrincipal> {
-  return Object.defineProperty(
-    {
-      $$type: '@backstage/BackstageCredentials',
-      version: 'v1',
-      expiresAt,
-      principal: {
-        type: 'user',
-        userEntityRef: sub,
-        ...(actor && {
-          actor: { type: 'service', subject: actor },
-        }),
-      },
-    },
-    'token',
-    {
+  const principal = createUserPrincipal(
+    sub,
+    actor ? createServicePrincipal(actor) : undefined,
+  );
+  const result = {
+    $$type: '@backstage/BackstageCredentials',
+    version: 'v1',
+    expiresAt,
+    principal,
+  } as const;
+  Object.defineProperties(result, {
+    token: {
       enumerable: false,
       configurable: true,
+      writable: true,
       value: token,
     },
-  );
+    toString: {
+      enumerable: false,
+      configurable: true,
+      writable: true,
+      value: () => `backstageCredentials{${principal}}`,
+    },
+  });
+  return result;
 }
 
 export function createCredentialsWithNonePrincipal(): InternalBackstageCredentials<BackstageNonePrincipal> {
-  return {
+  const principal = createNonePrincipal();
+  const result = {
     $$type: '@backstage/BackstageCredentials',
     version: 'v1',
-    principal: {
-      type: 'none',
+    principal,
+  } as const;
+  Object.defineProperties(result, {
+    toString: {
+      enumerable: false,
+      configurable: true,
+      writable: true,
+      value: () => `backstageCredentials{${principal}}`,
     },
-  };
+  });
+  return result;
 }
 
 export function toInternalBackstageCredentials(
@@ -106,3 +124,74 @@ export function toInternalBackstageCredentials(
 
   return internalCredentials;
 }
+
+function createServicePrincipal(
+  sub: string,
+  accessRestrictions?: BackstagePrincipalAccessRestrictions,
+): BackstageServicePrincipal {
+  const result = {
+    type: 'service',
+    subject: sub,
+    accessRestrictions,
+  } as const;
+  Object.defineProperties(result, {
+    toString: {
+      enumerable: false,
+      configurable: true,
+      writable: true,
+      value: () => {
+        let parts = sub;
+        if (accessRestrictions) {
+          const hash = createHash('sha256')
+            .update(JSON.stringify(accessRestrictions))
+            .digest('base64')
+            .replace(/=+$/, '');
+          parts += `,accessRestrictions=${hash}`;
+        }
+        return `servicePrincipal{${parts}}`;
+      },
+    },
+  });
+  return result;
+}
+
+function createUserPrincipal(
+  userEntityRef: string,
+  actor?: BackstageServicePrincipal,
+): BackstageUserPrincipal {
+  const result = {
+    type: 'user',
+    userEntityRef,
+    actor,
+  } as const;
+  Object.defineProperties(result, {
+    toString: {
+      enumerable: false,
+      configurable: true,
+      writable: true,
+      value: () => {
+        let parts = userEntityRef;
+        if (actor) {
+          parts += `,actor={${actor}}`;
+        }
+        return `userPrincipal{${parts}}`;
+      },
+    },
+  });
+  return result;
+}
+
+function createNonePrincipal(): BackstageNonePrincipal {
+  const result = {
+    type: 'none',
+  } as const;
+  Object.defineProperties(result, {
+    toString: {
+      enumerable: false,
+      configurable: true,
+      writable: true,
+      value: () => 'nonePrincipal',
+    },
+  });
+  return result;
+}
diff --git a/packages/backend-test-utils/src/services/mockCredentials.test.ts b/packages/backend-test-utils/src/services/mockCredentials.test.ts
index 343d6d6d20..9248e3bde0 100644
--- a/packages/backend-test-utils/src/services/mockCredentials.test.ts
+++ b/packages/backend-test-utils/src/services/mockCredentials.test.ts
@@ -170,4 +170,27 @@ describe('mockCredentials', () => {
       "Invalid user entity reference 'wrong', expected <kind>:<namespace>/<name>",
     );
   });
+
+  it('should have a serializable form', () => {
+    expect(String(mockCredentials.service('my-service'))).toMatchInlineSnapshot(
+      `"mockCredentials{servicePrincipal{my-service}}"`,
+    );
+    expect(
+      String(mockCredentials.user('user:default/mock')),
+    ).toMatchInlineSnapshot(
+      `"mockCredentials{userPrincipal{user:default/mock}}"`,
+    );
+    expect(
+      String(
+        mockCredentials.user('user:default/mock', {
+          actor: { subject: 'my-actor' },
+        }),
+      ),
+    ).toMatchInlineSnapshot(
+      `"mockCredentials{userPrincipal{user:default/mock,actor={my-actor}}}"`,
+    );
+    expect(String(mockCredentials.none())).toMatchInlineSnapshot(
+      `"mockCredentials{nonePrincipal}"`,
+    );
+  });
 });
diff --git a/packages/backend-test-utils/src/services/mockCredentials.ts b/packages/backend-test-utils/src/services/mockCredentials.ts
index 617ffdb240..d749f7edb1 100644
--- a/packages/backend-test-utils/src/services/mockCredentials.ts
+++ b/packages/backend-test-utils/src/services/mockCredentials.ts
@@ -76,10 +76,19 @@ export namespace mockCredentials {
    * Creates a mocked credentials object for a unauthenticated principal.
    */
   export function none(): BackstageCredentials<BackstageNonePrincipal> {
-    return {
+    const result = {
       $$type: '@backstage/BackstageCredentials',
       principal: { type: 'none' },
-    };
+    } as const;
+    Object.defineProperties(result, {
+      toString: {
+        enumerable: false,
+        configurable: true,
+        writable: true,
+        value: () => `mockCredentials{nonePrincipal}`,
+      },
+    });
+    return result;
   }
 
   /**
@@ -111,24 +120,32 @@ export namespace mockCredentials {
     options?: { actor?: { subject: string } },
   ): BackstageCredentials<BackstageUserPrincipal> {
     validateUserEntityRef(userEntityRef);
-    return Object.defineProperty(
-      {
-        $$type: '@backstage/BackstageCredentials',
-        principal: {
-          type: 'user',
-          userEntityRef,
-          ...(options?.actor && {
-            actor: { type: 'service', subject: options.actor.subject },
-          }),
-        },
+    const result = {
+      $$type: '@backstage/BackstageCredentials',
+      principal: {
+        type: 'user',
+        userEntityRef,
+        ...(options?.actor && {
+          actor: { type: 'service', subject: options.actor.subject } as const,
+        }),
       },
-      'token',
-      {
+    } as const;
+    Object.defineProperties(result, {
+      toString: {
+        enumerable: false,
+        configurable: true,
+        value: () =>
+          `mockCredentials{userPrincipal{${userEntityRef}${
+            options?.actor ? `,actor={${options.actor.subject}}` : ''
+          }}}`,
+      },
+      token: {
         enumerable: false,
         configurable: true,
         value: user.token(),
       },
-    );
+    });
+    return result;
   }
 
   /**
@@ -231,14 +248,27 @@ export namespace mockCredentials {
     subject: string = DEFAULT_MOCK_SERVICE_SUBJECT,
     accessRestrictions?: BackstagePrincipalAccessRestrictions,
   ): BackstageCredentials<BackstageServicePrincipal> {
-    return {
+    const result = {
       $$type: '@backstage/BackstageCredentials',
       principal: {
         type: 'service',
         subject,
         ...(accessRestrictions ? { accessRestrictions } : {}),
       },
-    };
+    } as const;
+    Object.defineProperties(result, {
+      toString: {
+        enumerable: false,
+        configurable: true,
+        value: () =>
+          `mockCredentials{servicePrincipal{${subject}${
+            accessRestrictions
+              ? `,accessRestrictions=${JSON.stringify(accessRestrictions)}`
+              : ''
+          }}}`,
+      },
+    });
+    return result;
   }
 
   /**