diff --git a/plugins/auth-backend/src/lib/flow/authFlowHelpers.test.ts b/plugins/auth-backend/src/lib/flow/authFlowHelpers.test.ts
new file mode 100644
index 0000000000..10e99c0fe1
--- /dev/null
+++ b/plugins/auth-backend/src/lib/flow/authFlowHelpers.test.ts
@@ -0,0 +1,103 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import express from 'express';
+import { ensuresXRequestedWith, postMessageResponse } from './authFlowHelpers';
+import { WebMessageResponse } from '../../providers/types';
+
+describe('OAuthProvider Utils', () => {
+  describe('postMessageResponse', () => {
+    const appOrigin = 'http://localhost:3000';
+    it('should post a message back with payload success', () => {
+      const mockResponse = ({
+        end: jest.fn().mockReturnThis(),
+        setHeader: jest.fn().mockReturnThis(),
+      } as unknown) as express.Response;
+
+      const data: WebMessageResponse = {
+        type: 'authorization_response',
+        response: {
+          providerInfo: {
+            accessToken: 'ACCESS_TOKEN',
+            idToken: 'ID_TOKEN',
+            expiresInSeconds: 10,
+            scope: 'email',
+          },
+          profile: {
+            email: 'foo@bar.com',
+          },
+          backstageIdentity: {
+            id: 'a',
+            idToken: 'a.b.c',
+          },
+        },
+      };
+      const jsonData = JSON.stringify(data);
+      const base64Data = Buffer.from(jsonData, 'utf8').toString('base64');
+
+      postMessageResponse(mockResponse, appOrigin, data);
+      expect(mockResponse.setHeader).toBeCalledTimes(3);
+      expect(mockResponse.end).toBeCalledTimes(1);
+      expect(mockResponse.end).toBeCalledWith(
+        expect.stringContaining(base64Data),
+      );
+    });
+
+    it('should post a message back with payload error', () => {
+      const mockResponse = ({
+        end: jest.fn().mockReturnThis(),
+        setHeader: jest.fn().mockReturnThis(),
+      } as unknown) as express.Response;
+
+      const data: WebMessageResponse = {
+        type: 'authorization_response',
+        error: new Error('Unknown error occured'),
+      };
+      const jsonData = JSON.stringify(data);
+      const base64Data = Buffer.from(jsonData, 'utf8').toString('base64');
+
+      postMessageResponse(mockResponse, appOrigin, data);
+      expect(mockResponse.setHeader).toBeCalledTimes(3);
+      expect(mockResponse.end).toBeCalledTimes(1);
+      expect(mockResponse.end).toBeCalledWith(
+        expect.stringContaining(base64Data),
+      );
+    });
+  });
+
+  describe('ensuresXRequestedWith', () => {
+    it('should return false if no header present', () => {
+      const mockRequest = ({
+        header: () => jest.fn(),
+      } as unknown) as express.Request;
+      expect(ensuresXRequestedWith(mockRequest)).toBe(false);
+    });
+
+    it('should return false if header present with incorrect value', () => {
+      const mockRequest = ({
+        header: () => 'INVALID',
+      } as unknown) as express.Request;
+      expect(ensuresXRequestedWith(mockRequest)).toBe(false);
+    });
+
+    it('should return true if header present with correct value', () => {
+      const mockRequest = ({
+        header: () => 'XMLHttpRequest',
+      } as unknown) as express.Request;
+      expect(ensuresXRequestedWith(mockRequest)).toBe(true);
+    });
+  });
+});
diff --git a/plugins/auth-backend/src/lib/flow/authFlowHelpers.ts b/plugins/auth-backend/src/lib/flow/authFlowHelpers.ts
new file mode 100644
index 0000000000..500a6cec8e
--- /dev/null
+++ b/plugins/auth-backend/src/lib/flow/authFlowHelpers.ts
@@ -0,0 +1,56 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import express from 'express';
+import crypto from 'crypto';
+import { WebMessageResponse } from '../../providers/types';
+
+export const postMessageResponse = (
+  res: express.Response,
+  appOrigin: string,
+  response: WebMessageResponse,
+) => {
+  const jsonData = JSON.stringify(response);
+  const base64Data = Buffer.from(jsonData, 'utf8').toString('base64');
+
+  res.setHeader('Content-Type', 'text/html');
+  res.setHeader('X-Frame-Options', 'sameorigin');
+
+  // TODO: Make target app origin configurable globally
+  const script = `
+    (window.opener || window.parent).postMessage(JSON.parse(atob('${base64Data}')), '${appOrigin}')
+    window.close()
+  `;
+  const hash = crypto.createHash('sha256').update(script).digest('base64');
+  res.setHeader('Content-Security-Policy', `script-src 'sha256-${hash}'`);
+
+  res.end(`
+<html>
+<body>
+  <script>${script}</script>
+</body>
+</html>
+  `);
+};
+
+export const ensuresXRequestedWith = (req: express.Request) => {
+  const requiredHeader = req.header('X-Requested-With');
+
+  if (!requiredHeader || requiredHeader !== 'XMLHttpRequest') {
+    return false;
+  }
+  return true;
+};
diff --git a/plugins/auth-backend/src/lib/flow/index.ts b/plugins/auth-backend/src/lib/flow/index.ts
new file mode 100644
index 0000000000..a5f2f7a3ac
--- /dev/null
+++ b/plugins/auth-backend/src/lib/flow/index.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { ensuresXRequestedWith, postMessageResponse } from './authFlowHelpers';
diff --git a/plugins/auth-backend/src/lib/OAuthProvider.test.ts b/plugins/auth-backend/src/lib/oauth/OAuthProvider.test.ts
similarity index 60%
rename from plugins/auth-backend/src/lib/OAuthProvider.test.ts
rename to plugins/auth-backend/src/lib/oauth/OAuthProvider.test.ts
index 06bbd15c51..124ace1013 100644
--- a/plugins/auth-backend/src/lib/OAuthProvider.test.ts
+++ b/plugins/auth-backend/src/lib/oauth/OAuthProvider.test.ts
@@ -16,15 +16,12 @@
 
 import express from 'express';
 import {
-  ensuresXRequestedWith,
-  postMessageResponse,
   THOUSAND_DAYS_MS,
   TEN_MINUTES_MS,
-  verifyNonce,
-  encodeState,
   OAuthProvider,
 } from './OAuthProvider';
-import { WebMessageResponse, OAuthProviderHandlers } from '../providers/types';
+import { OAuthProviderHandlers } from '../../providers/types';
+import { encodeState } from './helpers';
 
 const mockResponseData = {
   providerInfo: {
@@ -41,147 +38,6 @@ const mockResponseData = {
   },
 };
 
-describe('OAuthProvider Utils', () => {
-  describe('verifyNonce', () => {
-    it('should throw error if cookie nonce missing', () => {
-      const state = { nonce: 'NONCE', env: 'development' };
-      const mockRequest = ({
-        cookies: {},
-        query: {
-          state: encodeState(state),
-        },
-      } as unknown) as express.Request;
-      expect(() => {
-        verifyNonce(mockRequest, 'providera');
-      }).toThrowError('Auth response is missing cookie nonce');
-    });
-
-    it('should throw error if state nonce missing', () => {
-      const mockRequest = ({
-        cookies: {
-          'providera-nonce': 'NONCE',
-        },
-        query: {},
-      } as unknown) as express.Request;
-      expect(() => {
-        verifyNonce(mockRequest, 'providera');
-      }).toThrowError('Invalid state passed via request');
-    });
-
-    it('should throw error if nonce mismatch', () => {
-      const state = { nonce: 'NONCEB', env: 'development' };
-      const mockRequest = ({
-        cookies: {
-          'providera-nonce': 'NONCEA',
-        },
-        query: {
-          state: encodeState(state),
-        },
-      } as unknown) as express.Request;
-      expect(() => {
-        verifyNonce(mockRequest, 'providera');
-      }).toThrowError('Invalid nonce');
-    });
-
-    it('should not throw any error if nonce matches', () => {
-      const state = { nonce: 'NONCE', env: 'development' };
-      const mockRequest = ({
-        cookies: {
-          'providera-nonce': 'NONCE',
-        },
-        query: {
-          state: encodeState(state),
-        },
-      } as unknown) as express.Request;
-      expect(() => {
-        verifyNonce(mockRequest, 'providera');
-      }).not.toThrow();
-    });
-  });
-
-  describe('postMessageResponse', () => {
-    const appOrigin = 'http://localhost:3000';
-    it('should post a message back with payload success', () => {
-      const mockResponse = ({
-        end: jest.fn().mockReturnThis(),
-        setHeader: jest.fn().mockReturnThis(),
-      } as unknown) as express.Response;
-
-      const data: WebMessageResponse = {
-        type: 'authorization_response',
-        response: {
-          providerInfo: {
-            accessToken: 'ACCESS_TOKEN',
-            idToken: 'ID_TOKEN',
-            expiresInSeconds: 10,
-            scope: 'email',
-          },
-          profile: {
-            email: 'foo@bar.com',
-          },
-          backstageIdentity: {
-            id: 'a',
-            idToken: 'a.b.c',
-          },
-        },
-      };
-      const jsonData = JSON.stringify(data);
-      const base64Data = Buffer.from(jsonData, 'utf8').toString('base64');
-
-      postMessageResponse(mockResponse, appOrigin, data);
-      expect(mockResponse.setHeader).toBeCalledTimes(3);
-      expect(mockResponse.end).toBeCalledTimes(1);
-      expect(mockResponse.end).toBeCalledWith(
-        expect.stringContaining(base64Data),
-      );
-    });
-
-    it('should post a message back with payload error', () => {
-      const mockResponse = ({
-        end: jest.fn().mockReturnThis(),
-        setHeader: jest.fn().mockReturnThis(),
-      } as unknown) as express.Response;
-
-      const data: WebMessageResponse = {
-        type: 'authorization_response',
-        error: new Error('Unknown error occured'),
-      };
-      const jsonData = JSON.stringify(data);
-      const base64Data = Buffer.from(jsonData, 'utf8').toString('base64');
-
-      postMessageResponse(mockResponse, appOrigin, data);
-      expect(mockResponse.setHeader).toBeCalledTimes(3);
-      expect(mockResponse.end).toBeCalledTimes(1);
-      expect(mockResponse.end).toBeCalledWith(
-        expect.stringContaining(base64Data),
-      );
-    });
-  });
-
-  describe('ensuresXRequestedWith', () => {
-    it('should return false if no header present', () => {
-      const mockRequest = ({
-        header: () => jest.fn(),
-      } as unknown) as express.Request;
-      expect(ensuresXRequestedWith(mockRequest)).toBe(false);
-    });
-
-    it('should return false if header present with incorrect value', () => {
-      const mockRequest = ({
-        header: () => 'INVALID',
-      } as unknown) as express.Request;
-      expect(ensuresXRequestedWith(mockRequest)).toBe(false);
-    });
-
-    it('should return true if header present with correct value', () => {
-      const mockRequest = ({
-        header: () => 'XMLHttpRequest',
-      } as unknown) as express.Request;
-      expect(ensuresXRequestedWith(mockRequest)).toBe(true);
-    });
-  });
-});
-
 describe('OAuthProvider', () => {
   class MyAuthProvider implements OAuthProviderHandlers {
     async start() {
diff --git a/plugins/auth-backend/src/lib/OAuthProvider.ts b/plugins/auth-backend/src/lib/oauth/OAuthProvider.ts
similarity index 75%
rename from plugins/auth-backend/src/lib/OAuthProvider.ts
rename to plugins/auth-backend/src/lib/oauth/OAuthProvider.ts
index dac31b442d..95948ff7cc 100644
--- a/plugins/auth-backend/src/lib/OAuthProvider.ts
+++ b/plugins/auth-backend/src/lib/oauth/OAuthProvider.ts
@@ -20,13 +20,13 @@ import { URL } from 'url';
 import {
   AuthProviderRouteHandlers,
   OAuthProviderHandlers,
-  WebMessageResponse,
   BackstageIdentity,
-  OAuthState,
   AuthProviderConfig,
-} from '../providers/types';
+} from '../../providers/types';
 import { InputError } from '@backstage/backend-common';
-import { TokenIssuer } from '../identity';
+import { TokenIssuer } from '../../identity';
+import { verifyNonce, encodeState } from './helpers';
+import { postMessageResponse, ensuresXRequestedWith } from '../flow';
 
 export const THOUSAND_DAYS_MS = 1000 * 24 * 60 * 60 * 1000;
 export const TEN_MINUTES_MS = 600 * 1000;
@@ -42,85 +42,6 @@ export type Options = {
   tokenIssuer: TokenIssuer;
 };
 
-const readState = (stateString: string): OAuthState => {
-  const state = Object.fromEntries(
-    new URLSearchParams(decodeURIComponent(stateString)),
-  );
-  if (
-    !state.nonce ||
-    !state.env ||
-    state.nonce?.length === 0 ||
-    state.env?.length === 0
-  ) {
-    throw Error(`Invalid state passed via request`);
-  }
-  return {
-    nonce: state.nonce,
-    env: state.env,
-  };
-};
-
-export const encodeState = (state: OAuthState): string => {
-  const searchParams = new URLSearchParams();
-  searchParams.append('nonce', state.nonce);
-  searchParams.append('env', state.env);
-
-  return encodeURIComponent(searchParams.toString());
-};
-
-export const verifyNonce = (req: express.Request, providerId: string) => {
-  const cookieNonce = req.cookies[`${providerId}-nonce`];
-  const state: OAuthState = readState(req.query.state?.toString() ?? '');
-  const stateNonce = state.nonce;
-
-  if (!cookieNonce) {
-    throw new Error('Auth response is missing cookie nonce');
-  }
-  if (stateNonce.length === 0) {
-    throw new Error('Auth response is missing state nonce');
-  }
-  if (cookieNonce !== stateNonce) {
-    throw new Error('Invalid nonce');
-  }
-};
-
-export const postMessageResponse = (
-  res: express.Response,
-  appOrigin: string,
-  response: WebMessageResponse,
-) => {
-  const jsonData = JSON.stringify(response);
-  const base64Data = Buffer.from(jsonData, 'utf8').toString('base64');
-
-  res.setHeader('Content-Type', 'text/html');
-  res.setHeader('X-Frame-Options', 'sameorigin');
-
-  // TODO: Make target app origin configurable globally
-  const script = `
-    (window.opener || window.parent).postMessage(JSON.parse(atob('${base64Data}')), '${appOrigin}')
-    window.close()
-  `;
-  const hash = crypto.createHash('sha256').update(script).digest('base64');
-  res.setHeader('Content-Security-Policy', `script-src 'sha256-${hash}'`);
-
-  res.end(`
-<html>
-<body>
-  <script>${script}</script>
-</body>
-</html>
-  `);
-};
-
-export const ensuresXRequestedWith = (req: express.Request) => {
-  const requiredHeader = req.header('X-Requested-With');
-
-  if (!requiredHeader || requiredHeader !== 'XMLHttpRequest') {
-    return false;
-  }
-  return true;
-};
-
 export class OAuthProvider implements AuthProviderRouteHandlers {
   static fromConfig(
     config: AuthProviderConfig,
@@ -287,19 +208,6 @@ export class OAuthProvider implements AuthProviderRouteHandlers {
     }
   }
 
-  identifyEnv(req: express.Request): string | undefined {
-    const reqEnv = req.query.env?.toString();
-    if (reqEnv) {
-      return reqEnv;
-    }
-    const stateParams = req.query.state?.toString();
-    if (!stateParams) {
-      return undefined;
-    }
-    const env = readState(stateParams).env;
-    return env;
-  }
-
   /**
    * If the response from the OAuth provider includes a Backstage identity, we
    * make sure it's populated with all the information we can derive from the user ID.
diff --git a/plugins/auth-backend/src/lib/oauth/helpers.test.ts b/plugins/auth-backend/src/lib/oauth/helpers.test.ts
new file mode 100644
index 0000000000..fcf56705d2
--- /dev/null
+++ b/plugins/auth-backend/src/lib/oauth/helpers.test.ts
@@ -0,0 +1,77 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import express from 'express';
+import { verifyNonce, encodeState } from './helpers';
+
+describe('OAuthProvider Utils', () => {
+  describe('verifyNonce', () => {
+    it('should throw error if cookie nonce missing', () => {
+      const state = { nonce: 'NONCE', env: 'development' };
+      const mockRequest = ({
+        cookies: {},
+        query: {
+          state: encodeState(state),
+        },
+      } as unknown) as express.Request;
+      expect(() => {
+        verifyNonce(mockRequest, 'providera');
+      }).toThrowError('Auth response is missing cookie nonce');
+    });
+
+    it('should throw error if state nonce missing', () => {
+      const mockRequest = ({
+        cookies: {
+          'providera-nonce': 'NONCE',
+        },
+        query: {},
+      } as unknown) as express.Request;
+      expect(() => {
+        verifyNonce(mockRequest, 'providera');
+      }).toThrowError('Invalid state passed via request');
+    });
+
+    it('should throw error if nonce mismatch', () => {
+      const state = { nonce: 'NONCEB', env: 'development' };
+      const mockRequest = ({
+        cookies: {
+          'providera-nonce': 'NONCEA',
+        },
+        query: {
+          state: encodeState(state),
+        },
+      } as unknown) as express.Request;
+      expect(() => {
+        verifyNonce(mockRequest, 'providera');
+      }).toThrowError('Invalid nonce');
+    });
+
+    it('should not throw any error if nonce matches', () => {
+      const state = { nonce: 'NONCE', env: 'development' };
+      const mockRequest = ({
+        cookies: {
+          'providera-nonce': 'NONCE',
+        },
+        query: {
+          state: encodeState(state),
+        },
+      } as unknown) as express.Request;
+      expect(() => {
+        verifyNonce(mockRequest, 'providera');
+      }).not.toThrow();
+    });
+  });
+});
diff --git a/plugins/auth-backend/src/lib/oauth/helpers.ts b/plugins/auth-backend/src/lib/oauth/helpers.ts
new file mode 100644
index 0000000000..34f12b8d22
--- /dev/null
+++ b/plugins/auth-backend/src/lib/oauth/helpers.ts
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import express from 'express';
+import { OAuthState } from '../../providers/types';
+
+const readState = (stateString: string): OAuthState => {
+  const state = Object.fromEntries(
+    new URLSearchParams(decodeURIComponent(stateString)),
+  );
+  if (
+    !state.nonce ||
+    !state.env ||
+    state.nonce?.length === 0 ||
+    state.env?.length === 0
+  ) {
+    throw Error(`Invalid state passed via request`);
+  }
+  return {
+    nonce: state.nonce,
+    env: state.env,
+  };
+};
+
+export const encodeState = (state: OAuthState): string => {
+  const searchParams = new URLSearchParams();
+  searchParams.append('nonce', state.nonce);
+  searchParams.append('env', state.env);
+
+  return encodeURIComponent(searchParams.toString());
+};
+
+export const verifyNonce = (req: express.Request, providerId: string) => {
+  const cookieNonce = req.cookies[`${providerId}-nonce`];
+  const state: OAuthState = readState(req.query.state?.toString() ?? '');
+  const stateNonce = state.nonce;
+
+  if (!cookieNonce) {
+    throw new Error('Auth response is missing cookie nonce');
+  }
+  if (stateNonce.length === 0) {
+    throw new Error('Auth response is missing state nonce');
+  }
+  if (cookieNonce !== stateNonce) {
+    throw new Error('Invalid nonce');
+  }
+};
diff --git a/plugins/auth-backend/src/lib/oauth/index.ts b/plugins/auth-backend/src/lib/oauth/index.ts
new file mode 100644
index 0000000000..4c120799e7
--- /dev/null
+++ b/plugins/auth-backend/src/lib/oauth/index.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { OAuthProvider } from './OAuthProvider';
diff --git a/plugins/auth-backend/src/providers/auth0/provider.ts b/plugins/auth-backend/src/providers/auth0/provider.ts
index 7eeca59028..f785d1e147 100644
--- a/plugins/auth-backend/src/providers/auth0/provider.ts
+++ b/plugins/auth-backend/src/providers/auth0/provider.ts
@@ -19,7 +19,7 @@ import passport from 'passport';
 import Auth0Strategy from './strategy';
 import { Logger } from 'winston';
 import { TokenIssuer } from '../../identity';
-import { OAuthProvider } from '../../lib/OAuthProvider';
+import { OAuthProvider } from '../../lib/oauth';
 import {
   executeFetchUserProfileStrategy,
   executeFrameHandlerStrategy,
diff --git a/plugins/auth-backend/src/providers/github/provider.ts b/plugins/auth-backend/src/providers/github/provider.ts
index b63acdfb20..8e9bf1aa4a 100644
--- a/plugins/auth-backend/src/providers/github/provider.ts
+++ b/plugins/auth-backend/src/providers/github/provider.ts
@@ -29,7 +29,7 @@ import {
   OAuthResponse,
   PassportDoneCallback,
 } from '../types';
-import { OAuthProvider } from '../../lib/OAuthProvider';
+import { OAuthProvider } from '../../lib/oauth';
 import { Logger } from 'winston';
 import { TokenIssuer } from '../../identity';
 import passport from 'passport';
diff --git a/plugins/auth-backend/src/providers/gitlab/provider.ts b/plugins/auth-backend/src/providers/gitlab/provider.ts
index 1c2a822d82..2100bc753e 100644
--- a/plugins/auth-backend/src/providers/gitlab/provider.ts
+++ b/plugins/auth-backend/src/providers/gitlab/provider.ts
@@ -29,7 +29,7 @@ import {
   OAuthResponse,
   PassportDoneCallback,
 } from '../types';
-import { OAuthProvider } from '../../lib/OAuthProvider';
+import { OAuthProvider } from '../../lib/oauth';
 import { Logger } from 'winston';
 import { TokenIssuer } from '../../identity';
 import passport from 'passport';
diff --git a/plugins/auth-backend/src/providers/google/provider.ts b/plugins/auth-backend/src/providers/google/provider.ts
index d4455ac4d3..366f9cd96c 100644
--- a/plugins/auth-backend/src/providers/google/provider.ts
+++ b/plugins/auth-backend/src/providers/google/provider.ts
@@ -31,7 +31,7 @@ import {
   OAuthResponse,
   PassportDoneCallback,
 } from '../types';
-import { OAuthProvider } from '../../lib/OAuthProvider';
+import { OAuthProvider } from '../../lib/oauth';
 import passport from 'passport';
 import { Logger } from 'winston';
 import { TokenIssuer } from '../../identity';
diff --git a/plugins/auth-backend/src/providers/microsoft/provider.ts b/plugins/auth-backend/src/providers/microsoft/provider.ts
index 5997d8e1a8..fb96d2236f 100644
--- a/plugins/auth-backend/src/providers/microsoft/provider.ts
+++ b/plugins/auth-backend/src/providers/microsoft/provider.ts
@@ -35,7 +35,7 @@ import {
   PassportDoneCallback,
 } from '../types';
 
-import { OAuthProvider } from '../../lib/OAuthProvider';
+import { OAuthProvider } from '../../lib/oauth';
 import { Logger } from 'winston';
 import { TokenIssuer } from '../../identity';
 import { Config } from '@backstage/config';
diff --git a/plugins/auth-backend/src/providers/oauth2/provider.ts b/plugins/auth-backend/src/providers/oauth2/provider.ts
index 4b8a826d81..c08e18960c 100644
--- a/plugins/auth-backend/src/providers/oauth2/provider.ts
+++ b/plugins/auth-backend/src/providers/oauth2/provider.ts
@@ -19,7 +19,7 @@ import passport from 'passport';
 import { Strategy as OAuth2Strategy } from 'passport-oauth2';
 import { Logger } from 'winston';
 import { TokenIssuer } from '../../identity';
-import { OAuthProvider } from '../../lib/OAuthProvider';
+import { OAuthProvider } from '../../lib/oauth';
 import {
   executeFetchUserProfileStrategy,
   executeFrameHandlerStrategy,
diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts
index db8e0cf313..a6ccc25d21 100644
--- a/plugins/auth-backend/src/providers/okta/provider.ts
+++ b/plugins/auth-backend/src/providers/okta/provider.ts
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 import express from 'express';
-import { OAuthProvider } from '../../lib/OAuthProvider';
+import { OAuthProvider } from '../../lib/oauth';
 import { Strategy as OktaStrategy } from 'passport-okta-oauth';
 import passport from 'passport';
 import {
diff --git a/plugins/auth-backend/src/providers/saml/provider.ts b/plugins/auth-backend/src/providers/saml/provider.ts
index 56793d85f4..d98bcc9579 100644
--- a/plugins/auth-backend/src/providers/saml/provider.ts
+++ b/plugins/auth-backend/src/providers/saml/provider.ts
@@ -30,7 +30,7 @@ import {
   PassportDoneCallback,
   ProfileInfo,
 } from '../types';
-import { postMessageResponse } from '../../lib/OAuthProvider';
+import { postMessageResponse } from '../../lib/flow';
 import { Logger } from 'winston';
 import { TokenIssuer } from '../../identity';
 import { Config } from '@backstage/config';