diff --git a/.github/uffizzi/uffizzi.production.app-config.yaml b/.github/uffizzi/uffizzi.production.app-config.yaml
index 2e45740875..d4b70641da 100644
--- a/.github/uffizzi/uffizzi.production.app-config.yaml
+++ b/.github/uffizzi/uffizzi.production.app-config.yaml
@@ -30,6 +30,9 @@ backend:
 auth:
   environment: production
   providers: {}
+  proxy:
+    enabled: true
+    url: https://demo.backstage.io/api/auth
 
 catalog:
   locations:
diff --git a/packages/app/src/AuthProxyDiscoveryApi.ts b/packages/app/src/AuthProxyDiscoveryApi.ts
new file mode 100644
index 0000000000..761803f0de
--- /dev/null
+++ b/packages/app/src/AuthProxyDiscoveryApi.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2020 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { Config } from '@backstage/config';
+import { UrlPatternDiscovery } from '@backstage/core-app-api';
+import { DiscoveryApi } from '@backstage/core-plugin-api';
+
+export class AuthProxyDiscoveryApi implements DiscoveryApi {
+  private urlPatternDiscovery: UrlPatternDiscovery;
+
+  constructor(
+    baseUrl: string,
+    private readonly isAuthProxyingEnabled?: boolean,
+    private readonly authProxyUrl?: string,
+  ) {
+    this.urlPatternDiscovery = UrlPatternDiscovery.compile(
+      `${baseUrl}/api/{{ pluginId }}`,
+    );
+  }
+
+  async getBaseUrl(pluginId: string) {
+    if (
+      pluginId === 'auth' &&
+      this.isAuthProxyingEnabled &&
+      this.authProxyUrl
+    ) {
+      return this.authProxyUrl;
+    }
+
+    return this.urlPatternDiscovery.getBaseUrl(pluginId);
+  }
+
+  static fromConfig(config: Config) {
+    return new AuthProxyDiscoveryApi(
+      config.getString('backend.baseUrl'),
+      config.getOptionalBoolean('auth.proxy.enabled'),
+      config.getOptionalString('auth.proxy.url'),
+    );
+  }
+}
diff --git a/packages/app/src/apis.ts b/packages/app/src/apis.ts
index d587a88402..f348d24466 100644
--- a/packages/app/src/apis.ts
+++ b/packages/app/src/apis.ts
@@ -31,11 +31,18 @@ import {
   AnyApiFactory,
   configApiRef,
   createApiFactory,
+  discoveryApiRef,
   errorApiRef,
   githubAuthApiRef,
 } from '@backstage/core-plugin-api';
+import { AuthProxyDiscoveryApi } from './AuthProxyDiscoveryApi';
 
 export const apis: AnyApiFactory[] = [
+  createApiFactory({
+    api: discoveryApiRef,
+    deps: { configApi: configApiRef },
+    factory: ({ configApi }) => AuthProxyDiscoveryApi.fromConfig(configApi),
+  }),
   createApiFactory({
     api: scmIntegrationsApiRef,
     deps: { configApi: configApiRef },