diff --git a/.changeset/brown-actors-clap.md b/.changeset/brown-actors-clap.md
new file mode 100644
index 0000000000..af25a6e87f
--- /dev/null
+++ b/.changeset/brown-actors-clap.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-plugin-api': minor
+---
+
+**BREAKING**: The deprecated identity and token manager services have been removed. This means that `coreServices.identity` and `coreServices.tokenManager` are gone, along with related types and utilities in other packages.
diff --git a/.changeset/kind-moose-learn.md b/.changeset/kind-moose-learn.md
new file mode 100644
index 0000000000..810064b1a1
--- /dev/null
+++ b/.changeset/kind-moose-learn.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-app-api': minor
+---
+
+**BREAKING**: The deprecated `identityServiceFactory` and `tokenManagerServiceFactory` have been removed.
diff --git a/.changeset/kind-walls-speak.md b/.changeset/kind-walls-speak.md
index a2470650a4..441e247dea 100644
--- a/.changeset/kind-walls-speak.md
+++ b/.changeset/kind-walls-speak.md
@@ -2,4 +2,4 @@
 '@backstage/backend-defaults': minor
 ---
 
-**BREAKING**: The backwards compatibility with plugins using legacy auth through the token manage service has been removed. This means that instead of falling back to using the old token manager, requests towards plugins that don't support the new auth system will simply fail. Please make sure that all plugins in your deployment are hosted within a backend instance from the new backend system.
+**BREAKING**: The backwards compatibility with plugins using legacy auth through the token manager service has been removed. This means that instead of falling back to using the old token manager, requests towards plugins that don't support the new auth system will simply fail. Please make sure that all plugins in your deployment are hosted within a backend instance from the new backend system.
diff --git a/.changeset/large-poets-check.md b/.changeset/large-poets-check.md
new file mode 100644
index 0000000000..393d26ac9b
--- /dev/null
+++ b/.changeset/large-poets-check.md
@@ -0,0 +1,11 @@
+---
+'@backstage/plugin-catalog-backend-module-bitbucket-cloud': patch
+'@backstage/plugin-search-backend-module-techdocs': patch
+'@backstage/plugin-search-backend-module-catalog': patch
+'@backstage/plugin-search-backend-module-explore': patch
+'@backstage/plugin-permission-node': patch
+'@backstage/plugin-signals-backend': patch
+'@backstage/plugin-auth-backend': patch
+---
+
+Internal refactor to remove dependencies on the identity and token manager services, which have been removed. Public APIs no longer require the identity service or token manager to be provided.
diff --git a/.changeset/popular-cooks-camp.md b/.changeset/popular-cooks-camp.md
new file mode 100644
index 0000000000..4049825efd
--- /dev/null
+++ b/.changeset/popular-cooks-camp.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-test-utils': minor
+---
+
+**BREAKING**: Removed service mocks for the identity and token manager services, which have been removed from `@backstage/backend-plugin-api`.
diff --git a/.changeset/swift-radios-enjoy.md b/.changeset/swift-radios-enjoy.md
new file mode 100644
index 0000000000..495117e3c6
--- /dev/null
+++ b/.changeset/swift-radios-enjoy.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-common': patch
+---
+
+Internal refactor to re-declare the token manager service which was removed from `@backstage/backend-plugin-api`, but is still supported in this package for backwards compatibility.
diff --git a/.changeset/twenty-clouds-melt.md b/.changeset/twenty-clouds-melt.md
new file mode 100644
index 0000000000..dee2b0f8ef
--- /dev/null
+++ b/.changeset/twenty-clouds-melt.md
@@ -0,0 +1,64 @@
+---
+'@backstage/backend-defaults': minor
+---
+
+**BREAKING**: The default backend instance no longer provides implementations for the identity and token manager services, which have been removed from `@backstage/backend-plugin-api`.
+
+If you rely on plugins that still require these services, you can add them to your own backend by re-creating the service reference and factory.
+
+The following can be used to implement the identity service:
+
+```ts
+import {
+  coreServices,
+  createServiceFactory,
+  createServiceRef,
+} from '@backstage/backend-plugin-api';
+import {
+  DefaultIdentityClient,
+  IdentityApi,
+} from '@backstage/plugin-auth-node';
+
+backend.add(
+  createServiceFactory({
+    service: createServiceRef<IdentityApi>({ id: 'core.identity' }),
+    deps: {
+      discovery: coreServices.discovery,
+    },
+    async factory({ discovery }) {
+      return DefaultIdentityClient.create({ discovery });
+    },
+  }),
+);
+```
+
+The following can be used to implement the token manager service:
+
+```ts
+import { ServerTokenManager, TokenManager } from '@backstage/backend-common';
+import { createBackend } from '@backstage/backend-defaults';
+import {
+  coreServices,
+  createServiceFactory,
+  createServiceRef,
+} from '@backstage/backend-plugin-api';
+
+backend.add(
+  createServiceFactory({
+    service: createServiceRef<TokenManager>({ id: 'core.tokenManager' }),
+    deps: {
+      config: coreServices.rootConfig,
+      logger: coreServices.rootLogger,
+    },
+    createRootContext({ config, logger }) {
+      return ServerTokenManager.fromConfig(config, {
+        logger,
+        allowDisabledTokenManager: true,
+      });
+    },
+    async factory(_deps, tokenManager) {
+      return tokenManager;
+    },
+  }),
+);
+```
diff --git a/packages/backend-app-api/api-report.md b/packages/backend-app-api/api-report.md
index 5ea5b2bcc9..88fa34e6e4 100644
--- a/packages/backend-app-api/api-report.md
+++ b/packages/backend-app-api/api-report.md
@@ -4,9 +4,7 @@
 
 ```ts
 import { BackendFeature } from '@backstage/backend-plugin-api';
-import { IdentityService } from '@backstage/backend-plugin-api';
 import { ServiceFactory } from '@backstage/backend-plugin-api';
-import { TokenManagerService } from '@backstage/backend-plugin-api';
 
 // @public (undocumented)
 export interface Backend {
@@ -34,18 +32,4 @@ export interface CreateSpecializedBackendOptions {
   // (undocumented)
   defaultServiceFactories: ServiceFactory[];
 }
-
-// @public @deprecated (undocumented)
-export const identityServiceFactory: ServiceFactory<
-  IdentityService,
-  'plugin',
-  'singleton'
->;
-
-// @public @deprecated (undocumented)
-export const tokenManagerServiceFactory: ServiceFactory<
-  TokenManagerService,
-  'plugin',
-  'singleton'
->;
 ```
diff --git a/packages/backend-app-api/src/index.ts b/packages/backend-app-api/src/index.ts
index 02633f3732..c58379c3e4 100644
--- a/packages/backend-app-api/src/index.ts
+++ b/packages/backend-app-api/src/index.ts
@@ -21,4 +21,3 @@
  */
 
 export * from './wiring';
-export * from './services/implementations';
diff --git a/packages/backend-app-api/src/services/implementations/identity/identityServiceFactory.ts b/packages/backend-app-api/src/services/implementations/identity/identityServiceFactory.ts
deleted file mode 100644
index ccae77affa..0000000000
--- a/packages/backend-app-api/src/services/implementations/identity/identityServiceFactory.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Copyright 2022 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import {
-  coreServices,
-  createServiceFactory,
-} from '@backstage/backend-plugin-api';
-import { DefaultIdentityClient } from '@backstage/plugin-auth-node';
-
-/**
- * @public
- * @deprecated Please migrate to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead
- */
-export const identityServiceFactory = createServiceFactory({
-  service: coreServices.identity,
-  deps: {
-    discovery: coreServices.discovery,
-  },
-  async factory({ discovery }) {
-    return DefaultIdentityClient.create({ discovery });
-  },
-});
diff --git a/packages/backend-app-api/src/services/implementations/identity/index.ts b/packages/backend-app-api/src/services/implementations/identity/index.ts
deleted file mode 100644
index 4c92217e6a..0000000000
--- a/packages/backend-app-api/src/services/implementations/identity/index.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright 2023 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-export { identityServiceFactory } from './identityServiceFactory';
diff --git a/packages/backend-app-api/src/services/implementations/index.ts b/packages/backend-app-api/src/services/implementations/index.ts
deleted file mode 100644
index 5f9bb9479a..0000000000
--- a/packages/backend-app-api/src/services/implementations/index.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright 2022 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-export * from './identity';
-export * from './tokenManager';
diff --git a/packages/backend-app-api/src/services/implementations/tokenManager/index.ts b/packages/backend-app-api/src/services/implementations/tokenManager/index.ts
deleted file mode 100644
index 3ae3d45d2f..0000000000
--- a/packages/backend-app-api/src/services/implementations/tokenManager/index.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright 2023 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-export { tokenManagerServiceFactory } from './tokenManagerServiceFactory';
diff --git a/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.test.ts b/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.test.ts
deleted file mode 100644
index dc52130ec6..0000000000
--- a/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.test.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Copyright 2022 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import { tokenManagerServiceFactory } from './tokenManagerServiceFactory';
-import { ServiceFactoryTester } from '@backstage/backend-test-utils';
-
-describe('tokenManagerFactory', () => {
-  it('should create a disabled manager without configuration', async () => {
-    const tokenManager = await ServiceFactoryTester.from(
-      tokenManagerServiceFactory,
-    ).getSubject();
-
-    await expect(tokenManager.authenticate('abc')).rejects.toThrow(
-      'no legacy keys are configured',
-    );
-    await expect(tokenManager.getToken()).rejects.toThrow(
-      'no legacy keys are configured',
-    );
-  });
-});
diff --git a/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.ts b/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.ts
deleted file mode 100644
index e7c4ce7af0..0000000000
--- a/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.ts
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright 2022 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import {
-  coreServices,
-  createServiceFactory,
-} from '@backstage/backend-plugin-api';
-import { ServerTokenManager } from '@backstage/backend-common';
-
-/**
- * @public
- * @deprecated Please migrate to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead
- */
-export const tokenManagerServiceFactory = createServiceFactory({
-  service: coreServices.tokenManager,
-  deps: {
-    config: coreServices.rootConfig,
-    logger: coreServices.rootLogger,
-  },
-  createRootContext({ config, logger }) {
-    return ServerTokenManager.fromConfig(config, {
-      logger,
-      allowDisabledTokenManager: true,
-    });
-  },
-  async factory(_deps, tokenManager) {
-    return tokenManager;
-  },
-});
diff --git a/packages/backend-common/api-report.md b/packages/backend-common/api-report.md
index d0b84edaa6..7de2731518 100644
--- a/packages/backend-common/api-report.md
+++ b/packages/backend-common/api-report.md
@@ -22,7 +22,6 @@ import Docker from 'dockerode';
 import { ErrorRequestHandler } from 'express';
 import express from 'express';
 import { HttpAuthService } from '@backstage/backend-plugin-api';
-import { IdentityService } from '@backstage/backend-plugin-api';
 import { isChildPath as isChildPath_2 } from '@backstage/backend-plugin-api';
 import { isDatabaseConflictError as isDatabaseConflictError_2 } from '@backstage/backend-plugin-api';
 import { KubeConfig } from '@kubernetes/client-node';
@@ -44,7 +43,6 @@ import { Router } from 'express';
 import { SchedulerService } from '@backstage/backend-plugin-api';
 import { Server } from 'http';
 import { ServiceRef } from '@backstage/backend-plugin-api';
-import { TokenManagerService } from '@backstage/backend-plugin-api';
 import { TransportStreamOptions } from 'winston-transport';
 import { UrlReaderService } from '@backstage/backend-plugin-api';
 import { UserInfoService } from '@backstage/backend-plugin-api';
@@ -101,7 +99,7 @@ export function createLegacyAuthAdapters<
     auth?: AuthService;
     httpAuth?: HttpAuthService;
     userInfo?: UserInfoService;
-    identity?: IdentityService;
+    identity?: LegacyIdentityService;
     tokenManager?: TokenManager;
     discovery: PluginEndpointDiscovery;
   },
@@ -547,7 +545,12 @@ export interface StatusCheckHandlerOptions {
 }
 
 // @public @deprecated (undocumented)
-export type TokenManager = TokenManagerService;
+export interface TokenManager {
+  authenticate(token: string): Promise<void>;
+  getToken(): Promise<{
+    token: string;
+  }>;
+}
 
 // @public @deprecated
 export function useHotCleanup(
diff --git a/packages/backend-common/src/compat/auth/createLegacyAuthAdapters.test.ts b/packages/backend-common/src/compat/auth/createLegacyAuthAdapters.test.ts
index 354b4a57dc..49494761bf 100644
--- a/packages/backend-common/src/compat/auth/createLegacyAuthAdapters.test.ts
+++ b/packages/backend-common/src/compat/auth/createLegacyAuthAdapters.test.ts
@@ -14,18 +14,28 @@
  * limitations under the License.
  */
 
-import { mockServices } from '@backstage/backend-test-utils';
 import { createLegacyAuthAdapters } from './createLegacyAuthAdapters';
 import { Request } from 'express';
+import { TokenManager } from '../../deprecated';
+
+const mockTokenManager: TokenManager = {
+  async getToken(): Promise<{ token: string }> {
+    return { token: 'mock-token' };
+  },
+  async authenticate(token: string): Promise<void> {
+    if (token !== 'mock-token') {
+      throw new Error('Invalid token');
+    }
+  },
+};
 
 describe('createLegacyAuthAdapters', () => {
   it('should pass through auth if only auth is provided', () => {
     const auth = {};
     const ret = createLegacyAuthAdapters({
       auth: auth as any,
-      tokenManager: mockServices.tokenManager(),
+      tokenManager: mockTokenManager,
       discovery: {} as any,
-      identity: mockServices.identity(),
     });
 
     expect(ret.auth).toBe(auth);
@@ -35,9 +45,8 @@ describe('createLegacyAuthAdapters', () => {
     const httpAuth = {};
     const ret = createLegacyAuthAdapters({
       httpAuth: httpAuth as any,
-      tokenManager: mockServices.tokenManager(),
+      tokenManager: mockTokenManager,
       discovery: {} as any,
-      identity: mockServices.identity(),
     });
 
     expect(ret.httpAuth).toBe(httpAuth);
@@ -49,9 +58,8 @@ describe('createLegacyAuthAdapters', () => {
     const ret = createLegacyAuthAdapters({
       auth: auth as any,
       httpAuth: httpAuth as any,
-      tokenManager: mockServices.tokenManager(),
+      tokenManager: mockTokenManager,
       discovery: {} as any,
-      identity: mockServices.identity(),
     });
 
     expect(ret.auth).toBe(auth);
@@ -64,9 +72,8 @@ describe('createLegacyAuthAdapters', () => {
     const ret = createLegacyAuthAdapters({
       auth: auth as any,
       userInfo: userInfo as any,
-      tokenManager: mockServices.tokenManager(),
+      tokenManager: mockTokenManager,
       discovery: {} as any,
-      identity: mockServices.identity(),
     });
 
     expect(ret.auth).toBe(auth);
@@ -77,9 +84,8 @@ describe('createLegacyAuthAdapters', () => {
     const ret = createLegacyAuthAdapters({
       auth: undefined,
       httpAuth: undefined,
-      tokenManager: mockServices.tokenManager(),
+      tokenManager: mockTokenManager,
       discovery: {} as any,
-      identity: mockServices.identity(),
     });
 
     expect(ret).toEqual({
@@ -94,7 +100,6 @@ describe('createLegacyAuthAdapters', () => {
       auth: undefined,
       httpAuth: undefined,
       discovery: {} as any,
-      identity: mockServices.identity(),
     });
 
     const credentials = await httpAuth.credentials({
@@ -116,13 +121,12 @@ describe('createLegacyAuthAdapters', () => {
       auth: undefined,
       httpAuth: undefined,
       tokenManager: {
-        ...mockServices.tokenManager(),
+        ...mockTokenManager,
         async getToken() {
           return { token: 'new-token' };
         },
       },
       discovery: {} as any,
-      identity: mockServices.identity(),
     });
 
     const credentials = await httpAuth.credentials({
diff --git a/packages/backend-common/src/compat/auth/createLegacyAuthAdapters.ts b/packages/backend-common/src/compat/auth/createLegacyAuthAdapters.ts
index 15cd881649..fc02d936d1 100644
--- a/packages/backend-common/src/compat/auth/createLegacyAuthAdapters.ts
+++ b/packages/backend-common/src/compat/auth/createLegacyAuthAdapters.ts
@@ -23,8 +23,6 @@ import {
   BackstageUserInfo,
   BackstageUserPrincipal,
   HttpAuthService,
-  IdentityService,
-  TokenManagerService,
   UserInfoService,
 } from '@backstage/backend-plugin-api';
 import { AuthenticationError, NotAllowedError } from '@backstage/errors';
@@ -44,11 +42,12 @@ import {
 import { decodeJwt } from 'jose';
 import { TokenManager, PluginEndpointDiscovery } from '../../deprecated';
 import { JsonObject } from '@backstage/types';
+import { LegacyIdentityService } from '../legacy';
 
 class AuthCompat implements AuthService {
   constructor(
-    private readonly identity: IdentityService,
-    private readonly tokenManager?: TokenManagerService,
+    private readonly identity: LegacyIdentityService,
+    private readonly tokenManager?: TokenManager,
   ) {}
 
   isPrincipal<TType extends keyof BackstagePrincipalTypes>(
@@ -299,7 +298,7 @@ export function createLegacyAuthAdapters<
     auth?: AuthService;
     httpAuth?: HttpAuthService;
     userInfo?: UserInfoService;
-    identity?: IdentityService;
+    identity?: LegacyIdentityService;
     tokenManager?: TokenManager;
     discovery: PluginEndpointDiscovery;
   },
diff --git a/packages/backend-common/src/deprecated/tokens/types.ts b/packages/backend-common/src/deprecated/tokens/types.ts
index 09dc0bb211..41a2000868 100644
--- a/packages/backend-common/src/deprecated/tokens/types.ts
+++ b/packages/backend-common/src/deprecated/tokens/types.ts
@@ -14,10 +14,25 @@
  * limitations under the License.
  */
 
-import { TokenManagerService } from '@backstage/backend-plugin-api';
-
 /**
  * @public
  * @deprecated Please {@link https://backstage.io/docs/tutorials/auth-service-migration | migrate} to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead.
  */
-export type TokenManager = TokenManagerService;
+export interface TokenManager {
+  /**
+   * Fetches a valid token.
+   *
+   * @remarks
+   *
+   * Tokens are valid for roughly one hour; the actual deadline is set in the
+   * payload `exp` claim. Never hold on to tokens for reuse; always ask for a
+   * new one for each outgoing request. This ensures that you always get a
+   * valid, fresh one.
+   */
+  getToken(): Promise<{ token: string }>;
+
+  /**
+   * Validates a given token.
+   */
+  authenticate(token: string): Promise<void>;
+}
diff --git a/packages/backend-defaults/src/CreateBackend.ts b/packages/backend-defaults/src/CreateBackend.ts
index 47fa09da49..4b0f497980 100644
--- a/packages/backend-defaults/src/CreateBackend.ts
+++ b/packages/backend-defaults/src/CreateBackend.ts
@@ -14,12 +14,7 @@
  * limitations under the License.
  */
 
-import {
-  Backend,
-  createSpecializedBackend,
-  identityServiceFactory,
-  tokenManagerServiceFactory,
-} from '@backstage/backend-app-api';
+import { Backend, createSpecializedBackend } from '@backstage/backend-app-api';
 import { authServiceFactory } from '@backstage/backend-defaults/auth';
 import { cacheServiceFactory } from '@backstage/backend-defaults/cache';
 import { databaseServiceFactory } from '@backstage/backend-defaults/database';
@@ -47,7 +42,6 @@ export const defaultServiceFactories = [
   discoveryServiceFactory,
   httpAuthServiceFactory,
   httpRouterServiceFactory,
-  identityServiceFactory,
   lifecycleServiceFactory,
   loggerServiceFactory,
   permissionsServiceFactory,
@@ -56,7 +50,6 @@ export const defaultServiceFactories = [
   rootLifecycleServiceFactory,
   rootLoggerServiceFactory,
   schedulerServiceFactory,
-  tokenManagerServiceFactory,
   userInfoServiceFactory,
   urlReaderServiceFactory,
   eventsServiceFactory,
diff --git a/packages/backend-defaults/src/entrypoints/auth/authServiceFactory.test.ts b/packages/backend-defaults/src/entrypoints/auth/authServiceFactory.test.ts
index d37e4d1443..cb672ed7f1 100644
--- a/packages/backend-defaults/src/entrypoints/auth/authServiceFactory.test.ts
+++ b/packages/backend-defaults/src/entrypoints/auth/authServiceFactory.test.ts
@@ -19,7 +19,6 @@ import {
   mockServices,
   registerMswTestHooks,
 } from '@backstage/backend-test-utils';
-import { tokenManagerServiceFactory } from '@backstage/backend-app-api';
 import { authServiceFactory } from './authServiceFactory';
 import { base64url, decodeJwt } from 'jose';
 import { discoveryServiceFactory } from '../discovery';
@@ -32,7 +31,6 @@ const server = setupServer();
 // TODO: Ship discovery mock service in the service factory tester
 const mockDeps = [
   discoveryServiceFactory,
-  tokenManagerServiceFactory,
   mockServices.rootConfig.factory({
     data: {
       backend: {
diff --git a/packages/backend-defaults/src/entrypoints/permissions/permissionsServiceFactory.ts b/packages/backend-defaults/src/entrypoints/permissions/permissionsServiceFactory.ts
index 873d6a4fa0..000d71965b 100644
--- a/packages/backend-defaults/src/entrypoints/permissions/permissionsServiceFactory.ts
+++ b/packages/backend-defaults/src/entrypoints/permissions/permissionsServiceFactory.ts
@@ -35,13 +35,11 @@ export const permissionsServiceFactory = createServiceFactory({
     auth: coreServices.auth,
     config: coreServices.rootConfig,
     discovery: coreServices.discovery,
-    tokenManager: coreServices.tokenManager,
   },
-  async factory({ auth, config, discovery, tokenManager }) {
+  async factory({ auth, config, discovery }) {
     return ServerPermissionClient.fromConfig(config, {
       auth,
       discovery,
-      tokenManager,
     });
   },
 });
diff --git a/packages/backend-plugin-api/api-report.md b/packages/backend-plugin-api/api-report.md
index c8f788e1f0..1732998e44 100644
--- a/packages/backend-plugin-api/api-report.md
+++ b/packages/backend-plugin-api/api-report.md
@@ -12,7 +12,6 @@ import { Duration } from 'luxon';
 import { EvaluatorRequestOptions } from '@backstage/plugin-permission-common';
 import { Handler } from 'express';
 import { HumanDuration } from '@backstage/types';
-import { IdentityApi } from '@backstage/plugin-auth-node';
 import { isChildPath } from '@backstage/cli-common';
 import { JsonObject } from '@backstage/types';
 import { JsonValue } from '@backstage/types';
@@ -194,11 +193,7 @@ export namespace coreServices {
   const rootLifecycle: ServiceRef<RootLifecycleService, 'root', 'singleton'>;
   const rootLogger: ServiceRef<RootLoggerService, 'root', 'singleton'>;
   const scheduler: ServiceRef<SchedulerService, 'plugin', 'singleton'>;
-  const // @deprecated
-    tokenManager: ServiceRef<TokenManagerService, 'plugin', 'singleton'>;
   const urlReader: ServiceRef<UrlReaderService, 'plugin', 'singleton'>;
-  const // @deprecated
-    identity: ServiceRef<IdentityService, 'plugin', 'singleton'>;
 }
 
 // @public
@@ -383,9 +378,6 @@ export interface HttpRouterServiceAuthPolicy {
   path: string;
 }
 
-// @public @deprecated
-export interface IdentityService extends IdentityApi {}
-
 export { isChildPath };
 
 // @public
@@ -654,14 +646,6 @@ export interface ServiceRefOptions<
   scope?: TScope;
 }
 
-// @public @deprecated
-export interface TokenManagerService {
-  authenticate(token: string): Promise<void>;
-  getToken(): Promise<{
-    token: string;
-  }>;
-}
-
 // @public
 export interface UrlReaderService {
   readTree(
diff --git a/packages/backend-plugin-api/src/services/definitions/IdentityService.ts b/packages/backend-plugin-api/src/services/definitions/IdentityService.ts
deleted file mode 100644
index daa45b8200..0000000000
--- a/packages/backend-plugin-api/src/services/definitions/IdentityService.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Copyright 2020 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import { IdentityApi } from '@backstage/plugin-auth-node';
-
-/**
- * This is the legacy service for identity handling in Backstage. Please migrate to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead.
- *
- * See the {@link https://backstage.io/docs/backend-system/core-services/identity | service documentation} for more details.
- *
- * @public
- * @deprecated Please {@link https://backstage.io/docs/tutorials/auth-service-migration | migrate} to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead.
- */
-export interface IdentityService extends IdentityApi {}
diff --git a/packages/backend-plugin-api/src/services/definitions/TokenManagerService.ts b/packages/backend-plugin-api/src/services/definitions/TokenManagerService.ts
deleted file mode 100644
index 52d5d1ff9f..0000000000
--- a/packages/backend-plugin-api/src/services/definitions/TokenManagerService.ts
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright 2022 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * This is the legacy service for creating and validating tokens. Please migrate to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead.
- *
- * See the {@link https://backstage.io/docs/backend-system/core-services/token-manager | service documentation} for more details.
- *
- * @public
- * @deprecated Please {@link https://backstage.io/docs/tutorials/auth-service-migration | migrate} to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead.
- */
-export interface TokenManagerService {
-  /**
-   * Fetches a valid token.
-   *
-   * @remarks
-   *
-   * Tokens are valid for roughly one hour; the actual deadline is set in the
-   * payload `exp` claim. Never hold on to tokens for reuse; always ask for a
-   * new one for each outgoing request. This ensures that you always get a
-   * valid, fresh one.
-   */
-  getToken(): Promise<{ token: string }>;
-
-  /**
-   * Validates a given token.
-   */
-  authenticate(token: string): Promise<void>;
-}
diff --git a/packages/backend-plugin-api/src/services/definitions/coreServices.ts b/packages/backend-plugin-api/src/services/definitions/coreServices.ts
index 33d1da2903..f87bff023c 100644
--- a/packages/backend-plugin-api/src/services/definitions/coreServices.ts
+++ b/packages/backend-plugin-api/src/services/definitions/coreServices.ts
@@ -239,20 +239,6 @@ export namespace coreServices {
     import('./SchedulerService').SchedulerService
   >({ id: 'core.scheduler' });
 
-  /**
-   * Deprecated service authentication service, use the `auth` service instead.
-   *
-   * See {@link TokenManagerService}
-   * and {@link https://backstage.io/docs/backend-system/core-services/token-manager | the service docs}
-   * for more information.
-   *
-   * @public
-   * @deprecated Please migrate to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead
-   */
-  export const tokenManager = createServiceRef<
-    import('./TokenManagerService').TokenManagerService
-  >({ id: 'core.tokenManager' });
-
   /**
    * Reading content from external systems.
    *
@@ -265,18 +251,4 @@ export namespace coreServices {
   export const urlReader = createServiceRef<
     import('./UrlReaderService').UrlReaderService
   >({ id: 'core.urlReader' });
-
-  /**
-   * Deprecated user authentication service, use the `auth` service instead.
-   *
-   * See {@link IdentityService}
-   * and {@link https://backstage.io/docs/backend-system/core-services/identity | the service docs}
-   * for more information.
-   *
-   * @public
-   * @deprecated Please migrate to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead
-   */
-  export const identity = createServiceRef<
-    import('./IdentityService').IdentityService
-  >({ id: 'core.identity' });
 }
diff --git a/packages/backend-plugin-api/src/services/definitions/index.ts b/packages/backend-plugin-api/src/services/definitions/index.ts
index 194658dc0e..1df00bdead 100644
--- a/packages/backend-plugin-api/src/services/definitions/index.ts
+++ b/packages/backend-plugin-api/src/services/definitions/index.ts
@@ -64,7 +64,6 @@ export type {
   SchedulerServiceTaskScheduleDefinition,
   SchedulerServiceTaskScheduleDefinitionConfig,
 } from './SchedulerService';
-export type { TokenManagerService } from './TokenManagerService';
 export type {
   UrlReaderServiceReadTreeOptions,
   UrlReaderServiceReadTreeResponse,
@@ -78,4 +77,3 @@ export type {
   UrlReaderService,
 } from './UrlReaderService';
 export type { BackstageUserInfo, UserInfoService } from './UserInfoService';
-export type { IdentityService } from './IdentityService';
diff --git a/packages/backend-test-utils/api-report.md b/packages/backend-test-utils/api-report.md
index cbc1cbde26..109ddbece3 100644
--- a/packages/backend-test-utils/api-report.md
+++ b/packages/backend-test-utils/api-report.md
@@ -23,7 +23,6 @@ import { ExtendedHttpServer } from '@backstage/backend-defaults/rootHttpRouter';
 import { ExtensionPoint } from '@backstage/backend-plugin-api';
 import { HttpAuthService } from '@backstage/backend-plugin-api';
 import { HttpRouterService } from '@backstage/backend-plugin-api';
-import { IdentityService } from '@backstage/backend-plugin-api';
 import { JsonObject } from '@backstage/types';
 import Keyv from 'keyv';
 import { Knex } from 'knex';
@@ -39,7 +38,6 @@ import { RootLoggerService } from '@backstage/backend-plugin-api';
 import { SchedulerService } from '@backstage/backend-plugin-api';
 import { ServiceFactory } from '@backstage/backend-plugin-api';
 import { ServiceRef } from '@backstage/backend-plugin-api';
-import { TokenManagerService } from '@backstage/backend-plugin-api';
 import { UrlReaderService } from '@backstage/backend-plugin-api';
 import { UserInfoService } from '@backstage/backend-plugin-api';
 
@@ -217,17 +215,6 @@ export namespace mockServices {
       ) => ServiceMock<HttpRouterService>;
   }
   // (undocumented)
-  export function identity(): IdentityService;
-  // (undocumented)
-  export namespace identity {
-    const // (undocumented)
-      factory: () => ServiceFactory<IdentityService, 'plugin', 'singleton'>;
-    const // (undocumented)
-      mock: (
-        partialImpl?: Partial<IdentityService> | undefined,
-      ) => ServiceMock<IdentityService>;
-  }
-  // (undocumented)
   export namespace lifecycle {
     const // (undocumented)
       factory: () => ServiceFactory<LifecycleService, 'plugin', 'singleton'>;
@@ -324,17 +311,6 @@ export namespace mockServices {
       ) => ServiceMock<SchedulerService>;
   }
   // (undocumented)
-  export function tokenManager(): TokenManagerService;
-  // (undocumented)
-  export namespace tokenManager {
-    const // (undocumented)
-      factory: () => ServiceFactory<TokenManagerService, 'plugin', 'singleton'>;
-    const // (undocumented)
-      mock: (
-        partialImpl?: Partial<TokenManagerService> | undefined,
-      ) => ServiceMock<TokenManagerService>;
-  }
-  // (undocumented)
   export namespace urlReader {
     const // (undocumented)
       factory: () => ServiceFactory<UrlReaderService, 'plugin', 'singleton'>;
diff --git a/packages/backend-test-utils/src/next/services/MockIdentityService.ts b/packages/backend-test-utils/src/next/services/MockIdentityService.ts
deleted file mode 100644
index ff424f79c2..0000000000
--- a/packages/backend-test-utils/src/next/services/MockIdentityService.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Copyright 2023 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import { IdentityService } from '@backstage/backend-plugin-api';
-import {
-  IdentityApiGetIdentityRequest,
-  BackstageIdentityResponse,
-} from '@backstage/plugin-auth-node';
-
-export class MockIdentityService implements IdentityService {
-  getIdentity(
-    _options: IdentityApiGetIdentityRequest,
-  ): Promise<BackstageIdentityResponse | undefined> {
-    return Promise.resolve({
-      token: 'mock-token',
-      identity: {
-        type: 'user',
-        userEntityRef: 'user:default/mock-user',
-        ownershipEntityRefs: [],
-      },
-    });
-  }
-}
diff --git a/packages/backend-test-utils/src/next/services/mockServices.ts b/packages/backend-test-utils/src/next/services/mockServices.ts
index 9833c6c45c..d3ec8fb18d 100644
--- a/packages/backend-test-utils/src/next/services/mockServices.ts
+++ b/packages/backend-test-utils/src/next/services/mockServices.ts
@@ -35,12 +35,10 @@ import {
   BackstageUserInfo,
   DiscoveryService,
   HttpAuthService,
-  IdentityService,
   LoggerService,
   RootConfigService,
   ServiceFactory,
   ServiceRef,
-  TokenManagerService,
   UserInfoService,
   coreServices,
   createServiceFactory,
@@ -53,7 +51,6 @@ import {
 import { JsonObject } from '@backstage/types';
 import { MockAuthService } from './MockAuthService';
 import { MockHttpAuthService } from './MockHttpAuthService';
-import { MockIdentityService } from './MockIdentityService';
 import { MockRootLoggerService } from './MockRootLoggerService';
 import { MockUserInfoService } from './MockUserInfoService';
 import { mockCredentials } from './mockCredentials';
@@ -167,46 +164,6 @@ export namespace mockServices {
     }));
   }
 
-  export function tokenManager(): TokenManagerService {
-    return {
-      async getToken(): Promise<{ token: string }> {
-        return { token: 'mock-token' };
-      },
-      async authenticate(token: string): Promise<void> {
-        if (token !== 'mock-token') {
-          throw new Error('Invalid token');
-        }
-      },
-    };
-  }
-  export namespace tokenManager {
-    export const factory = () =>
-      createServiceFactory({
-        service: coreServices.tokenManager,
-        deps: {},
-        factory: () => tokenManager(),
-      });
-    export const mock = simpleMock(coreServices.tokenManager, () => ({
-      authenticate: jest.fn(),
-      getToken: jest.fn(),
-    }));
-  }
-
-  export function identity(): IdentityService {
-    return new MockIdentityService();
-  }
-  export namespace identity {
-    export const factory = () =>
-      createServiceFactory({
-        service: coreServices.identity,
-        deps: {},
-        factory: () => identity(),
-      });
-    export const mock = simpleMock(coreServices.identity, () => ({
-      getIdentity: jest.fn(),
-    }));
-  }
-
   export function auth(options?: {
     pluginId?: string;
     disableDefaultAuthPolicy?: boolean;
diff --git a/packages/backend-test-utils/src/next/wiring/TestBackend.test.ts b/packages/backend-test-utils/src/next/wiring/TestBackend.test.ts
index 52ef3705a6..7bf3887c93 100644
--- a/packages/backend-test-utils/src/next/wiring/TestBackend.test.ts
+++ b/packages/backend-test-utils/src/next/wiring/TestBackend.test.ts
@@ -198,13 +198,12 @@ describe('TestBackend', () => {
             rootLifecycle: coreServices.rootLifecycle,
             rootLogger: coreServices.rootLogger,
             scheduler: coreServices.scheduler,
-            tokenManager: coreServices.tokenManager,
             urlReader: coreServices.urlReader,
             auth: coreServices.auth,
             httpAuth: coreServices.httpAuth,
           },
           async init(deps) {
-            expect(Object.keys(deps)).toHaveLength(17);
+            expect(Object.keys(deps)).toHaveLength(16);
             expect(Object.values(deps)).not.toContain(undefined);
           },
         });
diff --git a/packages/backend-test-utils/src/next/wiring/TestBackend.ts b/packages/backend-test-utils/src/next/wiring/TestBackend.ts
index 6b4110d4de..96bf0f7dc1 100644
--- a/packages/backend-test-utils/src/next/wiring/TestBackend.ts
+++ b/packages/backend-test-utils/src/next/wiring/TestBackend.ts
@@ -72,7 +72,6 @@ export const defaultServiceFactories = [
   mockServices.database.factory(),
   mockServices.httpAuth.factory(),
   mockServices.httpRouter.factory(),
-  mockServices.identity.factory(),
   mockServices.lifecycle.factory(),
   mockServices.logger.factory(),
   mockServices.permissions.factory(),
@@ -80,7 +79,6 @@ export const defaultServiceFactories = [
   mockServices.rootLifecycle.factory(),
   mockServices.rootLogger.factory(),
   mockServices.scheduler.factory(),
-  mockServices.tokenManager.factory(),
   mockServices.userInfo.factory(),
   mockServices.urlReader.factory(),
   mockServices.events.factory(),
diff --git a/plugins/auth-backend/api-report.md b/plugins/auth-backend/api-report.md
index 5478ccc323..1f33886759 100644
--- a/plugins/auth-backend/api-report.md
+++ b/plugins/auth-backend/api-report.md
@@ -41,7 +41,6 @@ import { RootConfigService } from '@backstage/backend-plugin-api';
 import { SignInInfo as SignInInfo_2 } from '@backstage/plugin-auth-node';
 import { SignInResolver as SignInResolver_2 } from '@backstage/plugin-auth-node';
 import { TokenManager } from '@backstage/backend-common';
-import { TokenManagerService } from '@backstage/backend-plugin-api';
 import { TokenParams as TokenParams_2 } from '@backstage/plugin-auth-node';
 import { UserEntity } from '@backstage/catalog-model';
 import { WebMessageResponse as WebMessageResponse_2 } from '@backstage/plugin-auth-node';
@@ -126,7 +125,7 @@ export type BitbucketServerOAuthResult = {
 export class CatalogIdentityClient {
   constructor(options: {
     catalogApi: CatalogApi;
-    tokenManager: TokenManager;
+    tokenManager?: TokenManager;
     discovery: DiscoveryService;
     auth?: AuthService;
     httpAuth?: HttpAuthService;
@@ -673,7 +672,7 @@ export interface RouterOptions {
   // (undocumented)
   tokenFactoryAlgorithm?: string;
   // (undocumented)
-  tokenManager: TokenManagerService;
+  tokenManager?: TokenManager;
 }
 
 // @public (undocumented)
diff --git a/plugins/auth-backend/src/authPlugin.ts b/plugins/auth-backend/src/authPlugin.ts
index 7687462d32..89b7e9a780 100644
--- a/plugins/auth-backend/src/authPlugin.ts
+++ b/plugins/auth-backend/src/authPlugin.ts
@@ -65,7 +65,6 @@ export const authPlugin = createBackendPlugin({
         config: coreServices.rootConfig,
         database: coreServices.database,
         discovery: coreServices.discovery,
-        tokenManager: coreServices.tokenManager,
         auth: coreServices.auth,
         httpAuth: coreServices.httpAuth,
         catalogApi: catalogServiceRef,
@@ -76,7 +75,6 @@ export const authPlugin = createBackendPlugin({
         config,
         database,
         discovery,
-        tokenManager,
         auth,
         httpAuth,
         catalogApi,
@@ -86,7 +84,6 @@ export const authPlugin = createBackendPlugin({
           config,
           database,
           discovery,
-          tokenManager,
           auth,
           httpAuth,
           catalogApi,
diff --git a/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.ts b/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.ts
index 51c72eeb63..e91108dbf2 100644
--- a/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.ts
+++ b/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.ts
@@ -45,7 +45,7 @@ export class CatalogIdentityClient {
 
   constructor(options: {
     catalogApi: CatalogApi;
-    tokenManager: TokenManager;
+    tokenManager?: TokenManager;
     discovery: DiscoveryService;
     auth?: AuthService;
     httpAuth?: HttpAuthService;
diff --git a/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.test.ts b/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.test.ts
index a69c9c90d4..7fb759200c 100644
--- a/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.test.ts
+++ b/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.test.ts
@@ -34,7 +34,6 @@ describe('CatalogAuthResolverContext', () => {
       logger: mockServices.logger.mock(),
       catalogApi: mockCatalogApi as CatalogApi,
       tokenIssuer: {} as TokenIssuer,
-      tokenManager: mockServices.tokenManager(),
       discovery: {} as DiscoveryService,
       auth: mockServices.auth(),
       httpAuth: mockServices.httpAuth(),
diff --git a/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.ts b/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.ts
index c81ac4c355..51b374b468 100644
--- a/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.ts
+++ b/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.ts
@@ -66,7 +66,7 @@ export class CatalogAuthResolverContext implements AuthResolverContext {
     logger: LoggerService;
     catalogApi: CatalogApi;
     tokenIssuer: TokenIssuer;
-    tokenManager: TokenManager;
+    tokenManager?: TokenManager;
     discovery: DiscoveryService;
     auth: AuthService;
     httpAuth: HttpAuthService;
diff --git a/plugins/auth-backend/src/providers/router.ts b/plugins/auth-backend/src/providers/router.ts
index d84133685c..e449372143 100644
--- a/plugins/auth-backend/src/providers/router.ts
+++ b/plugins/auth-backend/src/providers/router.ts
@@ -50,7 +50,7 @@ export function bindProviderRouters(
     discovery: PluginEndpointDiscovery;
     auth: AuthService;
     httpAuth: HttpAuthService;
-    tokenManager: TokenManager;
+    tokenManager?: TokenManager;
     tokenIssuer: TokenIssuer;
     ownershipResolver?: AuthOwnershipResolver;
     catalogApi?: CatalogApi;
diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index b954eb4dbb..af34ffc310 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -24,11 +24,13 @@ import {
   HttpAuthService,
   LoggerService,
   RootConfigService,
-  TokenManagerService,
 } from '@backstage/backend-plugin-api';
 import { defaultAuthProviderFactories } from '../providers';
 import { AuthOwnershipResolver } from '@backstage/plugin-auth-node';
-import { createLegacyAuthAdapters } from '@backstage/backend-common';
+import {
+  TokenManager,
+  createLegacyAuthAdapters,
+} from '@backstage/backend-common';
 import { NotFoundError } from '@backstage/errors';
 import { CatalogApi } from '@backstage/catalog-client';
 import {
@@ -56,7 +58,7 @@ export interface RouterOptions {
   database: DatabaseService;
   config: RootConfigService;
   discovery: DiscoveryService;
-  tokenManager: TokenManagerService;
+  tokenManager?: TokenManager;
   auth?: AuthService;
   httpAuth?: HttpAuthService;
   tokenFactoryAlgorithm?: string;
diff --git a/plugins/catalog-backend-module-bitbucket-cloud/src/module/catalogModuleBitbucketCloudEntityProvider.ts b/plugins/catalog-backend-module-bitbucket-cloud/src/module/catalogModuleBitbucketCloudEntityProvider.ts
index 21d86ce8e6..179e74b8c0 100644
--- a/plugins/catalog-backend-module-bitbucket-cloud/src/module/catalogModuleBitbucketCloudEntityProvider.ts
+++ b/plugins/catalog-backend-module-bitbucket-cloud/src/module/catalogModuleBitbucketCloudEntityProvider.ts
@@ -40,23 +40,13 @@ export const catalogModuleBitbucketCloudEntityProvider = createBackendModule({
         events: eventsServiceRef,
         logger: coreServices.logger,
         scheduler: coreServices.scheduler,
-        tokenManager: coreServices.tokenManager,
       },
-      async init({
-        catalog,
-        catalogApi,
-        config,
-        events,
-        logger,
-        scheduler,
-        tokenManager,
-      }) {
+      async init({ catalog, catalogApi, config, events, logger, scheduler }) {
         const providers = BitbucketCloudEntityProvider.fromConfig(config, {
           catalogApi,
           events,
           logger,
           scheduler,
-          tokenManager,
         });
 
         catalog.addEntityProvider(providers);
diff --git a/plugins/example-todo-list-backend/api-report.md b/plugins/example-todo-list-backend/api-report.md
index 1dd4880323..8fa39f0cec 100644
--- a/plugins/example-todo-list-backend/api-report.md
+++ b/plugins/example-todo-list-backend/api-report.md
@@ -5,7 +5,7 @@
 ```ts
 import { BackendFeature } from '@backstage/backend-plugin-api';
 import express from 'express';
-import { IdentityApi } from '@backstage/plugin-auth-node';
+import { HttpAuthService } from '@backstage/backend-plugin-api';
 import { LoggerService } from '@backstage/backend-plugin-api';
 
 // @public
@@ -18,7 +18,7 @@ export default exampleTodoListPlugin;
 // @public
 export interface RouterOptions {
   // (undocumented)
-  identity: IdentityApi;
+  httpAuth: HttpAuthService;
   // (undocumented)
   logger: LoggerService;
 }
diff --git a/plugins/example-todo-list-backend/src/plugin.ts b/plugins/example-todo-list-backend/src/plugin.ts
index ccff192d4c..1c7bba929a 100644
--- a/plugins/example-todo-list-backend/src/plugin.ts
+++ b/plugins/example-todo-list-backend/src/plugin.ts
@@ -30,14 +30,14 @@ export const exampleTodoListPlugin = createBackendPlugin({
   register(env) {
     env.registerInit({
       deps: {
-        identity: coreServices.identity,
+        httpAuth: coreServices.httpAuth,
         logger: coreServices.logger,
         httpRouter: coreServices.httpRouter,
       },
-      async init({ identity, logger, httpRouter }) {
+      async init({ httpAuth, logger, httpRouter }) {
         httpRouter.use(
           await createRouter({
-            identity,
+            httpAuth,
             logger,
           }),
         );
diff --git a/plugins/example-todo-list-backend/src/service/router.test.ts b/plugins/example-todo-list-backend/src/service/router.test.ts
index e9abb5a76c..50bacac203 100644
--- a/plugins/example-todo-list-backend/src/service/router.test.ts
+++ b/plugins/example-todo-list-backend/src/service/router.test.ts
@@ -14,7 +14,6 @@
  * limitations under the License.
  */
 
-import { DefaultIdentityClient } from '@backstage/plugin-auth-node';
 import express from 'express';
 import request from 'supertest';
 
@@ -27,7 +26,7 @@ describe('createRouter', () => {
   beforeAll(async () => {
     const router = await createRouter({
       logger: mockServices.logger.mock(),
-      identity: {} as DefaultIdentityClient,
+      httpAuth: mockServices.httpAuth.mock(),
     });
     app = express().use(router);
   });
diff --git a/plugins/example-todo-list-backend/src/service/router.ts b/plugins/example-todo-list-backend/src/service/router.ts
index 09b8669507..5f2d9fd37c 100644
--- a/plugins/example-todo-list-backend/src/service/router.ts
+++ b/plugins/example-todo-list-backend/src/service/router.ts
@@ -19,8 +19,7 @@ import express from 'express';
 import Router from 'express-promise-router';
 import { add, getAll, update } from './todos';
 import { InputError } from '@backstage/errors';
-import { IdentityApi } from '@backstage/plugin-auth-node';
-import { LoggerService } from '@backstage/backend-plugin-api';
+import { HttpAuthService, LoggerService } from '@backstage/backend-plugin-api';
 
 /**
  * Dependencies of the todo-list router
@@ -29,7 +28,7 @@ import { LoggerService } from '@backstage/backend-plugin-api';
  */
 export interface RouterOptions {
   logger: LoggerService;
-  identity: IdentityApi;
+  httpAuth: HttpAuthService;
 }
 
 /**
@@ -44,7 +43,7 @@ export interface RouterOptions {
 export async function createRouter(
   options: RouterOptions,
 ): Promise<express.Router> {
-  const { logger, identity } = options;
+  const { logger, httpAuth } = options;
 
   const router = Router();
   router.use(express.json());
@@ -59,16 +58,16 @@ export async function createRouter(
   });
 
   router.post('/todos', async (req, res) => {
-    let author: string | undefined = undefined;
-
-    const user = await identity.getIdentity({ request: req });
-    author = user?.identity.userEntityRef;
+    const credentials = await httpAuth.credentials(req, { allow: ['user'] });
 
     if (!isTodoCreateRequest(req.body)) {
       throw new InputError('Invalid payload');
     }
 
-    const todo = add({ title: req.body.title, author });
+    const todo = add({
+      title: req.body.title,
+      author: credentials.principal.userEntityRef,
+    });
     res.json(todo);
   });
 
diff --git a/plugins/permission-node/api-report.md b/plugins/permission-node/api-report.md
index 36483bd342..0f0885e180 100644
--- a/plugins/permission-node/api-report.md
+++ b/plugins/permission-node/api-report.md
@@ -29,7 +29,7 @@ import { PermissionsServiceRequestOptions } from '@backstage/backend-plugin-api'
 import { PolicyDecision } from '@backstage/plugin-permission-common';
 import { QueryPermissionRequest } from '@backstage/plugin-permission-common';
 import { ResourcePermission } from '@backstage/plugin-permission-common';
-import { TokenManagerService } from '@backstage/backend-plugin-api';
+import { TokenManager } from '@backstage/backend-common';
 import { z } from 'zod';
 
 // @public
@@ -290,7 +290,7 @@ export class ServerPermissionClient implements PermissionsService {
     config: Config,
     options: {
       discovery: DiscoveryService;
-      tokenManager: TokenManagerService;
+      tokenManager?: TokenManager;
       auth?: AuthService;
     },
   ): ServerPermissionClient;
diff --git a/plugins/permission-node/src/ServerPermissionClient.test.ts b/plugins/permission-node/src/ServerPermissionClient.test.ts
index 5c6328ae44..772f1b95d7 100644
--- a/plugins/permission-node/src/ServerPermissionClient.test.ts
+++ b/plugins/permission-node/src/ServerPermissionClient.test.ts
@@ -82,7 +82,6 @@ describe('ServerPermissionClient', () => {
     it('should bypass the permission backend if permissions are disabled', async () => {
       const client = ServerPermissionClient.fromConfig(new ConfigReader({}), {
         discovery,
-        tokenManager: mockServices.tokenManager.mock(),
         auth: mockServices.auth(),
       });
 
@@ -101,7 +100,6 @@ describe('ServerPermissionClient', () => {
     it('should bypass the permission backend if permissions are enabled and request has valid server credentials', async () => {
       const client = ServerPermissionClient.fromConfig(config, {
         discovery,
-        tokenManager: mockServices.tokenManager.mock(),
         auth: mockServices.auth(),
       });
 
@@ -115,7 +113,6 @@ describe('ServerPermissionClient', () => {
     it('should call the permission backend if permissions are enabled and request does not have valid server credentials', async () => {
       const client = ServerPermissionClient.fromConfig(config, {
         discovery,
-        tokenManager: mockServices.tokenManager.mock(),
         auth: mockServices.auth(),
       });
 
@@ -156,7 +153,6 @@ describe('ServerPermissionClient', () => {
     it('should bypass the permission backend if permissions are disabled', async () => {
       const client = ServerPermissionClient.fromConfig(new ConfigReader({}), {
         discovery,
-        tokenManager: mockServices.tokenManager.mock(),
         auth: mockServices.auth(),
       });
 
@@ -173,7 +169,6 @@ describe('ServerPermissionClient', () => {
     it('should bypass the permission backend if permissions are enabled and request has valid server credentials', async () => {
       const client = ServerPermissionClient.fromConfig(config, {
         discovery,
-        tokenManager: mockServices.tokenManager.mock(),
         auth: mockServices.auth(),
       });
 
@@ -190,7 +185,6 @@ describe('ServerPermissionClient', () => {
     it('should call the permission backend if permissions are enabled and request does not have valid server credentials', async () => {
       const client = ServerPermissionClient.fromConfig(config, {
         discovery,
-        tokenManager: mockServices.tokenManager.mock(),
         auth: mockServices.auth(),
       });
 
@@ -223,7 +217,6 @@ describe('ServerPermissionClient', () => {
           }),
           {
             discovery,
-            tokenManager: mockServices.tokenManager(),
             auth: mockServices.auth(),
           },
         );
diff --git a/plugins/permission-node/src/ServerPermissionClient.ts b/plugins/permission-node/src/ServerPermissionClient.ts
index e21067bfa1..c34a8fe930 100644
--- a/plugins/permission-node/src/ServerPermissionClient.ts
+++ b/plugins/permission-node/src/ServerPermissionClient.ts
@@ -14,7 +14,10 @@
  * limitations under the License.
  */
 
-import { createLegacyAuthAdapters } from '@backstage/backend-common';
+import {
+  TokenManager,
+  createLegacyAuthAdapters,
+} from '@backstage/backend-common';
 import {
   AuthService,
   BackstageCredentials,
@@ -22,7 +25,6 @@ import {
   DiscoveryService,
   PermissionsService,
   PermissionsServiceRequestOptions,
-  TokenManagerService,
 } from '@backstage/backend-plugin-api';
 import { Config } from '@backstage/config';
 import {
@@ -51,7 +53,8 @@ export class ServerPermissionClient implements PermissionsService {
     config: Config,
     options: {
       discovery: DiscoveryService;
-      tokenManager: TokenManagerService;
+      /** @deprecated This option will be removed in the future, provide a the auth option instead */
+      tokenManager?: TokenManager;
       auth?: AuthService;
     },
   ) {
@@ -62,6 +65,7 @@ export class ServerPermissionClient implements PermissionsService {
 
     if (
       permissionEnabled &&
+      tokenManager &&
       (tokenManager as any).isInsecureServerTokenManager
     ) {
       throw new Error(
diff --git a/plugins/search-backend-module-catalog/src/alpha.ts b/plugins/search-backend-module-catalog/src/alpha.ts
index 2ae9cd8af9..03e5bcb226 100644
--- a/plugins/search-backend-module-catalog/src/alpha.ts
+++ b/plugins/search-backend-module-catalog/src/alpha.ts
@@ -80,7 +80,6 @@ export default createBackendModule({
         auth: coreServices.auth,
         config: coreServices.rootConfig,
         discovery: coreServices.discovery,
-        tokenManager: coreServices.tokenManager,
         scheduler: coreServices.scheduler,
         indexRegistry: searchIndexRegistryExtensionPoint,
         catalog: catalogServiceRef,
@@ -89,7 +88,6 @@ export default createBackendModule({
         auth,
         config,
         discovery,
-        tokenManager,
         scheduler,
         indexRegistry,
         catalog,
@@ -102,7 +100,6 @@ export default createBackendModule({
             auth,
             entityTransformer,
             discovery,
-            tokenManager,
             catalogClient: catalog,
           }),
         });
diff --git a/plugins/search-backend-module-explore/src/alpha.ts b/plugins/search-backend-module-explore/src/alpha.ts
index ee4bedde21..63a13c273b 100644
--- a/plugins/search-backend-module-explore/src/alpha.ts
+++ b/plugins/search-backend-module-explore/src/alpha.ts
@@ -43,7 +43,6 @@ export default createBackendModule({
         logger: coreServices.logger,
         discovery: coreServices.discovery,
         scheduler: coreServices.scheduler,
-        tokenManager: coreServices.tokenManager,
         auth: coreServices.auth,
         indexRegistry: searchIndexRegistryExtensionPoint,
       },
@@ -52,7 +51,6 @@ export default createBackendModule({
         logger,
         discovery,
         scheduler,
-        tokenManager,
         auth,
         indexRegistry,
       }) {
@@ -74,7 +72,6 @@ export default createBackendModule({
             discovery,
             logger,
             auth,
-            tokenManager,
           }),
         });
       },
diff --git a/plugins/search-backend-module-techdocs/src/alpha.ts b/plugins/search-backend-module-techdocs/src/alpha.ts
index 77cf6af47b..344a50c59d 100644
--- a/plugins/search-backend-module-techdocs/src/alpha.ts
+++ b/plugins/search-backend-module-techdocs/src/alpha.ts
@@ -78,7 +78,6 @@ export default createBackendModule({
         auth: coreServices.auth,
         httpAuth: coreServices.httpAuth,
         discovery: coreServices.discovery,
-        tokenManager: coreServices.tokenManager,
         scheduler: coreServices.scheduler,
         catalog: catalogServiceRef,
         indexRegistry: searchIndexRegistryExtensionPoint,
@@ -89,7 +88,6 @@ export default createBackendModule({
         auth,
         httpAuth,
         discovery,
-        tokenManager,
         scheduler,
         catalog,
         indexRegistry,
@@ -110,7 +108,6 @@ export default createBackendModule({
           schedule: scheduler.createScheduledTaskRunner(schedule),
           factory: DefaultTechDocsCollatorFactory.fromConfig(config, {
             discovery,
-            tokenManager,
             auth,
             httpAuth,
             logger,
diff --git a/plugins/signals-backend/api-report.md b/plugins/signals-backend/api-report.md
index b7d3255239..442b923851 100644
--- a/plugins/signals-backend/api-report.md
+++ b/plugins/signals-backend/api-report.md
@@ -28,7 +28,7 @@ export interface RouterOptions {
   // (undocumented)
   events: EventsService;
   // (undocumented)
-  identity: IdentityApi;
+  identity?: IdentityApi;
   // (undocumented)
   lifecycle?: LifecycleService;
   // (undocumented)
diff --git a/plugins/signals-backend/src/plugin.ts b/plugins/signals-backend/src/plugin.ts
index 0963b79ccb..a627f7019b 100644
--- a/plugins/signals-backend/src/plugin.ts
+++ b/plugins/signals-backend/src/plugin.ts
@@ -34,7 +34,6 @@ export const signalsPlugin = createBackendPlugin({
         logger: coreServices.logger,
         config: coreServices.rootConfig,
         lifecycle: coreServices.rootLifecycle,
-        identity: coreServices.identity,
         discovery: coreServices.discovery,
         userInfo: coreServices.userInfo,
         auth: coreServices.auth,
@@ -45,7 +44,6 @@ export const signalsPlugin = createBackendPlugin({
         logger,
         config,
         lifecycle,
-        identity,
         discovery,
         userInfo,
         auth,
@@ -55,7 +53,6 @@ export const signalsPlugin = createBackendPlugin({
           await createRouter({
             logger,
             config,
-            identity,
             lifecycle,
             discovery,
             userInfo,
diff --git a/plugins/signals-backend/src/service/router.ts b/plugins/signals-backend/src/service/router.ts
index ea706ebf1a..aaf981aa34 100644
--- a/plugins/signals-backend/src/service/router.ts
+++ b/plugins/signals-backend/src/service/router.ts
@@ -40,7 +40,7 @@ import { Config } from '@backstage/config';
 export interface RouterOptions {
   logger: LoggerService;
   events: EventsService;
-  identity: IdentityApi;
+  identity?: IdentityApi;
   discovery: PluginEndpointDiscovery;
   config: Config;
   lifecycle?: LifecycleService;
diff --git a/plugins/user-settings-backend/dev/index.ts b/plugins/user-settings-backend/dev/index.ts
index 49fa7cb6bd..43c75d24df 100644
--- a/plugins/user-settings-backend/dev/index.ts
+++ b/plugins/user-settings-backend/dev/index.ts
@@ -15,9 +15,7 @@
  */
 
 import { createBackend } from '@backstage/backend-defaults';
-import { mockServices } from '@backstage/backend-test-utils';
 
 const backend = createBackend();
-backend.add(mockServices.identity.factory());
 backend.add(import('../src/alpha'));
 backend.start();