diff --git a/packages/backend-test-utils/src/next/services/MockAuthService.test.ts b/packages/backend-test-utils/src/next/services/MockAuthService.test.ts
index b354301c53..7a6e562c98 100644
--- a/packages/backend-test-utils/src/next/services/MockAuthService.test.ts
+++ b/packages/backend-test-utils/src/next/services/MockAuthService.test.ts
@@ -57,6 +57,10 @@ describe('MockAuthService', () => {
     await expect(
       auth.authenticate(mockCredentials.user.token('user:default/other')),
     ).resolves.toEqual(mockCredentials.user('user:default/other'));
+
+    await expect(
+      auth.authenticate(mockCredentials.user.invalidToken()),
+    ).rejects.toThrow('User token is invalid');
   });
 
   it('should authenticate mock service tokens', async () => {
@@ -91,6 +95,10 @@ describe('MockAuthService', () => {
     ).rejects.toThrow(
       "Invalid mock token target plugin ID, got 'other' but expected 'test'",
     );
+
+    await expect(
+      auth.authenticate(mockCredentials.service.invalidToken()),
+    ).rejects.toThrow('Service token is invalid');
   });
 
   it('should return own service credentials', async () => {
diff --git a/packages/backend-test-utils/src/next/services/MockAuthService.ts b/packages/backend-test-utils/src/next/services/MockAuthService.ts
index 38a068adeb..7d1bbc0733 100644
--- a/packages/backend-test-utils/src/next/services/MockAuthService.ts
+++ b/packages/backend-test-utils/src/next/services/MockAuthService.ts
@@ -31,6 +31,8 @@ import {
   MOCK_SERVICE_TOKEN_PREFIX,
   DEFAULT_MOCK_USER_ENTITY_REF,
   DEFAULT_MOCK_SERVICE_SUBJECT,
+  MOCK_INVALID_USER_TOKEN,
+  MOCK_INVALID_SERVICE_TOKEN,
 } from './mockCredentials';
 
 /** @internal */
@@ -38,11 +40,16 @@ export class MockAuthService implements AuthService {
   constructor(private readonly pluginId: string) {}
 
   async authenticate(token: string): Promise<BackstageCredentials> {
-    if (token === MOCK_USER_TOKEN) {
-      return mockCredentials.user();
-    }
-    if (token === MOCK_SERVICE_TOKEN) {
-      return mockCredentials.service();
+    switch (token) {
+      case MOCK_USER_TOKEN:
+        return mockCredentials.user();
+      case MOCK_SERVICE_TOKEN:
+        return mockCredentials.service();
+      case MOCK_INVALID_USER_TOKEN:
+        throw new AuthenticationError('User token is invalid');
+      case MOCK_INVALID_SERVICE_TOKEN:
+        throw new AuthenticationError('Service token is invalid');
+      default:
     }
 
     if (token.startsWith(MOCK_USER_TOKEN_PREFIX)) {
diff --git a/packages/backend-test-utils/src/next/services/mockCredentials.test.ts b/packages/backend-test-utils/src/next/services/mockCredentials.test.ts
index aaa2626309..3d7540a0ee 100644
--- a/packages/backend-test-utils/src/next/services/mockCredentials.test.ts
+++ b/packages/backend-test-utils/src/next/services/mockCredentials.test.ts
@@ -53,10 +53,15 @@ describe('mockCredentials', () => {
     expect(mockCredentials.user.token('user:default/other')).toBe(
       'mock-user-token:{"userEntityRef":"user:default/other"}',
     );
+    expect(mockCredentials.user.invalidToken()).toBe('mock-invalid-user-token');
+
     expect(mockCredentials.user.header()).toBe('Bearer mock-user-token');
     expect(mockCredentials.user.header('user:default/other')).toBe(
       'Bearer mock-user-token:{"userEntityRef":"user:default/other"}',
     );
+    expect(mockCredentials.user.invalidHeader()).toBe(
+      'Bearer mock-invalid-user-token',
+    );
   });
 
   it('creates service tokens and headers', () => {
@@ -86,6 +91,9 @@ describe('mockCredentials', () => {
     ).toBe(
       'mock-service-token:{"subject":"external:other","targetPluginId":"other"}',
     );
+    expect(mockCredentials.service.invalidToken()).toBe(
+      'mock-invalid-service-token',
+    );
 
     expect(mockCredentials.service.header()).toBe('Bearer mock-service-token');
     expect(mockCredentials.service.header({ subject: 'external:other' })).toBe(
@@ -113,6 +121,9 @@ describe('mockCredentials', () => {
     ).toBe(
       'Bearer mock-service-token:{"subject":"external:other","targetPluginId":"other"}',
     );
+    expect(mockCredentials.service.invalidHeader()).toBe(
+      'Bearer mock-invalid-service-token',
+    );
   });
 
   it('should throw on invalid user entity refs', () => {
diff --git a/packages/backend-test-utils/src/next/services/mockCredentials.ts b/packages/backend-test-utils/src/next/services/mockCredentials.ts
index e86916db3b..cf516c403a 100644
--- a/packages/backend-test-utils/src/next/services/mockCredentials.ts
+++ b/packages/backend-test-utils/src/next/services/mockCredentials.ts
@@ -26,8 +26,10 @@ export const DEFAULT_MOCK_SERVICE_SUBJECT = 'external:test-service';
 
 export const MOCK_USER_TOKEN = 'mock-user-token';
 export const MOCK_USER_TOKEN_PREFIX = 'mock-user-token:';
+export const MOCK_INVALID_USER_TOKEN = 'mock-invalid-user-token';
 export const MOCK_SERVICE_TOKEN = 'mock-service-token';
 export const MOCK_SERVICE_TOKEN_PREFIX = 'mock-service-token:';
+export const MOCK_INVALID_SERVICE_TOKEN = 'mock-invalid-service-token';
 
 function validateUserEntityRef(ref: string) {
   if (!ref.match(/^.+:.+\/.+$/)) {
@@ -96,6 +98,14 @@ export namespace mockCredentials {
     export function header(userEntityRef?: string): string {
       return `Bearer ${token(userEntityRef)}`;
     }
+
+    export function invalidToken(): string {
+      return MOCK_INVALID_USER_TOKEN;
+    }
+
+    export function invalidHeader(): string {
+      return `Bearer ${invalidToken()}`;
+    }
   }
 
   /**
@@ -148,5 +158,13 @@ export namespace mockCredentials {
     export function header(payload?: TokenPayload): string {
       return `Bearer ${token(payload)}`;
     }
+
+    export function invalidToken(): string {
+      return MOCK_INVALID_SERVICE_TOKEN;
+    }
+
+    export function invalidHeader(): string {
+      return `Bearer ${invalidToken()}`;
+    }
   }
 }