diff --git a/app-config.yaml b/app-config.yaml
index 8aa3bc569c..fdd97cbb8c 100644
--- a/app-config.yaml
+++ b/app-config.yaml
@@ -23,6 +23,8 @@ app:
             title: '#backstage'
 
 backend:
+  auth:
+    secret: ${BACKEND_SECRET}
   baseUrl: http://localhost:7000
   listen:
     port: 7000
diff --git a/packages/backend-common/src/tokens/AuthIdentityTokenManager.ts b/packages/backend-common/src/tokens/AuthIdentityTokenManager.ts
index 9487d4555b..7aa97925ae 100644
--- a/packages/backend-common/src/tokens/AuthIdentityTokenManager.ts
+++ b/packages/backend-common/src/tokens/AuthIdentityTokenManager.ts
@@ -15,6 +15,7 @@
  */
 
 import { JWK, JWT } from 'jose';
+import { Config } from '@backstage/config';
 import { TokenManager } from './types';
 import { IdentityClient } from '../identity';
 import { PluginEndpointDiscovery } from '../discovery';
@@ -24,11 +25,13 @@ export class AuthIdentityTokenManager implements TokenManager {
   private identityClient: IdentityClient;
   private key: JWK.OctKey;
 
-  constructor(discovery: PluginEndpointDiscovery, secret: string) {
+  constructor(discovery: PluginEndpointDiscovery, config: Config) {
     this.identityClient = new IdentityClient({
       discovery: discovery,
       issuer: 'auth-identity-token-manager',
     });
+
+    const secret = config.getConfig('backend.auth').getString('secret');
     this.key = JWK.asKey({ kty: 'oct', k: secret });
   }
 
diff --git a/packages/backend/src/index.ts b/packages/backend/src/index.ts
index ffcd52a1dd..57417ce9c6 100644
--- a/packages/backend/src/index.ts
+++ b/packages/backend/src/index.ts
@@ -66,7 +66,7 @@ function makeCreateEnv(config: Config) {
   const root = getRootLogger();
   const reader = UrlReaders.default({ logger: root, config });
   const discovery = SingleHostDiscovery.fromConfig(config);
-  const tokenManager = new AuthIdentityTokenManager(discovery, 'secret-tehe');
+  const tokenManager = new AuthIdentityTokenManager(discovery, config);
 
   root.info(`Created UrlReader ${reader}`);
 
diff --git a/packages/create-app/templates/default-app/packages/backend/src/index.ts b/packages/create-app/templates/default-app/packages/backend/src/index.ts
index 204fe8ae81..a85f331a7b 100644
--- a/packages/create-app/templates/default-app/packages/backend/src/index.ts
+++ b/packages/create-app/templates/default-app/packages/backend/src/index.ts
@@ -38,7 +38,7 @@ function makeCreateEnv(config: Config) {
 
   const cacheManager = CacheManager.fromConfig(config);
   const databaseManager = DatabaseManager.fromConfig(config);
-  const tokenManager = new AuthIdentityTokenManager(discovery);
+  const tokenManager = new AuthIdentityTokenManager(discovery, config);
 
   return (plugin: string): PluginEnvironment => {
     const logger = root.child({ type: 'plugin', plugin });
diff --git a/plugins/auth-backend/src/identity/index.ts b/plugins/auth-backend/src/identity/index.ts
index 727e47ed6a..cb2f369668 100644
--- a/plugins/auth-backend/src/identity/index.ts
+++ b/plugins/auth-backend/src/identity/index.ts
@@ -15,7 +15,6 @@
  */
 
 export { createOidcRouter } from './router';
-// export { IdentityClient } from './IdentityClient';
 export { TokenFactory } from './TokenFactory';
 export { DatabaseKeyStore } from './DatabaseKeyStore';
 export { MemoryKeyStore } from './MemoryKeyStore';