diff --git a/.changeset/early-eggs-press.md b/.changeset/early-eggs-press.md
new file mode 100644
index 0000000000..ff6658f7ca
--- /dev/null
+++ b/.changeset/early-eggs-press.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-common': patch
+---
+
+The `TokenManager` has been deprecated in preparation for the [stable release of the New Backend System](https://github.com/backstage/backstage/issues/24493). Please [migrate](https://backstage.io/docs/tutorials/auth-service-migration) to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead.
diff --git a/packages/backend-common/api-report.md b/packages/backend-common/api-report.md
index 9e69e0ab44..84328924bd 100644
--- a/packages/backend-common/api-report.md
+++ b/packages/backend-common/api-report.md
@@ -65,7 +65,7 @@ import type { SearchResponse as SearchResponse_2 } from '@backstage/backend-plug
 import type { SearchResponseFile as SearchResponseFile_2 } from '@backstage/backend-plugin-api';
 import { Server } from 'http';
 import { ServiceRef } from '@backstage/backend-plugin-api';
-import { TokenManagerService as TokenManager } from '@backstage/backend-plugin-api';
+import { TokenManagerService } from '@backstage/backend-plugin-api';
 import { TransportStreamOptions } from 'winston-transport';
 import { UrlReaderService } from '@backstage/backend-plugin-api';
 import { UrlReaderServiceReadTreeOptions } from '@backstage/backend-plugin-api';
@@ -405,7 +405,7 @@ export const legacyPlugin: (
           logger: LoggerService;
           permissions: PermissionsService;
           scheduler: SchedulerService;
-          tokenManager: TokenManager;
+          tokenManager: TokenManagerService;
           reader: UrlReaderService;
           identity: IdentityService;
         },
@@ -572,7 +572,7 @@ export type SearchResponse = SearchResponse_2;
 // @public @deprecated (undocumented)
 export type SearchResponseFile = SearchResponseFile_2;
 
-// @public
+// @public @deprecated
 export class ServerTokenManager implements TokenManager {
   // (undocumented)
   authenticate(token: string): Promise<void>;
@@ -588,7 +588,7 @@ export class ServerTokenManager implements TokenManager {
   static noop(): TokenManager;
 }
 
-// @public
+// @public @deprecated
 export interface ServerTokenManagerOptions {
   allowDisabledTokenManager?: boolean;
   logger: LoggerService;
@@ -647,7 +647,8 @@ export interface StatusCheckHandlerOptions {
   statusCheck?: StatusCheck;
 }
 
-export { TokenManager };
+// @public @deprecated (undocumented)
+export type TokenManager = TokenManagerService;
 
 // @public @deprecated (undocumented)
 export type UrlReader = UrlReaderService;
diff --git a/packages/backend-common/src/auth/createLegacyAuthAdapters.ts b/packages/backend-common/src/auth/createLegacyAuthAdapters.ts
index 97d8cd6240..94f997640d 100644
--- a/packages/backend-common/src/auth/createLegacyAuthAdapters.ts
+++ b/packages/backend-common/src/auth/createLegacyAuthAdapters.ts
@@ -27,7 +27,6 @@ import {
   TokenManagerService,
   UserInfoService,
 } from '@backstage/backend-plugin-api';
-import { TokenManager } from '../tokens';
 import { AuthenticationError, NotAllowedError } from '@backstage/errors';
 import type { Request, Response } from 'express';
 // eslint-disable-next-line @backstage/no-relative-monorepo-imports
@@ -43,6 +42,7 @@ import {
   DefaultIdentityClient,
 } from '@backstage/plugin-auth-node';
 import { decodeJwt } from 'jose';
+import { TokenManager } from '../deprecated';
 import { PluginEndpointDiscovery } from '../discovery';
 import { JsonObject } from '@backstage/types';
 
diff --git a/packages/backend-common/src/deprecated/index.ts b/packages/backend-common/src/deprecated/index.ts
index 6bd8906fec..5309240ccb 100644
--- a/packages/backend-common/src/deprecated/index.ts
+++ b/packages/backend-common/src/deprecated/index.ts
@@ -14,8 +14,6 @@
  * limitations under the License.
  */
 
-export * from './scm';
-
 // eslint-disable-next-line @backstage/no-relative-monorepo-imports
 import { CacheManager as _CacheManager } from '../../../backend-defaults/src/entrypoints/cache/CacheManager';
 // eslint-disable-next-line @backstage/no-relative-monorepo-imports
@@ -34,6 +32,9 @@ import {
   isChildPath as _isChildPath,
 } from '@backstage/backend-plugin-api';
 
+export * from './scm';
+export * from './tokens';
+
 /**
  * @public
  * @deprecated Use `CacheManager` from the `@backstage/backend-defaults` package instead
diff --git a/packages/backend-common/src/tokens/ServerTokenManager.test.ts b/packages/backend-common/src/deprecated/tokens/ServerTokenManager.test.ts
similarity index 100%
rename from packages/backend-common/src/tokens/ServerTokenManager.test.ts
rename to packages/backend-common/src/deprecated/tokens/ServerTokenManager.test.ts
diff --git a/packages/backend-common/src/tokens/ServerTokenManager.ts b/packages/backend-common/src/deprecated/tokens/ServerTokenManager.ts
similarity index 94%
rename from packages/backend-common/src/tokens/ServerTokenManager.ts
rename to packages/backend-common/src/deprecated/tokens/ServerTokenManager.ts
index a62eb8de55..a9dee0f67a 100644
--- a/packages/backend-common/src/tokens/ServerTokenManager.ts
+++ b/packages/backend-common/src/deprecated/tokens/ServerTokenManager.ts
@@ -61,6 +61,7 @@ class DisabledTokenManager implements TokenManager {
  * Options for {@link ServerTokenManager}.
  *
  * @public
+ * @deprecated Please {@link https://backstage.io/docs/tutorials/auth-service-migration | migrate} to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead.
  */
 export interface ServerTokenManagerOptions {
   /**
@@ -79,6 +80,7 @@ export interface ServerTokenManagerOptions {
  * authentication.
  *
  * @public
+ * @deprecated Please {@link https://backstage.io/docs/tutorials/auth-service-migration | migrate} to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead.
  */
 export class ServerTokenManager implements TokenManager {
   private readonly options: ServerTokenManagerOptions;
diff --git a/packages/backend-common/src/tokens/index.ts b/packages/backend-common/src/deprecated/tokens/index.ts
similarity index 100%
rename from packages/backend-common/src/tokens/index.ts
rename to packages/backend-common/src/deprecated/tokens/index.ts
diff --git a/packages/backend-common/src/tokens/types.ts b/packages/backend-common/src/deprecated/tokens/types.ts
similarity index 63%
rename from packages/backend-common/src/tokens/types.ts
rename to packages/backend-common/src/deprecated/tokens/types.ts
index 4e0fd698df..09dc0bb211 100644
--- a/packages/backend-common/src/tokens/types.ts
+++ b/packages/backend-common/src/deprecated/tokens/types.ts
@@ -14,4 +14,10 @@
  * limitations under the License.
  */
 
-export type { TokenManagerService as TokenManager } from '@backstage/backend-plugin-api';
+import { TokenManagerService } from '@backstage/backend-plugin-api';
+
+/**
+ * @public
+ * @deprecated Please {@link https://backstage.io/docs/tutorials/auth-service-migration | migrate} to the new `coreServices.auth`, `coreServices.httpAuth`, and `coreServices.userInfo` services as needed instead.
+ */
+export type TokenManager = TokenManagerService;
diff --git a/packages/backend-common/src/index.ts b/packages/backend-common/src/index.ts
index 87bfa245f6..bd6fdb2bb6 100644
--- a/packages/backend-common/src/index.ts
+++ b/packages/backend-common/src/index.ts
@@ -22,9 +22,9 @@
 
 export { legacyPlugin, makeLegacyPlugin } from './legacy';
 export type { LegacyCreateRouter } from './legacy';
+export { loadBackendConfig } from './config';
 export * from './auth';
 export * from './cache';
-export { loadBackendConfig } from './config';
 export * from './deprecated';
 export * from './database';
 export * from './discovery';
@@ -33,5 +33,4 @@ export * from './logging';
 export * from './middleware';
 export * from './reading';
 export * from './service';
-export * from './tokens';
 export * from './util';
diff --git a/packages/backend-common/src/legacy.ts b/packages/backend-common/src/legacy.ts
index 6aa991489c..420126f519 100644
--- a/packages/backend-common/src/legacy.ts
+++ b/packages/backend-common/src/legacy.ts
@@ -23,7 +23,7 @@ import {
 import { RequestHandler } from 'express';
 import { cacheToPluginCacheManager } from './cache';
 import { loggerToWinstonLogger } from './logging';
-import { TokenManager } from './tokens';
+import { TokenManager } from './deprecated';
 
 /**
  * @public