diff --git a/docs/auth/index.md b/docs/auth/index.md
index bff1f3df26..a3141d0434 100644
--- a/docs/auth/index.md
+++ b/docs/auth/index.md
@@ -459,6 +459,42 @@ providerFactories: {
 },
 ```
 
+In the new backend system you can leverage the `authProvidersExtensionPoint` for this:
+
+```ts
+// your-auth-plugin-module.ts
+export const gheAuth = createBackendModule({
+  // This ID must be exactly "auth" because that's the plugin it targets
+  pluginId: 'auth',
+  // This ID must be unique, but can be anything
+  moduleId: 'ghe-auth-provider',
+  register(reg) {
+    reg.registerInit({
+      deps: {
+        providers: authProvidersExtensionPoint,
+        logger: coreServices.logger,
+      },
+      async init({ providers, logger }) {
+        providers.registerProvider({
+          // This ID must match the actual provider config, e.g. addressing
+          // auth.providers.ghe means that this must be "ghe".
+          providerId: 'ghe',
+          factory: createOAuthProviderFactory({
+            authenticator: githubAuthenticator,
+            signInResolverFactories: {
+              ...commonSignInResolvers,
+            },
+          }),
+        });
+      },
+    });
+  },
+});
+
+// backend index.ts
+backend.add(gheAuth);
+```
+
 ## Configuring token issuers
 
 By default, the Backstage authentication backend generates and manages its own signing keys automatically for any issued