diff --git a/.changeset/sharp-peaches-begin.md b/.changeset/sharp-peaches-begin.md
new file mode 100644
index 0000000000..63c452fbb1
--- /dev/null
+++ b/.changeset/sharp-peaches-begin.md
@@ -0,0 +1,8 @@
+---
+'@backstage/backend-common': minor
+'example-app': patch
+'example-backend': patch
+'@backstage/plugin-permission-node': patch
+---
+
+Integrate permission framework into example app
diff --git a/docs/tutorials/backend-to-backend-auth.md b/docs/tutorials/backend-to-backend-auth.md
index 3cb72a4827..07de883172 100644
--- a/docs/tutorials/backend-to-backend-auth.md
+++ b/docs/tutorials/backend-to-backend-auth.md
@@ -22,13 +22,14 @@ resulting value.
 node -p 'require("crypto").randomBytes(24).toString("base64")'
 ```
 
+**NOTE**: For ease of development, we auto-generate a key for you if you haven't
+configured a secret in dev mode. You _must set your own secret_ in order for
+backend-to-backend authentication to work in production.
+
 Requests originating from a backend plugin can be authenticated by decorating
 them with a backend token. Backend tokens can be generated using a
 `TokenManager`, which can be passed to plugin backends via the
-`PluginEnvironment`. The `TokenManager` provided in new Backstage instances
-generated by `create-app` is a stub, which returns empty tokens and accepts any
-input string as valid. To enable backend-to-backend authentication, you'll need
-to instantiate a new one using the secret from your config instead:
+`PluginEnvironment`.
 
 ```diff
 // packages/backend/src/index.ts
@@ -42,8 +43,7 @@ function makeCreateEnv(config: Config) {
 
   const cacheManager = CacheManager.fromConfig(config);
   const databaseManager = DatabaseManager.fromConfig(config);
-- const tokenManager = ServerTokenManager.noop();
-+ const tokenManager = ServerTokenManager.fromConfig(config);
++ const tokenManager = ServerTokenManager.default({ config, logger: root });
 ```
 
 With this `tokenManager`, you can then generate a server token for requests:
diff --git a/plugins/permission-node/api-report.md b/plugins/permission-node/api-report.md
index 5e254d4a36..8e63daca83 100644
--- a/plugins/permission-node/api-report.md
+++ b/plugins/permission-node/api-report.md
@@ -126,9 +126,7 @@ export type PolicyDecision =
     }
   | ConditionalPolicyDecision;
 
-// Warning: (ae-missing-release-tag) "ServerPermissionClient" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
+// @public
 export class ServerPermissionClient extends PermissionClient {
   constructor(options: {
     discoveryApi: DiscoveryApi;
diff --git a/plugins/permission-node/src/ServerPermissionClient.ts b/plugins/permission-node/src/ServerPermissionClient.ts
index 1e54d73808..0ef464c639 100644
--- a/plugins/permission-node/src/ServerPermissionClient.ts
+++ b/plugins/permission-node/src/ServerPermissionClient.ts
@@ -25,6 +25,11 @@ import {
   PermissionClient,
 } from '@backstage/plugin-permission-common';
 
+/**
+ * A server side {@link @backstage/plugin-permission-common#PermissionClient}
+ * that allows all backend-to-backend requests.
+ * @public
+ */
 export class ServerPermissionClient extends PermissionClient {
   private readonly serverTokenManager: ServerTokenManager;