diff --git a/.changeset/blue-dingos-repeat.md b/.changeset/blue-dingos-repeat.md
new file mode 100644
index 0000000000..111a94a00b
--- /dev/null
+++ b/.changeset/blue-dingos-repeat.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Require that audience URLs for Okta authentication start with https
diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts
index 44e26bb7fe..dfffca9da7 100644
--- a/plugins/auth-backend/src/providers/okta/provider.ts
+++ b/plugins/auth-backend/src/providers/okta/provider.ts
@@ -275,6 +275,13 @@ export const createOktaProvider = (
       const audience = envConfig.getString('audience');
       const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
 
+      // This is a safe assumption as `passport-okta-oauth` uses the audience
+      // as the base for building the authorization, token, and user info URLs.
+      // https://github.com/fischerdan/passport-okta-oauth/blob/ea9ac42d/lib/passport-okta-oauth/oauth2.js#L12-L14
+      if (!audience.startsWith('https://')) {
+        throw new Error("URL for 'audience' must start with 'https://'.");
+      }
+
       const catalogIdentityClient = new CatalogIdentityClient({
         catalogApi,
         tokenIssuer,