diff --git a/plugins/auth-react/src/components/AppAuthProvider/AppAuthProvider.test.tsx b/packages/core-app-api/src/app/AppAuthProvider.test.tsx
similarity index 89%
rename from plugins/auth-react/src/components/AppAuthProvider/AppAuthProvider.test.tsx
rename to packages/core-app-api/src/app/AppAuthProvider.test.tsx
index ddf37059f2..2ee0c49f8d 100644
--- a/plugins/auth-react/src/components/AppAuthProvider/AppAuthProvider.test.tsx
+++ b/packages/core-app-api/src/app/AppAuthProvider.test.tsx
@@ -16,7 +16,6 @@
 
 import React from 'react';
 import { render, screen, waitFor } from '@testing-library/react';
-import { componentsApiRef } from '@backstage/frontend-plugin-api';
 import { discoveryApiRef, fetchApiRef } from '@backstage/core-plugin-api';
 import { AppAuthProvider } from './AppAuthProvider';
 
@@ -47,15 +46,12 @@ jest.mock('@backstage/core-plugin-api', () => {
         };
       }
 
-      if (ref === componentsApiRef) {
-        return {
-          getComponent: jest
-            .fn()
-            .mockReturnValue(() => <div data-testid="progress" />),
-        };
-      }
-
-      throw new Error(`Attempted to use an unmocked API reference: ${ref}`);
+      // componentsApiRef
+      return {
+        getComponent: jest
+          .fn()
+          .mockReturnValue(() => <div data-testid="progress" />),
+      };
     }),
   };
 });
diff --git a/plugins/auth-react/src/components/AppAuthProvider/AppAuthProvider.tsx b/packages/core-app-api/src/app/AppAuthProvider.tsx
similarity index 91%
rename from plugins/auth-react/src/components/AppAuthProvider/AppAuthProvider.tsx
rename to packages/core-app-api/src/app/AppAuthProvider.tsx
index dbf8aec3da..8834930ef6 100644
--- a/plugins/auth-react/src/components/AppAuthProvider/AppAuthProvider.tsx
+++ b/packages/core-app-api/src/app/AppAuthProvider.tsx
@@ -18,10 +18,6 @@ import React, { ReactNode } from 'react';
 import { CookieAuthRefreshProvider } from '@backstage/plugin-auth-react';
 import { isProtectedApp } from './isProtectedApp';
 
-/**
- * @public
- * A provider that will protect the app when running in protected experimental mode.
- */
 export function AppAuthProvider(props: { children: ReactNode }): JSX.Element {
   const { children } = props;
 
diff --git a/packages/core-app-api/src/app/AppManager.tsx b/packages/core-app-api/src/app/AppManager.tsx
index 3ad8387bf6..bd51f0046b 100644
--- a/packages/core-app-api/src/app/AppManager.tsx
+++ b/packages/core-app-api/src/app/AppManager.tsx
@@ -88,7 +88,7 @@ import { AppRouter, getBasePath } from './AppRouter';
 import { AppLanguageSelector } from '../apis/implementations/AppLanguageApi';
 import { I18nextTranslationApi } from '../apis/implementations/TranslationApi';
 import { overrideBaseUrlConfigs } from './overrideBaseUrlConfigs';
-import { isProtectedApp } from '@backstage/plugin-auth-react';
+import { isProtectedApp } from './isProtectedApp';
 
 type CompatiblePlugin =
   | BackstagePlugin
diff --git a/packages/core-app-api/src/app/AppRouter.tsx b/packages/core-app-api/src/app/AppRouter.tsx
index b667c03c4f..21704bc26b 100644
--- a/packages/core-app-api/src/app/AppRouter.tsx
+++ b/packages/core-app-api/src/app/AppRouter.tsx
@@ -29,7 +29,7 @@ import { isReactRouterBeta } from './isReactRouterBeta';
 import { RouteTracker } from '../routing/RouteTracker';
 import { Route, Routes } from 'react-router-dom';
 import { AppIdentityProxy } from '../apis/implementations/IdentityApi/AppIdentityProxy';
-import { AppAuthProvider } from '@backstage/plugin-auth-react';
+import { AppAuthProvider } from './AppAuthProvider';
 
 /**
  * Get the app base path from the configured app baseUrl.
diff --git a/plugins/auth-react/src/components/AppAuthProvider/isProtectedApp.tsx b/packages/core-app-api/src/app/isProtectedApp.tsx
similarity index 88%
rename from plugins/auth-react/src/components/AppAuthProvider/isProtectedApp.tsx
rename to packages/core-app-api/src/app/isProtectedApp.tsx
index 575eb59a73..f102989704 100644
--- a/plugins/auth-react/src/components/AppAuthProvider/isProtectedApp.tsx
+++ b/packages/core-app-api/src/app/isProtectedApp.tsx
@@ -14,10 +14,6 @@
  * limitations under the License.
  */
 
-/**
- * @public
- * An utility function that detects whether the app is operating in protected mode.
- */
 export function isProtectedApp() {
   const element = document.querySelector('meta[name="backstage-app-mode"]');
   const appMode = element?.getAttribute('content') ?? 'public';
diff --git a/packages/frontend-app-api/src/extensions/AppRoot.tsx b/packages/frontend-app-api/src/extensions/AppRoot.tsx
index 2822ebeb3e..db8de268b0 100644
--- a/packages/frontend-app-api/src/extensions/AppRoot.tsx
+++ b/packages/frontend-app-api/src/extensions/AppRoot.tsx
@@ -38,11 +38,12 @@ import {
 } from '@backstage/core-plugin-api';
 import { InternalAppContext } from '../wiring/InternalAppContext';
 // eslint-disable-next-line @backstage/no-relative-monorepo-imports
+import { AppAuthProvider } from '../../../core-app-api/src/app/AppAuthProvider';
+// eslint-disable-next-line @backstage/no-relative-monorepo-imports
 import { AppIdentityProxy } from '../../../core-app-api/src/apis/implementations/IdentityApi/AppIdentityProxy';
 import { BrowserRouter } from 'react-router-dom';
 import { RouteTracker } from '../routing/RouteTracker';
 import { getBasePath } from '../routing/getBasePath';
-import { AppAuthProvider } from '@backstage/plugin-auth-react';
 
 export const AppRoot = createExtension({
   namespace: 'app',
diff --git a/plugins/auth-react/api-report.md b/plugins/auth-react/api-report.md
index b76bc6973e..a5295e54ff 100644
--- a/plugins/auth-react/api-report.md
+++ b/plugins/auth-react/api-report.md
@@ -6,9 +6,6 @@
 import { default as React_2 } from 'react';
 import { ReactNode } from 'react';
 
-// @public
-export function AppAuthProvider(props: { children: ReactNode }): JSX.Element;
-
 // @public
 export function CookieAuthRedirect(): React_2.JSX.Element | null;
 
@@ -24,9 +21,6 @@ export type CookieAuthRefreshProviderProps = {
   children: ReactNode;
 };
 
-// @public
-export function isProtectedApp(): boolean;
-
 // @public
 export function useCookieAuthRefresh(options: {
   pluginId: string;
diff --git a/plugins/auth-react/src/components/AppAuthProvider/index.ts b/plugins/auth-react/src/components/AppAuthProvider/index.ts
deleted file mode 100644
index c1515cad7f..0000000000
--- a/plugins/auth-react/src/components/AppAuthProvider/index.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright 2024 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-export { isProtectedApp } from './isProtectedApp';
-export { AppAuthProvider } from './AppAuthProvider';
diff --git a/plugins/auth-react/src/components/index.ts b/plugins/auth-react/src/components/index.ts
index 9ab41560f1..928abb0cb5 100644
--- a/plugins/auth-react/src/components/index.ts
+++ b/plugins/auth-react/src/components/index.ts
@@ -17,6 +17,5 @@
 // The index file in ./components/ is typically responsible for selecting
 // which components are public API and should be exported from the package.
 
-export * from './AppAuthProvider';
 export * from './CookieAuthRedirect';
 export * from './CookieAuthRefreshProvider';