diff --git a/.changeset/slimy-spiders-pull.md b/.changeset/slimy-spiders-pull.md
new file mode 100644
index 0000000000..12bd0e23e4
--- /dev/null
+++ b/.changeset/slimy-spiders-pull.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Add warning about backend APIs not having auth by default
diff --git a/docs/auth/index.md b/docs/auth/index.md
index b2aac47e2a..6f3250559c 100644
--- a/docs/auth/index.md
+++ b/docs/auth/index.md
@@ -10,6 +10,8 @@ configure Backstage to have any number of authentication providers, but only
 one of these will typically be used for sign-in, with the rest being used to provide
 access external resources.
 
+> Note: Backstage backend APIs are by default unauthenticated. Thus, if your Backstage instance is exposed to the Internet, anyone can access information in the Backstage. If you would like to learn more, read about how to [authenticate API requests"](https://github.com/backstage/backstage/blob/master/contrib/docs/tutorials/authenticate-api-requests.md).
+
 ## Built-in Authentication Providers
 
 Backstage comes with many common authentication providers in the core library:
diff --git a/docs/permissions/getting-started.md b/docs/permissions/getting-started.md
index 01a268f7ef..0d542a6502 100644
--- a/docs/permissions/getting-started.md
+++ b/docs/permissions/getting-started.md
@@ -36,7 +36,7 @@ Like many other parts of Backstage, the permissions framework relies on informat
 
 ## Optionally add cookie-based authentication
 
-Asset requests initiated by the browser will not include a token in the `Authorization` header. If these requests check authorization through the permission framework, as done in plugins like TechDocs, then you'll need to set up cookie-based authentication. Refer to the ["Authenticate API requests"](https://github.com/backstage/backstage/blob/master/contrib/docs/tutorials/authenticate-api-requests.md) tutorial for a demonstration on how to implement this behavior.
+Frontend requests initiated by the browser will not include a token in the `Authorization` header. If these requests check authorization through the permission framework, as done in plugins like TechDocs, then you'll need to set up cookie-based authentication. Refer to the ["Authenticate API requests"](https://github.com/backstage/backstage/blob/master/contrib/docs/tutorials/authenticate-api-requests.md) tutorial for a demonstration on how to implement this behavior.
 
 ## Integrating the permission framework with your Backstage instance