diff --git a/plugins/auth-backend-module-gcp-iap-provider/api-report.md b/plugins/auth-backend-module-gcp-iap-provider/api-report.md
new file mode 100644
index 0000000000..02b77cea36
--- /dev/null
+++ b/plugins/auth-backend-module-gcp-iap-provider/api-report.md
@@ -0,0 +1,46 @@
+## API Report File for "@backstage/plugin-auth-backend-module-gcp-iap-provider"
+
+> Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).
+
+```ts
+import { BackendFeature } from '@backstage/backend-plugin-api';
+import { JsonPrimitive } from '@backstage/types';
+import { ProxyAuthenticator } from '@backstage/plugin-auth-node';
+import { SignInResolverFactory } from '@backstage/plugin-auth-node';
+
+// @public (undocumented)
+export const authModuleGcpIapProvider: () => BackendFeature;
+
+// @public (undocumented)
+export const gcpIapAuthenticator: ProxyAuthenticator<
+  {
+    jwtHeader: string;
+    tokenValidator: (token: string) => Promise<GcpIapTokenInfo>;
+  },
+  {
+    iapToken: GcpIapTokenInfo;
+  }
+>;
+
+// @public
+export type GcpIapResult = {
+  iapToken: GcpIapTokenInfo;
+};
+
+// @public
+export namespace gcpIapSignInResolvers {
+  const emailMatchingUserEntityAnnotation: SignInResolverFactory<
+    GcpIapResult,
+    unknown
+  >;
+}
+
+// @public
+export type GcpIapTokenInfo = {
+  sub: string;
+  email: string;
+  [key: string]: JsonPrimitive;
+};
+
+// (No @packageDocumentation comment for this package)
+```
diff --git a/plugins/auth-backend-module-google-provider/api-report.md b/plugins/auth-backend-module-google-provider/api-report.md
new file mode 100644
index 0000000000..8040c44832
--- /dev/null
+++ b/plugins/auth-backend-module-google-provider/api-report.md
@@ -0,0 +1,31 @@
+## API Report File for "@backstage/plugin-auth-backend-module-google-provider"
+
+> Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).
+
+```ts
+import { BackendFeature } from '@backstage/backend-plugin-api';
+import { OAuthAuthenticator } from '@backstage/plugin-auth-node';
+import { OAuthAuthenticatorResult } from '@backstage/plugin-auth-node';
+import { PassportOAuthAuthenticatorHelper } from '@backstage/plugin-auth-node';
+import { PassportProfile } from '@backstage/plugin-auth-node';
+import { SignInResolverFactory } from '@backstage/plugin-auth-node';
+
+// @public (undocumented)
+export const authModuleGoogleProvider: () => BackendFeature;
+
+// @public (undocumented)
+export const googleAuthenticator: OAuthAuthenticator<
+  PassportOAuthAuthenticatorHelper,
+  PassportProfile
+>;
+
+// @public
+export namespace googleSignInResolvers {
+  const emailMatchingUserEntityAnnotation: SignInResolverFactory<
+    OAuthAuthenticatorResult<PassportProfile>,
+    unknown
+  >;
+}
+
+// (No @packageDocumentation comment for this package)
+```
diff --git a/plugins/auth-backend/api-report.md b/plugins/auth-backend/api-report.md
index 80db2e0b71..188cca75e0 100644
--- a/plugins/auth-backend/api-report.md
+++ b/plugins/auth-backend/api-report.md
@@ -5,24 +5,40 @@
 ```ts
 /// <reference types="node" />
 
-import { BackstageIdentityResponse } from '@backstage/plugin-auth-node';
+import { AuthProviderConfig as AuthProviderConfig_2 } from '@backstage/plugin-auth-node';
+import { AuthProviderFactory as AuthProviderFactory_2 } from '@backstage/plugin-auth-node';
+import { AuthProviderRouteHandlers as AuthProviderRouteHandlers_2 } from '@backstage/plugin-auth-node';
+import { AuthResolverCatalogUserQuery as AuthResolverCatalogUserQuery_2 } from '@backstage/plugin-auth-node';
+import { AuthResolverContext as AuthResolverContext_2 } from '@backstage/plugin-auth-node';
 import { BackstageSignInResult } from '@backstage/plugin-auth-node';
 import { CacheService } from '@backstage/backend-plugin-api';
 import { CatalogApi } from '@backstage/catalog-client';
+import { ClientAuthResponse } from '@backstage/plugin-auth-node';
 import { Config } from '@backstage/config';
+import { CookieConfigurer as CookieConfigurer_2 } from '@backstage/plugin-auth-node';
+import { decodeOAuthState } from '@backstage/plugin-auth-node';
+import { encodeOAuthState } from '@backstage/plugin-auth-node';
 import { Entity } from '@backstage/catalog-model';
 import express from 'express';
-import { GetEntitiesRequest } from '@backstage/catalog-client';
+import { GcpIapResult as GcpIapResult_2 } from '@backstage/plugin-auth-backend-module-gcp-iap-provider';
+import { GcpIapTokenInfo as GcpIapTokenInfo_2 } from '@backstage/plugin-auth-backend-module-gcp-iap-provider';
 import { IncomingHttpHeaders } from 'http';
-import { JsonValue } from '@backstage/types';
-import { Logger } from 'winston';
+import { LoggerService } from '@backstage/backend-plugin-api';
+import { OAuthEnvironmentHandler as OAuthEnvironmentHandler_2 } from '@backstage/plugin-auth-node';
+import { OAuthState as OAuthState_2 } from '@backstage/plugin-auth-node';
 import { PluginDatabaseManager } from '@backstage/backend-common';
 import { PluginEndpointDiscovery } from '@backstage/backend-common';
+import { prepareBackstageIdentityResponse as prepareBackstageIdentityResponse_2 } from '@backstage/plugin-auth-node';
 import { Profile } from 'passport';
+import { ProfileInfo as ProfileInfo_2 } from '@backstage/plugin-auth-node';
+import { SignInInfo as SignInInfo_2 } from '@backstage/plugin-auth-node';
+import { SignInResolver as SignInResolver_2 } from '@backstage/plugin-auth-node';
 import { TokenManager } from '@backstage/backend-common';
+import { TokenParams as TokenParams_2 } from '@backstage/plugin-auth-node';
 import { TokenSet } from 'openid-client';
 import { UserEntity } from '@backstage/catalog-model';
 import { UserinfoResponse } from 'openid-client';
+import { WebMessageResponse as WebMessageResponse_2 } from '@backstage/plugin-auth-node';
 
 // @public
 export type AuthHandler<TAuthResult> = (
@@ -35,68 +51,23 @@ export type AuthHandlerResult = {
   profile: ProfileInfo;
 };
 
-// @public (undocumented)
-export type AuthProviderConfig = {
-  baseUrl: string;
-  appUrl: string;
-  isOriginAllowed: (origin: string) => boolean;
-  cookieConfigurer?: CookieConfigurer;
-};
+// @public @deprecated (undocumented)
+export type AuthProviderConfig = AuthProviderConfig_2;
 
-// @public (undocumented)
-export type AuthProviderFactory = (options: {
-  providerId: string;
-  globalConfig: AuthProviderConfig;
-  config: Config;
-  logger: Logger;
-  resolverContext: AuthResolverContext;
-}) => AuthProviderRouteHandlers;
+// @public @deprecated (undocumented)
+export type AuthProviderFactory = AuthProviderFactory_2;
 
-// @public
-export interface AuthProviderRouteHandlers {
-  frameHandler(req: express.Request, res: express.Response): Promise<void>;
-  logout?(req: express.Request, res: express.Response): Promise<void>;
-  refresh?(req: express.Request, res: express.Response): Promise<void>;
-  start(req: express.Request, res: express.Response): Promise<void>;
-}
+// @public @deprecated (undocumented)
+export type AuthProviderRouteHandlers = AuthProviderRouteHandlers_2;
 
-// @public
-export type AuthResolverCatalogUserQuery =
-  | {
-      entityRef:
-        | string
-        | {
-            kind?: string;
-            namespace?: string;
-            name: string;
-          };
-    }
-  | {
-      annotations: Record<string, string>;
-    }
-  | {
-      filter: Exclude<GetEntitiesRequest['filter'], undefined>;
-    };
+// @public @deprecated (undocumented)
+export type AuthResolverCatalogUserQuery = AuthResolverCatalogUserQuery_2;
 
-// @public
-export type AuthResolverContext = {
-  issueToken(params: TokenParams): Promise<{
-    token: string;
-  }>;
-  findCatalogUser(query: AuthResolverCatalogUserQuery): Promise<{
-    entity: Entity;
-  }>;
-  signInWithCatalogUser(
-    query: AuthResolverCatalogUserQuery,
-  ): Promise<BackstageSignInResult>;
-};
+// @public @deprecated (undocumented)
+export type AuthResolverContext = AuthResolverContext_2;
 
-// @public (undocumented)
-export type AuthResponse<ProviderInfo> = {
-  providerInfo: ProviderInfo;
-  profile: ProfileInfo;
-  backstageIdentity?: BackstageIdentityResponse;
-};
+// @public @deprecated (undocumented)
+export type AuthResponse<TProviderInfo> = ClientAuthResponse<TProviderInfo>;
 
 // @public (undocumented)
 export type AwsAlbResult = {
@@ -151,7 +122,7 @@ export class CatalogIdentityClient {
   findUser(query: { annotations: Record<string, string> }): Promise<UserEntity>;
   resolveCatalogMembership(query: {
     entityRefs: string[];
-    logger?: Logger;
+    logger?: LoggerService;
   }): Promise<string[]>;
 }
 
@@ -191,18 +162,8 @@ export type CloudflareAccessResult = {
   token: string;
 };
 
-// @public
-export type CookieConfigurer = (ctx: {
-  providerId: string;
-  baseUrl: string;
-  callbackUrl: string;
-  appOrigin: string;
-}) => {
-  domain: string;
-  path: string;
-  secure: boolean;
-  sameSite?: 'none' | 'lax' | 'strict';
-};
+// @public @deprecated (undocumented)
+export type CookieConfigurer = CookieConfigurer_2;
 
 // @public
 export function createAuthProviderIntegration<
@@ -235,23 +196,17 @@ export type EasyAuthResult = {
   accessToken?: string;
 };
 
-// @public (undocumented)
-export const encodeState: (state: OAuthState) => string;
+// @public @deprecated (undocumented)
+export const encodeState: typeof encodeOAuthState;
 
-// @public (undocumented)
+// @public @deprecated (undocumented)
 export const ensuresXRequestedWith: (req: express.Request) => boolean;
 
-// @public
-export type GcpIapResult = {
-  iapToken: GcpIapTokenInfo;
-};
+// @public @deprecated
+export type GcpIapResult = GcpIapResult_2;
 
-// @public
-export type GcpIapTokenInfo = {
-  sub: string;
-  email: string;
-  [key: string]: JsonValue;
-};
+// @public @deprecated
+export type GcpIapTokenInfo = GcpIapTokenInfo_2;
 
 // @public
 export function getDefaultOwnershipEntityRefs(entity: Entity): string[];
@@ -276,7 +231,7 @@ export type OAuth2ProxyResult<JWTPayload = {}> = {
   getHeader(name: string): string | undefined;
 };
 
-// @public (undocumented)
+// @public @deprecated (undocumented)
 export class OAuthAdapter implements AuthProviderRouteHandlers {
   constructor(handlers: OAuthHandlers, options: OAuthAdapterOptions);
   // (undocumented)
@@ -298,7 +253,7 @@ export class OAuthAdapter implements AuthProviderRouteHandlers {
   start(req: express.Request, res: express.Response): Promise<void>;
 }
 
-// @public (undocumented)
+// @public @deprecated (undocumented)
 export type OAuthAdapterOptions = {
   providerId: string;
   persistScopes?: boolean;
@@ -309,25 +264,10 @@ export type OAuthAdapterOptions = {
   callbackUrl: string;
 };
 
-// @public (undocumented)
-export class OAuthEnvironmentHandler implements AuthProviderRouteHandlers {
-  constructor(handlers: Map<string, AuthProviderRouteHandlers>);
-  // (undocumented)
-  frameHandler(req: express.Request, res: express.Response): Promise<void>;
-  // (undocumented)
-  logout(req: express.Request, res: express.Response): Promise<void>;
-  // (undocumented)
-  static mapConfig(
-    config: Config,
-    factoryFunc: (envConfig: Config) => AuthProviderRouteHandlers,
-  ): OAuthEnvironmentHandler;
-  // (undocumented)
-  refresh(req: express.Request, res: express.Response): Promise<void>;
-  // (undocumented)
-  start(req: express.Request, res: express.Response): Promise<void>;
-}
+// @public @deprecated (undocumented)
+export const OAuthEnvironmentHandler: typeof OAuthEnvironmentHandler_2;
 
-// @public
+// @public @deprecated (undocumented)
 export interface OAuthHandlers {
   handler(req: express.Request): Promise<{
     response: OAuthResponse;
@@ -341,7 +281,7 @@ export interface OAuthHandlers {
   start(req: OAuthStartRequest): Promise<OAuthStartResponse>;
 }
 
-// @public (undocumented)
+// @public @deprecated (undocumented)
 export type OAuthLogoutRequest = express.Request<{}> & {
   refreshToken: string;
 };
@@ -354,39 +294,40 @@ export type OAuthProviderInfo = {
   scope: string;
 };
 
-// @public
+// @public @deprecated
 export type OAuthProviderOptions = {
   clientId: string;
   clientSecret: string;
   callbackUrl: string;
 };
 
-// @public (undocumented)
+// @public @deprecated (undocumented)
 export type OAuthRefreshRequest = express.Request<{}> & {
   scope: string;
   refreshToken: string;
 };
 
-// @public
+// @public @deprecated (undocumented)
 export type OAuthResponse = {
   profile: ProfileInfo;
   providerInfo: OAuthProviderInfo;
   backstageIdentity?: BackstageSignInResult;
 };
 
-// @public (undocumented)
+// @public @deprecated (undocumented)
 export type OAuthResult = {
   fullProfile: Profile;
   params: {
     id_token?: string;
     scope: string;
+    token_type?: string;
     expires_in: number;
   };
   accessToken: string;
   refreshToken?: string;
 };
 
-// @public (undocumented)
+// @public @deprecated (undocumented)
 export type OAuthStartRequest = express.Request<{}> & {
   scope: string;
   state: OAuthState;
@@ -398,15 +339,8 @@ export type OAuthStartResponse = {
   status?: number;
 };
 
-// @public (undocumented)
-export type OAuthState = {
-  nonce: string;
-  env: string;
-  origin?: string;
-  scope?: string;
-  redirectUrl?: string;
-  flow?: string;
-};
+// @public @deprecated (undocumented)
+export type OAuthState = OAuthState_2;
 
 // @public
 export type OidcAuthResult = {
@@ -414,24 +348,18 @@ export type OidcAuthResult = {
   userinfo: UserinfoResponse;
 };
 
-// @public (undocumented)
+// @public @deprecated (undocumented)
 export const postMessageResponse: (
   res: express.Response,
   appOrigin: string,
   response: WebMessageResponse,
 ) => void;
 
-// @public
-export function prepareBackstageIdentityResponse(
-  result: BackstageSignInResult,
-): BackstageIdentityResponse;
+// @public @deprecated (undocumented)
+export const prepareBackstageIdentityResponse: typeof prepareBackstageIdentityResponse_2;
 
-// @public
-export type ProfileInfo = {
-  email?: string;
-  displayName?: string;
-  picture?: string;
-};
+// @public @deprecated (undocumented)
+export type ProfileInfo = ProfileInfo_2;
 
 // @public (undocumented)
 export type ProviderFactories = {
@@ -452,7 +380,7 @@ export const providers: Readonly<{
               | undefined;
           }
         | undefined,
-    ) => AuthProviderFactory;
+    ) => AuthProviderFactory_2;
     resolvers: never;
   }>;
   auth0: Readonly<{
@@ -467,7 +395,7 @@ export const providers: Readonly<{
               | undefined;
           }
         | undefined,
-    ) => AuthProviderFactory;
+    ) => AuthProviderFactory_2;
     resolvers: never;
   }>;
   awsAlb: Readonly<{
@@ -480,7 +408,7 @@ export const providers: Readonly<{
             };
           }
         | undefined,
-    ) => AuthProviderFactory;
+    ) => AuthProviderFactory_2;
     resolvers: never;
   }>;
   bitbucket: Readonly<{
@@ -495,7 +423,7 @@ export const providers: Readonly<{
               | undefined;
           }
         | undefined,
-    ) => AuthProviderFactory;
+    ) => AuthProviderFactory_2;
     resolvers: Readonly<{
       usernameMatchingUserEntityAnnotation(): SignInResolver<OAuthResult>;
       userIdMatchingUserEntityAnnotation(): SignInResolver<OAuthResult>;
@@ -513,7 +441,7 @@ export const providers: Readonly<{
               | undefined;
           }
         | undefined,
-    ) => AuthProviderFactory;
+    ) => AuthProviderFactory_2;
     resolvers: Readonly<{
       emailMatchingUserEntityProfileEmail: () => SignInResolver<BitbucketServerOAuthResult>;
     }>;
@@ -525,18 +453,18 @@ export const providers: Readonly<{
         resolver: SignInResolver<CloudflareAccessResult>;
       };
       cache?: CacheService | undefined;
-    }) => AuthProviderFactory;
+    }) => AuthProviderFactory_2;
     resolvers: Readonly<{
       emailMatchingUserEntityProfileEmail: () => SignInResolver<unknown>;
     }>;
   }>;
   gcpIap: Readonly<{
     create: (options: {
-      authHandler?: AuthHandler<GcpIapResult> | undefined;
+      authHandler?: AuthHandler<GcpIapResult_2> | undefined;
       signIn: {
-        resolver: SignInResolver<GcpIapResult>;
+        resolver: SignInResolver<GcpIapResult_2>;
       };
-    }) => AuthProviderFactory;
+    }) => AuthProviderFactory_2;
     resolvers: never;
   }>;
   github: Readonly<{
@@ -552,7 +480,7 @@ export const providers: Readonly<{
             stateEncoder?: StateEncoder | undefined;
           }
         | undefined,
-    ) => AuthProviderFactory;
+    ) => AuthProviderFactory_2;
     resolvers: Readonly<{
       usernameMatchingUserEntityName: () => SignInResolver<GithubOAuthResult>;
     }>;
@@ -569,7 +497,7 @@ export const providers: Readonly<{
               | undefined;
           }
         | undefined,
-    ) => AuthProviderFactory;
+    ) => AuthProviderFactory_2;
     resolvers: never;
   }>;
   google: Readonly<{
@@ -584,11 +512,11 @@ export const providers: Readonly<{
               | undefined;
           }
         | undefined,
-    ) => AuthProviderFactory;
+    ) => AuthProviderFactory_2;
     resolvers: Readonly<{
-      emailLocalPartMatchingUserEntityName: () => SignInResolver<unknown>;
-      emailMatchingUserEntityProfileEmail: () => SignInResolver<unknown>;
-      emailMatchingUserEntityAnnotation(): SignInResolver<OAuthResult>;
+      emailMatchingUserEntityProfileEmail: () => SignInResolver_2<OAuthResult>;
+      emailLocalPartMatchingUserEntityName: () => SignInResolver_2<OAuthResult>;
+      emailMatchingUserEntityAnnotation: () => SignInResolver_2<OAuthResult>;
     }>;
   }>;
   microsoft: Readonly<{
@@ -603,7 +531,7 @@ export const providers: Readonly<{
               | undefined;
           }
         | undefined,
-    ) => AuthProviderFactory;
+    ) => AuthProviderFactory_2;
     resolvers: Readonly<{
       emailLocalPartMatchingUserEntityName: () => SignInResolver<unknown>;
       emailMatchingUserEntityProfileEmail: () => SignInResolver<unknown>;
@@ -622,7 +550,7 @@ export const providers: Readonly<{
               | undefined;
           }
         | undefined,
-    ) => AuthProviderFactory;
+    ) => AuthProviderFactory_2;
     resolvers: never;
   }>;
   oauth2Proxy: Readonly<{
@@ -631,7 +559,7 @@ export const providers: Readonly<{
       signIn: {
         resolver: SignInResolver<OAuth2ProxyResult<unknown>>;
       };
-    }) => AuthProviderFactory;
+    }) => AuthProviderFactory_2;
     resolvers: never;
   }>;
   oidc: Readonly<{
@@ -646,7 +574,7 @@ export const providers: Readonly<{
               | undefined;
           }
         | undefined,
-    ) => AuthProviderFactory;
+    ) => AuthProviderFactory_2;
     resolvers: Readonly<{
       emailLocalPartMatchingUserEntityName: () => SignInResolver<unknown>;
       emailMatchingUserEntityProfileEmail: () => SignInResolver<unknown>;
@@ -664,7 +592,7 @@ export const providers: Readonly<{
               | undefined;
           }
         | undefined,
-    ) => AuthProviderFactory;
+    ) => AuthProviderFactory_2;
     resolvers: Readonly<{
       emailLocalPartMatchingUserEntityName: () => SignInResolver<unknown>;
       emailMatchingUserEntityProfileEmail: () => SignInResolver<unknown>;
@@ -683,7 +611,7 @@ export const providers: Readonly<{
               | undefined;
           }
         | undefined,
-    ) => AuthProviderFactory;
+    ) => AuthProviderFactory_2;
     resolvers: never;
   }>;
   saml: Readonly<{
@@ -698,7 +626,7 @@ export const providers: Readonly<{
               | undefined;
           }
         | undefined,
-    ) => AuthProviderFactory;
+    ) => AuthProviderFactory_2;
     resolvers: Readonly<{
       nameIdMatchingUserEntityName(): SignInResolver<SamlAuthResult>;
     }>;
@@ -713,13 +641,13 @@ export const providers: Readonly<{
             };
           }
         | undefined,
-    ) => AuthProviderFactory;
+    ) => AuthProviderFactory_2;
     resolvers: never;
   }>;
 }>;
 
-// @public (undocumented)
-export const readState: (stateString: string) => OAuthState;
+// @public @deprecated (undocumented)
+export const readState: typeof decodeOAuthState;
 
 // @public (undocumented)
 export interface RouterOptions {
@@ -732,7 +660,7 @@ export interface RouterOptions {
   // (undocumented)
   discovery: PluginEndpointDiscovery;
   // (undocumented)
-  logger: Logger;
+  logger: LoggerService;
   // (undocumented)
   providerFactories?: ProviderFactories;
   // (undocumented)
@@ -746,42 +674,23 @@ export type SamlAuthResult = {
   fullProfile: any;
 };
 
-// @public
-export type SignInInfo<TAuthResult> = {
-  profile: ProfileInfo;
-  result: TAuthResult;
-};
+// @public @deprecated (undocumented)
+export type SignInInfo<TAuthResult> = SignInInfo_2<TAuthResult>;
 
-// @public
-export type SignInResolver<TAuthResult> = (
-  info: SignInInfo<TAuthResult>,
-  context: AuthResolverContext,
-) => Promise<BackstageSignInResult>;
+// @public @deprecated (undocumented)
+export type SignInResolver<TAuthResult> = SignInResolver_2<TAuthResult>;
 
 // @public (undocumented)
 export type StateEncoder = (req: OAuthStartRequest) => Promise<{
   encodedState: string;
 }>;
 
-// @public
-export type TokenParams = {
-  claims: {
-    sub: string;
-    ent?: string[];
-  } & Record<string, JsonValue>;
-};
+// @public @deprecated (undocumented)
+export type TokenParams = TokenParams_2;
 
-// @public (undocumented)
+// @public @deprecated (undocumented)
 export const verifyNonce: (req: express.Request, providerId: string) => void;
 
-// @public
-export type WebMessageResponse =
-  | {
-      type: 'authorization_response';
-      response: AuthResponse<unknown>;
-    }
-  | {
-      type: 'authorization_response';
-      error: Error;
-    };
+// @public @deprecated (undocumented)
+export type WebMessageResponse = WebMessageResponse_2;
 ```
diff --git a/plugins/auth-node/api-report.md b/plugins/auth-node/api-report.md
index bc9e392929..4a384834d6 100644
--- a/plugins/auth-node/api-report.md
+++ b/plugins/auth-node/api-report.md
@@ -3,8 +3,100 @@
 > Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).
 
 ```ts
+import { BackstageIdentityResponse as BackstageIdentityResponse_2 } from '@backstage/plugin-auth-node';
+import { BackstageSignInResult as BackstageSignInResult_2 } from '@backstage/plugin-auth-node';
+import { Config } from '@backstage/config';
+import { Entity } from '@backstage/catalog-model';
+import { EntityFilterQuery } from '@backstage/catalog-client';
+import express from 'express';
+import { ExtensionPoint } from '@backstage/backend-plugin-api';
+import { JsonObject } from '@backstage/types';
+import { JsonValue } from '@backstage/types';
+import { LoggerService } from '@backstage/backend-plugin-api';
 import { PluginEndpointDiscovery } from '@backstage/backend-common';
+import { Profile } from 'passport';
 import { Request as Request_2 } from 'express';
+import { Response as Response_2 } from 'express';
+import { Strategy } from 'passport';
+import { ZodSchema } from 'zod';
+import { ZodTypeDef } from 'zod';
+
+// @public @deprecated (undocumented)
+export type AuthProviderConfig = {
+  baseUrl: string;
+  appUrl: string;
+  isOriginAllowed: (origin: string) => boolean;
+  cookieConfigurer?: CookieConfigurer;
+};
+
+// @public (undocumented)
+export type AuthProviderFactory = (options: {
+  providerId: string;
+  globalConfig: AuthProviderConfig;
+  config: Config;
+  logger: LoggerService;
+  resolverContext: AuthResolverContext;
+  baseUrl: string;
+  appUrl: string;
+  isOriginAllowed: (origin: string) => boolean;
+  cookieConfigurer?: CookieConfigurer;
+}) => AuthProviderRouteHandlers;
+
+// @public (undocumented)
+export interface AuthProviderRegistrationOptions {
+  // (undocumented)
+  factory: AuthProviderFactory;
+  // (undocumented)
+  providerId: string;
+}
+
+// @public
+export interface AuthProviderRouteHandlers {
+  frameHandler(req: Request_2, res: Response_2): Promise<void>;
+  logout?(req: Request_2, res: Response_2): Promise<void>;
+  refresh?(req: Request_2, res: Response_2): Promise<void>;
+  start(req: Request_2, res: Response_2): Promise<void>;
+}
+
+// @public (undocumented)
+export interface AuthProvidersExtensionPoint {
+  // (undocumented)
+  registerProvider(options: AuthProviderRegistrationOptions): void;
+}
+
+// @public (undocumented)
+export const authProvidersExtensionPoint: ExtensionPoint<AuthProvidersExtensionPoint>;
+
+// @public
+export type AuthResolverCatalogUserQuery =
+  | {
+      entityRef:
+        | string
+        | {
+            kind?: string;
+            namespace?: string;
+            name: string;
+          };
+    }
+  | {
+      annotations: Record<string, string>;
+    }
+  | {
+      filter: EntityFilterQuery;
+    };
+
+// @public
+export type AuthResolverContext = {
+  issueToken(params: TokenParams): Promise<{
+    token: string;
+  }>;
+  findCatalogUser(query: AuthResolverCatalogUserQuery): Promise<{
+    entity: Entity;
+  }>;
+  signInWithCatalogUser(
+    query: AuthResolverCatalogUserQuery,
+  ): Promise<BackstageSignInResult>;
+};
 
 // @public
 export interface BackstageIdentityResponse extends BackstageSignInResult {
@@ -23,6 +115,99 @@ export type BackstageUserIdentity = {
   ownershipEntityRefs: string[];
 };
 
+// @public (undocumented)
+export type ClientAuthResponse<TProviderInfo> = {
+  providerInfo: TProviderInfo;
+  profile: ProfileInfo;
+  backstageIdentity?: BackstageIdentityResponse;
+};
+
+// @public
+export namespace commonSignInResolvers {
+  const emailMatchingUserEntityProfileEmail: SignInResolverFactory<
+    unknown,
+    unknown
+  >;
+  const emailLocalPartMatchingUserEntityName: SignInResolverFactory<
+    unknown,
+    unknown
+  >;
+}
+
+// @public
+export type CookieConfigurer = (ctx: {
+  providerId: string;
+  baseUrl: string;
+  callbackUrl: string;
+  appOrigin: string;
+}) => {
+  domain: string;
+  path: string;
+  secure: boolean;
+  sameSite?: 'none' | 'lax' | 'strict';
+};
+
+// @public (undocumented)
+export function createOAuthAuthenticator<TContext, TProfile>(
+  authenticator: OAuthAuthenticator<TContext, TProfile>,
+): OAuthAuthenticator<TContext, TProfile>;
+
+// @public (undocumented)
+export function createOAuthProviderFactory<TProfile>(options: {
+  authenticator: OAuthAuthenticator<unknown, TProfile>;
+  stateTransform?: OAuthStateTransform;
+  profileTransform?: ProfileTransform<OAuthAuthenticatorResult<TProfile>>;
+  signInResolver?: SignInResolver<OAuthAuthenticatorResult<TProfile>>;
+  signInResolverFactories?: {
+    [name in string]: SignInResolverFactory<
+      OAuthAuthenticatorResult<TProfile>,
+      unknown
+    >;
+  };
+}): AuthProviderFactory;
+
+// @public (undocumented)
+export function createOAuthRouteHandlers<TProfile>(
+  options: OAuthRouteHandlersOptions<TProfile>,
+): AuthProviderRouteHandlers;
+
+// @public (undocumented)
+export function createProxyAuthenticator<TContext, TResult>(
+  authenticator: ProxyAuthenticator<TContext, TResult>,
+): ProxyAuthenticator<TContext, TResult>;
+
+// @public (undocumented)
+export function createProxyAuthProviderFactory<TResult>(options: {
+  authenticator: ProxyAuthenticator<unknown, TResult>;
+  profileTransform?: ProfileTransform<TResult>;
+  signInResolver?: SignInResolver<TResult>;
+  signInResolverFactories?: Record<
+    string,
+    SignInResolverFactory<TResult, unknown>
+  >;
+}): AuthProviderFactory;
+
+// @public (undocumented)
+export function createProxyAuthRouteHandlers<TResult>(
+  options: ProxyAuthRouteHandlersOptions<TResult>,
+): AuthProviderRouteHandlers;
+
+// @public (undocumented)
+export function createSignInResolverFactory<
+  TAuthResult,
+  TOptionsOutput,
+  TOptionsInput,
+>(
+  options: SignInResolverFactoryOptions<
+    TAuthResult,
+    TOptionsOutput,
+    TOptionsInput
+  >,
+): SignInResolverFactory<TAuthResult, TOptionsInput>;
+
+// @public (undocumented)
+export function decodeOAuthState(encodedState: string): OAuthState;
+
 // @public
 export class DefaultIdentityClient implements IdentityApi {
   // @deprecated
@@ -34,6 +219,9 @@ export class DefaultIdentityClient implements IdentityApi {
   ): Promise<BackstageIdentityResponse | undefined>;
 }
 
+// @public (undocumented)
+export function encodeOAuthState(state: OAuthState): string;
+
 // @public
 export function getBearerTokenFromAuthorizationHeader(
   authorizationHeader: unknown,
@@ -65,4 +253,391 @@ export type IdentityClientOptions = {
   issuer?: string;
   algorithms?: string[];
 };
+
+// @public (undocumented)
+export interface OAuthAuthenticator<TContext, TProfile> {
+  // (undocumented)
+  authenticate(
+    input: OAuthAuthenticatorAuthenticateInput,
+    ctx: TContext,
+  ): Promise<OAuthAuthenticatorResult<TProfile>>;
+  // (undocumented)
+  defaultProfileTransform: ProfileTransform<OAuthAuthenticatorResult<TProfile>>;
+  // (undocumented)
+  initialize(ctx: { callbackUrl: string; config: Config }): TContext;
+  // (undocumented)
+  logout?(input: OAuthAuthenticatorLogoutInput, ctx: TContext): Promise<void>;
+  // (undocumented)
+  refresh(
+    input: OAuthAuthenticatorRefreshInput,
+    ctx: TContext,
+  ): Promise<OAuthAuthenticatorResult<TProfile>>;
+  // (undocumented)
+  shouldPersistScopes?: boolean;
+  // (undocumented)
+  start(
+    input: OAuthAuthenticatorStartInput,
+    ctx: TContext,
+  ): Promise<{
+    url: string;
+    status?: number;
+  }>;
+}
+
+// @public (undocumented)
+export interface OAuthAuthenticatorAuthenticateInput {
+  // (undocumented)
+  req: Request_2;
+}
+
+// @public (undocumented)
+export interface OAuthAuthenticatorLogoutInput {
+  // (undocumented)
+  accessToken?: string;
+  // (undocumented)
+  refreshToken?: string;
+  // (undocumented)
+  req: Request_2;
+}
+
+// @public (undocumented)
+export interface OAuthAuthenticatorRefreshInput {
+  // (undocumented)
+  refreshToken: string;
+  // (undocumented)
+  req: Request_2;
+  // (undocumented)
+  scope: string;
+}
+
+// @public (undocumented)
+export interface OAuthAuthenticatorResult<TProfile> {
+  // (undocumented)
+  fullProfile: TProfile;
+  // (undocumented)
+  session: OAuthSession;
+}
+
+// @public (undocumented)
+export interface OAuthAuthenticatorStartInput {
+  // (undocumented)
+  req: Request_2;
+  // (undocumented)
+  scope: string;
+  // (undocumented)
+  state: string;
+}
+
+// @public (undocumented)
+export class OAuthEnvironmentHandler implements AuthProviderRouteHandlers {
+  constructor(handlers: Map<string, AuthProviderRouteHandlers>);
+  // (undocumented)
+  frameHandler(req: express.Request, res: express.Response): Promise<void>;
+  // (undocumented)
+  logout(req: express.Request, res: express.Response): Promise<void>;
+  // (undocumented)
+  static mapConfig(
+    config: Config,
+    factoryFunc: (envConfig: Config) => AuthProviderRouteHandlers,
+  ): OAuthEnvironmentHandler;
+  // (undocumented)
+  refresh(req: express.Request, res: express.Response): Promise<void>;
+  // (undocumented)
+  start(req: express.Request, res: express.Response): Promise<void>;
+}
+
+// @public (undocumented)
+export interface OAuthRouteHandlersOptions<TProfile> {
+  // (undocumented)
+  appUrl: string;
+  // (undocumented)
+  authenticator: OAuthAuthenticator<any, TProfile>;
+  // (undocumented)
+  baseUrl: string;
+  // (undocumented)
+  config: Config;
+  // (undocumented)
+  cookieConfigurer?: CookieConfigurer;
+  // (undocumented)
+  isOriginAllowed: (origin: string) => boolean;
+  // (undocumented)
+  profileTransform?: ProfileTransform<OAuthAuthenticatorResult<TProfile>>;
+  // (undocumented)
+  providerId: string;
+  // (undocumented)
+  resolverContext: AuthResolverContext;
+  // (undocumented)
+  signInResolver?: SignInResolver<OAuthAuthenticatorResult<TProfile>>;
+  // (undocumented)
+  stateTransform?: OAuthStateTransform;
+}
+
+// @public (undocumented)
+export interface OAuthSession {
+  // (undocumented)
+  accessToken: string;
+  // (undocumented)
+  expiresInSeconds: number;
+  // (undocumented)
+  idToken?: string;
+  // (undocumented)
+  refreshToken?: string;
+  // (undocumented)
+  scope: string;
+  // (undocumented)
+  tokenType: string;
+}
+
+// @public (undocumented)
+export type OAuthState = {
+  nonce: string;
+  env: string;
+  origin?: string;
+  scope?: string;
+  redirectUrl?: string;
+  flow?: string;
+};
+
+// @public (undocumented)
+export type OAuthStateTransform = (
+  state: OAuthState,
+  context: {
+    req: Request_2;
+  },
+) => Promise<{
+  state: OAuthState;
+}>;
+
+// @public (undocumented)
+export type PassportDoneCallback<TResult, TPrivateInfo = never> = (
+  err?: Error,
+  result?: TResult,
+  privateInfo?: TPrivateInfo,
+) => void;
+
+// @public (undocumented)
+export class PassportHelpers {
+  // (undocumented)
+  static executeFetchUserProfileStrategy(
+    providerStrategy: Strategy,
+    accessToken: string,
+  ): Promise<PassportProfile>;
+  // (undocumented)
+  static executeFrameHandlerStrategy<TResult, TPrivateInfo = never>(
+    req: Request_2,
+    providerStrategy: Strategy,
+    options?: Record<string, string>,
+  ): Promise<{
+    result: TResult;
+    privateInfo: TPrivateInfo;
+  }>;
+  // (undocumented)
+  static executeRedirectStrategy(
+    req: Request_2,
+    providerStrategy: Strategy,
+    options: Record<string, string>,
+  ): Promise<{
+    url: string;
+    status?: number;
+  }>;
+  // (undocumented)
+  static executeRefreshTokenStrategy(
+    providerStrategy: Strategy,
+    refreshToken: string,
+    scope: string,
+  ): Promise<{
+    accessToken: string;
+    refreshToken?: string;
+    params: any;
+  }>;
+  // (undocumented)
+  static transformProfile: (
+    profile: PassportProfile,
+    idToken?: string,
+  ) => ProfileInfo;
+}
+
+// @public (undocumented)
+export class PassportOAuthAuthenticatorHelper {
+  // (undocumented)
+  authenticate(
+    input: OAuthAuthenticatorAuthenticateInput,
+  ): Promise<OAuthAuthenticatorResult<PassportProfile>>;
+  // (undocumented)
+  static defaultProfileTransform: ProfileTransform<
+    OAuthAuthenticatorResult<PassportProfile>
+  >;
+  // (undocumented)
+  fetchProfile(accessToken: string): Promise<PassportProfile>;
+  // (undocumented)
+  static from(strategy: Strategy): PassportOAuthAuthenticatorHelper;
+  // (undocumented)
+  refresh(
+    input: OAuthAuthenticatorRefreshInput,
+  ): Promise<OAuthAuthenticatorResult<PassportProfile>>;
+  // (undocumented)
+  start(
+    input: OAuthAuthenticatorStartInput,
+    options: Record<string, string>,
+  ): Promise<{
+    url: string;
+    status?: number;
+  }>;
+}
+
+// @public (undocumented)
+export type PassportOAuthDoneCallback = PassportDoneCallback<
+  PassportOAuthResult,
+  PassportOAuthPrivateInfo
+>;
+
+// @public (undocumented)
+export type PassportOAuthPrivateInfo = {
+  refreshToken?: string;
+};
+
+// @public (undocumented)
+export type PassportOAuthResult = {
+  fullProfile: PassportProfile;
+  params: {
+    id_token?: string;
+    scope: string;
+    token_type?: string;
+    expires_in: number;
+  };
+  accessToken: string;
+};
+
+// @public (undocumented)
+export type PassportProfile = Profile & {
+  avatarUrl?: string;
+};
+
+// @public
+export function prepareBackstageIdentityResponse(
+  result: BackstageSignInResult_2,
+): BackstageIdentityResponse_2;
+
+// @public
+export type ProfileInfo = {
+  email?: string;
+  displayName?: string;
+  picture?: string;
+};
+
+// @public
+export type ProfileTransform<TResult> = (
+  result: TResult,
+  context: AuthResolverContext,
+) => Promise<{
+  profile: ProfileInfo;
+}>;
+
+// @public (undocumented)
+export interface ProxyAuthenticator<TContext, TResult> {
+  // (undocumented)
+  authenticate(
+    options: {
+      req: Request_2;
+    },
+    ctx: TContext,
+  ): Promise<{
+    result: TResult;
+  }>;
+  // (undocumented)
+  defaultProfileTransform: ProfileTransform<TResult>;
+  // (undocumented)
+  initialize(ctx: { config: Config }): Promise<TContext>;
+}
+
+// @public (undocumented)
+export interface ProxyAuthRouteHandlersOptions<TResult> {
+  // (undocumented)
+  authenticator: ProxyAuthenticator<any, TResult>;
+  // (undocumented)
+  config: Config;
+  // (undocumented)
+  profileTransform?: ProfileTransform<TResult>;
+  // (undocumented)
+  resolverContext: AuthResolverContext;
+  // (undocumented)
+  signInResolver: SignInResolver<TResult>;
+}
+
+// @public (undocumented)
+export function readDeclarativeSignInResolver<TAuthResult>(
+  options: ReadDeclarativeSignInResolverOptions<TAuthResult>,
+): SignInResolver<TAuthResult> | undefined;
+
+// @public (undocumented)
+export interface ReadDeclarativeSignInResolverOptions<TAuthResult> {
+  // (undocumented)
+  config: Config;
+  // (undocumented)
+  signInResolverFactories: {
+    [name in string]: SignInResolverFactory<TAuthResult, unknown>;
+  };
+}
+
+// @public (undocumented)
+export function sendWebMessageResponse(
+  res: Response_2,
+  appOrigin: string,
+  response: WebMessageResponse,
+): void;
+
+// @public
+export type SignInInfo<TAuthResult> = {
+  profile: ProfileInfo;
+  result: TAuthResult;
+};
+
+// @public
+export type SignInResolver<TAuthResult> = (
+  info: SignInInfo<TAuthResult>,
+  context: AuthResolverContext,
+) => Promise<BackstageSignInResult>;
+
+// @public (undocumented)
+export interface SignInResolverFactory<TAuthResult, TOptions> {
+  // (undocumented)
+  (
+    ...options: undefined extends TOptions
+      ? [options?: TOptions]
+      : [options: TOptions]
+  ): SignInResolver<TAuthResult>;
+  // (undocumented)
+  optionsJsonSchema?: JsonObject;
+}
+
+// @public (undocumented)
+export interface SignInResolverFactoryOptions<
+  TAuthResult,
+  TOptionsOutput,
+  TOptionsInput,
+> {
+  // (undocumented)
+  create(options: TOptionsOutput): SignInResolver<TAuthResult>;
+  // (undocumented)
+  optionsSchema?: ZodSchema<TOptionsOutput, ZodTypeDef, TOptionsInput>;
+}
+
+// @public
+export type TokenParams = {
+  claims: {
+    sub: string;
+    ent?: string[];
+  } & Record<string, JsonValue>;
+};
+
+// @public
+export type WebMessageResponse =
+  | {
+      type: 'authorization_response';
+      response: ClientAuthResponse<unknown>;
+    }
+  | {
+      type: 'authorization_response';
+      error: Error;
+    };
 ```