diff --git a/docs/tutorials/backend-to-backend-auth.md b/docs/tutorials/backend-to-backend-auth.md
index 07de883172..6163d4f592 100644
--- a/docs/tutorials/backend-to-backend-auth.md
+++ b/docs/tutorials/backend-to-backend-auth.md
@@ -43,7 +43,7 @@ function makeCreateEnv(config: Config) {
 
   const cacheManager = CacheManager.fromConfig(config);
   const databaseManager = DatabaseManager.fromConfig(config);
-+ const tokenManager = ServerTokenManager.default({ config, logger: root });
++ const tokenManager = ServerTokenManager.fromConfig(config, { logger: root });
 ```
 
 With this `tokenManager`, you can then generate a server token for requests:
diff --git a/packages/backend-common/api-report.md b/packages/backend-common/api-report.md
index 32d0df1148..cd44601d8c 100644
--- a/packages/backend-common/api-report.md
+++ b/packages/backend-common/api-report.md
@@ -491,10 +491,12 @@ export class ServerTokenManager implements TokenManager {
   // (undocumented)
   authenticate(token: string): Promise<void>;
   // (undocumented)
-  static default(options: {
-    config: Config;
-    logger: Logger_2;
-  }): ServerTokenManager;
+  static fromConfig(
+    config: Config,
+    options: {
+      logger: Logger_2;
+    },
+  ): ServerTokenManager;
   // (undocumented)
   getToken(): Promise<{
     token: string;
diff --git a/packages/backend-common/src/tokens/ServerTokenManager.test.ts b/packages/backend-common/src/tokens/ServerTokenManager.test.ts
index df74faf534..fb82eada29 100644
--- a/packages/backend-common/src/tokens/ServerTokenManager.test.ts
+++ b/packages/backend-common/src/tokens/ServerTokenManager.test.ts
@@ -38,8 +38,7 @@ describe('ServerTokenManager', () => {
 
   describe('getToken', () => {
     it('should return a token', async () => {
-      const tokenManager = ServerTokenManager.default({
-        config: configWithSecret,
+      const tokenManager = ServerTokenManager.fromConfig(configWithSecret, {
         logger,
       });
       expect((await tokenManager.getToken()).token).toBeDefined();
@@ -48,8 +47,7 @@ describe('ServerTokenManager', () => {
 
   describe('authenticate', () => {
     it('should not throw if token is valid', async () => {
-      const tokenManager = ServerTokenManager.default({
-        config: configWithSecret,
+      const tokenManager = ServerTokenManager.fromConfig(configWithSecret, {
         logger,
       });
       const { token } = await tokenManager.getToken();
@@ -57,8 +55,7 @@ describe('ServerTokenManager', () => {
     });
 
     it('should throw if token is invalid', async () => {
-      const tokenManager = ServerTokenManager.default({
-        config: configWithSecret,
+      const tokenManager = ServerTokenManager.fromConfig(configWithSecret, {
         logger,
       });
       await expect(
@@ -67,12 +64,10 @@ describe('ServerTokenManager', () => {
     });
 
     it('should validate server tokens created by a different instance using the same secret', async () => {
-      const tokenManager1 = ServerTokenManager.default({
-        config: configWithSecret,
+      const tokenManager1 = ServerTokenManager.fromConfig(configWithSecret, {
         logger,
       });
-      const tokenManager2 = ServerTokenManager.default({
-        config: configWithSecret,
+      const tokenManager2 = ServerTokenManager.fromConfig(configWithSecret, {
         logger,
       });
 
@@ -82,26 +77,26 @@ describe('ServerTokenManager', () => {
     });
 
     it('should validate server tokens created using any of the secrets', async () => {
-      const tokenManager1 = ServerTokenManager.default({
-        config: new ConfigReader({
+      const tokenManager1 = ServerTokenManager.fromConfig(
+        new ConfigReader({
           backend: { auth: { keys: [{ secret: 'a1b2c3' }] } },
         }),
-        logger,
-      });
-      const tokenManager2 = ServerTokenManager.default({
-        config: new ConfigReader({
+        { logger },
+      );
+      const tokenManager2 = ServerTokenManager.fromConfig(
+        new ConfigReader({
           backend: { auth: { keys: [{ secret: 'd4e5f6' }] } },
         }),
-        logger,
-      });
-      const tokenManager3 = ServerTokenManager.default({
-        config: new ConfigReader({
+        { logger },
+      );
+      const tokenManager3 = ServerTokenManager.fromConfig(
+        new ConfigReader({
           backend: {
             auth: { keys: [{ secret: 'a1b2c3' }, { secret: 'd4e5f6' }] },
           },
         }),
-        logger,
-      });
+        { logger },
+      );
 
       const { token: token1 } = await tokenManager1.getToken();
       await expect(tokenManager3.authenticate(token1)).resolves.not.toThrow();
@@ -111,18 +106,18 @@ describe('ServerTokenManager', () => {
     });
 
     it('should throw for server tokens created using a different secret', async () => {
-      const tokenManager1 = ServerTokenManager.default({
-        config: new ConfigReader({
+      const tokenManager1 = ServerTokenManager.fromConfig(
+        new ConfigReader({
           backend: { auth: { keys: [{ secret: 'a1b2c3' }] } },
         }),
-        logger,
-      });
-      const tokenManager2 = ServerTokenManager.default({
-        config: new ConfigReader({
+        { logger },
+      );
+      const tokenManager2 = ServerTokenManager.fromConfig(
+        new ConfigReader({
           backend: { auth: { keys: [{ secret: 'd4e5f6' }] } },
         }),
-        logger,
-      });
+        { logger },
+      );
 
       const { token } = await tokenManager1.getToken();
 
@@ -133,14 +128,13 @@ describe('ServerTokenManager', () => {
 
     it('should throw for server tokens created by a different generated secret', async () => {
       (process.env as any).NODE_ENV = 'development';
-      const tokenManager1 = ServerTokenManager.default({
-        config: new ConfigReader({
+      const tokenManager1 = ServerTokenManager.fromConfig(
+        new ConfigReader({
           backend: { auth: { keys: [{ secret: 'a1b2c3' }] } },
         }),
-        logger,
-      });
-      const tokenManager2 = ServerTokenManager.default({
-        config: emptyConfig,
+        { logger },
+      );
+      const tokenManager2 = ServerTokenManager.fromConfig(emptyConfig, {
         logger,
       });
 
@@ -156,33 +150,33 @@ describe('ServerTokenManager', () => {
     describe('NODE_ENV === production', () => {
       it('should throw if backend auth configuration is missing', () => {
         expect(() =>
-          ServerTokenManager.default({ config: emptyConfig, logger }),
+          ServerTokenManager.fromConfig(emptyConfig, { logger }),
         ).toThrow();
       });
 
       it('should throw if no keys are included in the configuration', () => {
         expect(() =>
-          ServerTokenManager.default({
-            config: new ConfigReader({
+          ServerTokenManager.fromConfig(
+            new ConfigReader({
               backend: { auth: { keys: [] } },
             }),
-            logger,
-          }),
+            { logger },
+          ),
         ).toThrow();
       });
 
       it('should throw if any key is missing a secret property', () => {
         expect(() =>
-          ServerTokenManager.default({
-            config: new ConfigReader({
+          ServerTokenManager.fromConfig(
+            new ConfigReader({
               backend: {
                 auth: {
                   keys: [{ secret: '123' }, {}, { secret: '789' }],
                 },
               },
             }),
-            logger,
-          }),
+            { logger },
+          ),
         ).toThrow();
       });
     });
@@ -199,27 +193,24 @@ describe('ServerTokenManager', () => {
       });
 
       it('should generate a key if no config is provided', () => {
-        ServerTokenManager.default({
-          config: emptyConfig,
-          logger,
-        });
+        ServerTokenManager.fromConfig(emptyConfig, { logger });
 
         expect(generateSyncSpy).toHaveBeenCalledWith('oct', 192);
       });
 
       it('should generate a key if no keys are provided in the configuration', () => {
-        ServerTokenManager.default({
-          config: new ConfigReader({
+        ServerTokenManager.fromConfig(
+          new ConfigReader({
             backend: { auth: { keys: [] } },
           }),
-          logger,
-        });
+          { logger },
+        );
 
         expect(generateSyncSpy).toHaveBeenCalledWith('oct', 192);
       });
 
       it('should use provided secrets if config is provided', () => {
-        ServerTokenManager.default({ config: configWithSecret, logger });
+        ServerTokenManager.fromConfig(configWithSecret, { logger });
         expect(generateSyncSpy).not.toHaveBeenCalled();
       });
     });
diff --git a/packages/backend-common/src/tokens/ServerTokenManager.ts b/packages/backend-common/src/tokens/ServerTokenManager.ts
index a9633c7f77..0b7ea49dce 100644
--- a/packages/backend-common/src/tokens/ServerTokenManager.ts
+++ b/packages/backend-common/src/tokens/ServerTokenManager.ts
@@ -30,8 +30,8 @@ export class ServerTokenManager implements TokenManager {
   private readonly verificationKeys: JWKS.KeyStore;
   private readonly signingKey: JWK.Key;
 
-  static default(options: { config: Config; logger: Logger }) {
-    const { config, logger } = options;
+  static fromConfig(config: Config, options: { logger: Logger }) {
+    const { logger } = options;
 
     if (process.env.NODE_ENV === 'development') {
       let secrets: string[] = [];
diff --git a/packages/backend/src/index.ts b/packages/backend/src/index.ts
index 78b48e581f..96def8d03f 100644
--- a/packages/backend/src/index.ts
+++ b/packages/backend/src/index.ts
@@ -63,7 +63,7 @@ function makeCreateEnv(config: Config) {
   const root = getRootLogger();
   const reader = UrlReaders.default({ logger: root, config });
   const discovery = SingleHostDiscovery.fromConfig(config);
-  const tokenManager = ServerTokenManager.default({ config, logger: root });
+  const tokenManager = ServerTokenManager.fromConfig(config, { logger: root });
   const permissions = new ServerPermissionClient({
     discoveryApi: discovery,
     configApi: config,
diff --git a/packages/create-app/templates/default-app/packages/backend/src/index.ts b/packages/create-app/templates/default-app/packages/backend/src/index.ts
index f191acf3db..7a2d2a7a34 100644
--- a/packages/create-app/templates/default-app/packages/backend/src/index.ts
+++ b/packages/create-app/templates/default-app/packages/backend/src/index.ts
@@ -38,7 +38,7 @@ function makeCreateEnv(config: Config) {
 
   const cacheManager = CacheManager.fromConfig(config);
   const databaseManager = DatabaseManager.fromConfig(config);
-  const tokenManager = ServerTokenManager.default({ config, logger: root });
+  const tokenManager = ServerTokenManager.fromConfig(config, { logger: root });
 
   return (plugin: string): PluginEnvironment => {
     const logger = root.child({ type: 'plugin', plugin });