diff --git a/packages/backend-common/src/identity/IdentityClient.ts b/packages/backend-common/src/identity/IdentityClient.ts
index c69ff1be64..c2aa913df3 100644
--- a/packages/backend-common/src/identity/IdentityClient.ts
+++ b/packages/backend-common/src/identity/IdentityClient.ts
@@ -28,7 +28,8 @@ const CLOCK_MARGIN_S = 10;
  * @experimental This is not a stable API yet
  */
 
-// TODO: (b2b-auth) integrate IdentityClient into the TokenManager instead
+// TODO: (b2b-auth) move IdentityClient into tokens
+// perhaps also create an interface?
 export class IdentityClient {
   private readonly discovery: PluginEndpointDiscovery;
   private readonly issuer: string;
diff --git a/packages/backend-common/src/tokens/AuthIdentityTokenManager.ts b/packages/backend-common/src/tokens/AuthIdentityTokenManager.ts
index da9c62a231..72bec24448 100644
--- a/packages/backend-common/src/tokens/AuthIdentityTokenManager.ts
+++ b/packages/backend-common/src/tokens/AuthIdentityTokenManager.ts
@@ -19,19 +19,30 @@ import { TokenManager } from './types';
 import { IdentityClient } from '../identity';
 import { PluginEndpointDiscovery } from '../discovery';
 
+// TODO: (b2b-auth) rename this class
 export class AuthIdentityTokenManager implements TokenManager {
   private identityClient: IdentityClient;
   private key: JWK.OctKey;
 
-  constructor(discovery: PluginEndpointDiscovery, secret: string) {
-    this.identityClient = new IdentityClient({
-      discovery,
+  static create(options: {
+    discovery: PluginEndpointDiscovery;
+    secret: string;
+  }) {
+    const identityClient = new IdentityClient({
+      discovery: options.discovery,
       issuer: 'auth-identity-token-manager',
     });
+    return new AuthIdentityTokenManager(identityClient, options.secret);
+  }
+
+  private constructor(identityClient: IdentityClient, secret: string) {
+    this.identityClient = identityClient;
+    // TODO: (b2b-auth) how do we get this to be the right JWK type
     this.key = JWK.asKey(Buffer.from(secret)) as JWK.OctKey;
   }
 
   async getServerToken(): Promise<{ token: string }> {
+    // TODO: (b2b-auth) figure out how to use HMAC as the alg
     const jwt = JWT.sign({ sub: 'backstage-server' }, this.key);
     return { token: jwt };
   }
diff --git a/packages/backend/src/index.ts b/packages/backend/src/index.ts
index 81d9c36d3f..35d6365851 100644
--- a/packages/backend/src/index.ts
+++ b/packages/backend/src/index.ts
@@ -66,7 +66,10 @@ function makeCreateEnv(config: Config) {
   const root = getRootLogger();
   const reader = UrlReaders.default({ logger: root, config });
   const discovery = SingleHostDiscovery.fromConfig(config);
-  const tokenManager = new AuthIdentityTokenManager(discovery);
+  const tokenManager = AuthIdentityTokenManager.create({
+    discovery,
+    secret: 'secret-tehe',
+  });
 
   root.info(`Created UrlReader ${reader}`);