diff --git a/packages/backend-common/package.json b/packages/backend-common/package.json
index 2dbeac6845..94f1b39672 100644
--- a/packages/backend-common/package.json
+++ b/packages/backend-common/package.json
@@ -83,6 +83,7 @@
   },
   "devDependencies": {
     "@backstage/cli": "^0.9.0",
+    "@backstage/core-app-api": "^0.1.21",
     "@backstage/test-utils": "^0.1.22",
     "@types/archiver": "^5.1.0",
     "@types/compression": "^1.7.0",
diff --git a/packages/backend-common/src/tokens/AuthIdentityTokenManager.test.ts b/packages/backend-common/src/tokens/AuthIdentityTokenManager.test.ts
index b52acbe300..c0e952bae5 100644
--- a/packages/backend-common/src/tokens/AuthIdentityTokenManager.test.ts
+++ b/packages/backend-common/src/tokens/AuthIdentityTokenManager.test.ts
@@ -13,6 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+import { ConfigReader } from '@backstage/core-app-api';
 import { PluginEndpointDiscovery } from '..';
 import { IdentityClient } from '../identity';
 import { AuthIdentityTokenManager } from './AuthIdentityTokenManager';
@@ -25,6 +26,9 @@ const discovery: PluginEndpointDiscovery = {
     return 'url';
   },
 };
+const config = new ConfigReader({
+  backend: { auth: { secret: 'a-secret-key' } },
+});
 
 beforeAll(() => {
   jest
@@ -35,23 +39,28 @@ beforeAll(() => {
 });
 
 describe('AuthIdentityTokenManager', () => {
-  it('should validate a valid server token', async () => {
-    const tokenManager = new AuthIdentityTokenManager(
-      discovery,
-      'a-secret-key',
+  it('should throw in getServerToken if there is no secret in the config', async () => {
+    const emptyConfig = new ConfigReader({});
+    const tokenManager = new AuthIdentityTokenManager(discovery, emptyConfig);
+    await expect(tokenManager.getServerToken()).rejects.toThrow(
+      'No server token defined in config',
     );
+  });
+
+  it('should validate a valid server token', async () => {
+    const tokenManager = new AuthIdentityTokenManager(discovery, config);
     const { token } = await tokenManager.getServerToken();
     await expect(tokenManager.validateToken(token)).resolves.toBeUndefined();
   });
 
   it('should reject an invalid server token', async () => {
-    const tokenManager = new AuthIdentityTokenManager(
-      discovery,
-      'a-secret-key',
-    );
+    const differentConfig = new ConfigReader({
+      backend: { auth: { secret: 'a-different-key' } },
+    });
+    const tokenManager = new AuthIdentityTokenManager(discovery, config);
     const differentTokenManager = new AuthIdentityTokenManager(
       discovery,
-      'a-different-key',
+      differentConfig,
     );
     const { token } = await tokenManager.getServerToken();
     await expect(differentTokenManager.validateToken(token)).rejects.toThrow(