diff --git a/plugins/auth-backend/src/providers/factories.ts b/plugins/auth-backend/src/providers/factories.ts
index 6c83dffda3..37761c2305 100644
--- a/plugins/auth-backend/src/providers/factories.ts
+++ b/plugins/auth-backend/src/providers/factories.ts
@@ -14,9 +14,6 @@
  * limitations under the License.
  */
 
-import Router from 'express-promise-router';
-import { Logger } from 'winston';
-import { TokenIssuer } from '../identity';
 import { createGithubProvider } from './github';
 import { createGitlabProvider } from './gitlab';
 import { createGoogleProvider } from './google';
@@ -25,8 +22,7 @@ import { createOktaProvider } from './okta';
 import { createSamlProvider } from './saml';
 import { createAuth0Provider } from './auth0';
 import { createMicrosoftProvider } from './microsoft';
-import { AuthProviderConfig, AuthProviderFactory } from './types';
-import { Config } from '@backstage/config';
+import { AuthProviderFactory, AuthProviderFactoryOptions } from './types';
 
 const factories: { [providerId: string]: AuthProviderFactory } = {
   google: createGoogleProvider,
@@ -39,31 +35,14 @@ const factories: { [providerId: string]: AuthProviderFactory } = {
   oauth2: createOAuth2Provider,
 };
 
-export const createAuthProviderRouter = (
+export function createAuthProvider(
   providerId: string,
-  globalConfig: AuthProviderConfig,
-  config: Config,
-  logger: Logger,
-  tokenIssuer: TokenIssuer,
-) => {
+  options: AuthProviderFactoryOptions,
+) {
   const factory = factories[providerId];
   if (!factory) {
     throw Error(`No auth provider available for '${providerId}'`);
   }
 
-  const router = Router();
-
-  const handler = factory({ globalConfig, config, logger, tokenIssuer });
-
-  router.get('/start', handler.start.bind(handler));
-  router.get('/handler/frame', handler.frameHandler.bind(handler));
-  router.post('/handler/frame', handler.frameHandler.bind(handler));
-  if (handler.logout) {
-    router.post('/logout', handler.logout.bind(handler));
-  }
-  if (handler.refresh) {
-    router.get('/refresh', handler.refresh.bind(handler));
-  }
-
-  return router;
-};
+  return factory(options);
+}
diff --git a/plugins/auth-backend/src/providers/index.ts b/plugins/auth-backend/src/providers/index.ts
index d210bfd1bb..99348438be 100644
--- a/plugins/auth-backend/src/providers/index.ts
+++ b/plugins/auth-backend/src/providers/index.ts
@@ -14,4 +14,4 @@
  * limitations under the License.
  */
 
-export { createAuthProviderRouter } from './factories';
+export { createAuthProvider } from './factories';
diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index 56ac587126..99b5ee800b 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -19,7 +19,7 @@ import Router from 'express-promise-router';
 import cookieParser from 'cookie-parser';
 import Knex from 'knex';
 import { Logger } from 'winston';
-import { createAuthProviderRouter } from '../providers';
+import { createAuthProvider } from '../providers';
 import { Config } from '@backstage/config';
 import { DatabaseKeyStore, TokenFactory, createOidcRouter } from '../identity';
 import {
@@ -65,15 +65,26 @@ export async function createRouter(
   for (const providerId of providers) {
     logger.info(`Configuring provider, ${providerId}`);
     try {
-      const providerConfig = providersConfig.getConfig(providerId);
-      const providerRouter = createAuthProviderRouter(
-        providerId,
-        { baseUrl: authUrl, appUrl },
-        providerConfig,
+      const provider = createAuthProvider(providerId, {
+        globalConfig: { baseUrl: authUrl, appUrl },
+        config: providersConfig.getConfig(providerId),
         logger,
         tokenIssuer,
-      );
-      router.use(`/${providerId}`, providerRouter);
+      });
+
+      const r = Router();
+
+      r.get('/start', provider.start.bind(provider));
+      r.get('/handler/frame', provider.frameHandler.bind(provider));
+      r.post('/handler/frame', provider.frameHandler.bind(provider));
+      if (provider.logout) {
+        r.post('/logout', provider.logout.bind(provider));
+      }
+      if (provider.refresh) {
+        r.get('/refresh', provider.refresh.bind(provider));
+      }
+
+      router.use(`/${providerId}`, r);
     } catch (e) {
       if (process.env.NODE_ENV !== 'development') {
         throw new Error(