Every industry has that moment when the side project grows up. The garage band gets a record deal. The startup app becomes a household name. And in our world of platform engineering, that moment just happened for Backstage.
With the release of Backstage 1.43 last week, what started as Spotify’s internal developer portal is looking less like a cool open source experiment and more like real infrastructure. This wasn’t a flashy “new UI” update. It was a maturity drop: OpenShift auth, a Scaffolder Actions Registry, and even experimental support for MCP tokens.
If you’re a platform engineer, these are not throwaway bullet points in a changelog. They’re signposts that internal developer platforms (IDPs) are moving past their awkward adolescence.
The Backstage Story So Far
Let’s rewind. When Spotify open-sourced Backstage in 2020, it was mostly known as a catalog. A way to wrangle microservices sprawl with a slick UI. The idea caught fire. Developers wanted it. Platform teams saw potential. Soon, it was in the CNCF sandbox, then incubation, and the plugin ecosystem exploded.
But if we’re honest, many Backstage rollouts fizzled. Too hard to maintain, too many plugins to babysit, not enough ROI. For a while, it felt like Backstage was at risk of becoming another “nice idea” project: Fun demos, few production wins.
That’s why 1.43 matters. It’s not about shiny features. It’s about tackling the enterprise realities that make or break an IDP.
What’s New in 1.43
OpenShift Auth Provider
Let’s start with the least sexy but most important bit: OpenShift as an authentication provider.
For Red Hat-heavy shops, this is a big deal. Instead of juggling credentials or maintaining brittle SSO glue, developers can log into Backstage using the same identity provider they use across their hybrid stack.
This is how IDPs stop being toys for “greenfield cloud” and start working in the messy, mixed estates most enterprises actually run.
Scaffolder Actions Registry
The Scaffolder has always been one of Backstage’s crown jewels — golden path templates to spin up services the right way. But every company ended up writing its own Actions. Lots of bespoke glue. Lots of duplication.
Enter the Actions Registry. Now teams can pull from a shared library of vetted automation. Write once, use everywhere. This moves the scaffolder from “cool templating tool” to “platform-wide automation framework.”
Golden paths only work if they’re consistent. The registry makes that possible.
Experimental MCP Token Support
This one’s still under the radar, but it could be a game-changer: Experimental support for MCP (Model Context Protocol) tokens.
If you haven’t been following, MCP is a spec that lets AI agents (think Claude, Cursor, Codeium) request scoped, short-lived credentials from systems like Backstage. In plain English: your developer portal could soon become the broker not just for humans, but for AI assistants too.
Sound exciting? It is. Sound terrifying? Also yes. We’re about to enter a world where agents run builds, open PRs, and request pipeline access. If you don’t want that happening over long-lived tokens and sticky notes on a laptop, you’re going to need something like MCP.
Other Notables
- BACKSTAGE_ENV config: makes it easier to run Backstage across multiple environments.
- Bug fixes, refinements and under-the-hood stability. The unglamorous but necessary stuff that separates real infrastructure from GitHub demos.
Why Platform Engineers Should Care
This release isn’t just about a handful of new features. It’s about signaling that Backstage — and by extension, IDPs — are entering a new phase.
- Enterprise-ready. OpenShift auth lowers the friction for adoption in large orgs.
- Scalable golden paths. The Actions Registry makes templates reusable and governable, reducing toil for platform engineers.
- AI-native future. MCP tokens hint at the next era, where IDPs aren’t just front doors for developers, but also for AI agents working alongside them.
Together, these aren’t bells and whistles. They’re foundations.
Risks and Questions
Of course, maturity brings new questions:
- Will enterprises actually adopt these features, or will they stay “cool experiments” in release notes?
- Governance vs. sprawl: A registry of Actions is only helpful if someone curates and secures it. Otherwise, it’s just another dumping ground.
- AI agents in pipelines: Are we empowering productivity, or opening Pandora’s box of autonomous mischief?
These are not problems we can punt to “future us.” They’re arriving now.
What is MCP, and Why Should You Care?
The Model Context Protocol (MCP) is a spec for connecting AI assistants to external systems — securely. Instead of hard-coding tokens or sharing credentials, an agent can request a short-lived, scoped credential via an MCP-aware broker (like Backstage).
Why it matters:
- Security: Stops AI tools from hoarding long-lived keys.
- Observability: Lets platform teams track what agents are doing, just like human developers.
- Control: You can enforce policy at the broker, not just hope the agent behaves.
In other words, MCP is about making “AI in the developer workflow” something you can actually govern, not just pray over.
Shimmy’s Take
Every IDP vendor claims to pave golden paths. But paved roads only matter if they can handle enterprise traffic. Backstage 1.43 feels like the first time the asphalt is actually getting poured.
OpenShift auth tells me the project is serious about fitting into real-world enterprise environments. The Actions Registry tells me the community wants to solve the duplication problem, not just generate YAML faster. And MCP tokens—well, they tell me the future is already knocking at the door, whether we’re ready or not.
Backstage isn’t “done.” It’s not a turnkey magic portal. It still requires engineering effort, curation, and governance. But with 1.43, it’s no longer just a shiny catalog with a Spotify story behind it. It’s becoming infrastructure.
Platform engineers now face a choice: Keep duct-taping their own portals together, or embrace the idea that open source is starting to deliver a shared standard.
For my money? If you’re serious about IDPs, you can’t afford to ignore this release. The kids are growing up. Time to treat them like adults.