diff --git a/packages/backend/src/auth-service-client/client.test.ts b/packages/backend/src/auth-service-client/client.test.ts
new file mode 100644
index 0000000000..72425a6e9a
--- /dev/null
+++ b/packages/backend/src/auth-service-client/client.test.ts
@@ -0,0 +1,119 @@
+import { faker } from '@faker-js/faker'
+import nock from 'nock'
+import { AuthServiceClient, AuthServiceClientError } from './client'
+
+describe('AuthServiceClient', () => {
+  const baseUrl = 'http://auth-service.biz'
+  let client: AuthServiceClient
+
+  beforeEach(() => {
+    client = new AuthServiceClient(baseUrl)
+    nock.cleanAll()
+  })
+
+  afterEach(() => {
+    expect(nock.isDone()).toBeTruthy()
+  })
+
+  const createTenantData = () => ({
+    id: faker.string.uuid(),
+    idpConsentUrl: faker.internet.url(),
+    idpSecret: faker.string.alphanumeric(32)
+  })
+
+  describe('tenant', () => {
+    describe('get', () => {
+      test('retrieves a tenant', async () => {
+        const tenantData = createTenantData()
+
+        nock(baseUrl).get(`/tenant/${tenantData.id}`).reply(200, tenantData)
+
+        const tenant = await client.tenant.get(tenantData.id)
+        expect(tenant).toEqual(tenantData)
+      })
+
+      test('throws on bad request', async () => {
+        const id = faker.string.uuid()
+
+        nock(baseUrl).get(`/tenant/${id}`).reply(404)
+
+        await expect(client.tenant.get(id)).rejects.toThrow(
+          AuthServiceClientError
+        )
+      })
+    })
+
+    describe('create', () => {
+      test('creates a new tenant', async () => {
+        const tenantData = createTenantData()
+
+        nock(baseUrl).post('/tenant', tenantData).reply(201)
+
+        await expect(client.tenant.create(tenantData)).resolves.toBe('')
+      })
+
+      test('throws on bad request', async () => {
+        const tenantData = createTenantData()
+
+        nock(baseUrl)
+          .post('/tenant', tenantData)
+          .reply(409, { message: 'Tenant already exists' })
+
+        await expect(client.tenant.create(tenantData)).rejects.toThrow(
+          AuthServiceClientError
+        )
+      })
+    })
+
+    describe('update', () => {
+      test('updates an existing tenant', async () => {
+        const id = faker.string.uuid()
+        const updateData = {
+          idpConsentUrl: faker.internet.url(),
+          idpSecret: faker.string.alphanumeric(32)
+        }
+
+        nock(baseUrl).patch(`/tenant/${id}`, updateData).reply(200)
+
+        await expect(client.tenant.update(id, updateData)).resolves.toBe('')
+      })
+
+      test('throws on bad request', async () => {
+        const id = faker.string.uuid()
+        const updateData = {
+          idpConsentUrl: faker.internet.url()
+        }
+
+        nock(baseUrl)
+          .patch(`/tenant/${id}`, updateData)
+          .reply(404, { message: 'Tenant not found' })
+
+        await expect(client.tenant.update(id, updateData)).rejects.toThrow(
+          AuthServiceClientError
+        )
+      })
+    })
+
+    describe('delete', () => {
+      test('deletes an existing tenant', async () => {
+        const id = faker.string.uuid()
+
+        nock(baseUrl).delete(`/tenant/${id}`).reply(204)
+
+        await expect(client.tenant.delete(id)).resolves.toBeUndefined()
+      })
+
+      test('throws on bad request', async () => {
+        const id = faker.string.uuid()
+
+        nock(baseUrl)
+          .delete(`/tenant/${id}`)
+          .reply(404, { message: 'Tenant not found' })
+
+        await expect(client.tenant.delete(id)).rejects.toThrow(
+          AuthServiceClientError
+        )
+      })
+    })
+  })
+})
diff --git a/packages/backend/src/auth-service-client/client.ts b/packages/backend/src/auth-service-client/client.ts
new file mode 100644
index 0000000000..4ce39bac7f
--- /dev/null
+++ b/packages/backend/src/auth-service-client/client.ts
@@ -0,0 +1,83 @@
+interface Tenant {
+  id: string
+  idpConsentUrl: string
+  idpSecret: string
+}
+
+export class AuthServiceClientError extends Error {
+  constructor(
+    message: string,
+    public status: number,
+    public details?: any
+  ) {
+    super(message)
+    this.status = status
+    this.details = details
+  }
+}
+
+export class AuthServiceClient {
+  private baseUrl: string
+
+  constructor(baseUrl: string) {
+    this.baseUrl = baseUrl
+  }
+
+  private async request<T>(path: string, options: RequestInit): Promise<T> {
+    const response = await fetch(`${this.baseUrl}${path}`, options)
+
+    if (!response.ok) {
+      let errorDetails
+      try {
+        errorDetails = await response.json()
+      } catch {
+        errorDetails = { message: response.statusText }
+      }
+
+      throw new AuthServiceClientError(
+        `Auth Service Client Error: ${response.status} ${response.statusText}`,
+        response.status,
+        errorDetails
+      )
+    }
+
+    if (
+      response.status === 204 ||
+      response.headers.get('Content-Length') === '0'
+    ) {
+      return undefined as T // TODO: not this. handle the type correctly
+    }
+
+    const contentType = response.headers.get('Content-Type')
+    if (contentType && contentType.includes('application/json')) {
+      try {
+        return (await response.json()) as T
+      } catch (error) {
+        throw new AuthServiceClientError(
+          `Failed to parse JSON response from ${path}`,
+          response.status
+        )
+      }
+    }
+
+    return (await response.text()) as T
+  }
+
+  public tenant = {
+    get: (id: string) =>
+      this.request<Tenant>(`/tenant/${id}`, { method: 'GET' }),
+    create: (data: Omit<Tenant, 'id'>) =>
+      this.request('/tenant', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(data)
+      }),
+    update: (id: string, data: Partial<Omit<Tenant, 'id'>>) =>
+      this.request(`/tenant/${id}`, {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(data)
+      }),
+    delete: (id: string) => this.request(`/tenant/${id}`, { method: 'DELETE' })
+  }
+}