diff --git a/modules/auth/README.md b/modules/auth/README.md
new file mode 100644
index 00000000..ff65531b
--- /dev/null
+++ b/modules/auth/README.md
@@ -0,0 +1,16 @@
+# `@erp/auth`
+
+Estado actual:
+
+- Este módulo está en estado legacy para backend.
+- El runtime nuevo de autenticación backend vive en `modules/identity`.
+- Los módulos backend nuevos deben usar `@erp/identity/api`.
+- Para rutas tenant-scoped usar `requireIdentityTenant(params)`.
+- Para rutas solo autenticadas usar `requireIdentityAuthenticated(params)`.
+- `@erp/auth/api` se mantiene temporalmente solo por `supplier`.
+- No añadir nuevos imports backend a `@erp/auth/api`.
+
+Importante:
+
+- Este paquete sigue exponiendo `@erp/auth/client`, por lo que no debe retirarse todavía.
+- No cambiar ni borrar exports legacy mientras `supplier` siga sin migrarse.
diff --git a/modules/auth/src/api/lib/express/index.ts b/modules/auth/src/api/lib/express/index.ts
index c39f7e57..2cbbd1b4 100644
--- a/modules/auth/src/api/lib/express/index.ts
+++ b/modules/auth/src/api/lib/express/index.ts
@@ -1,3 +1,10 @@
+/**
+ * Legacy backend auth exports.
+ *
+ * Nuevos consumidores backend deben usar `@erp/identity/api`.
+ * Este punto de entrada se mantiene temporalmente mientras `supplier`
+ * siga dependiendo de `@erp/auth/api`.
+ */
 export * from "./mock-user.middleware";
 export * from "./require-authenticated.middleware";
 export * from "./require-company-context.middleware";
diff --git a/modules/customer-invoices/package.json b/modules/customer-invoices/package.json
index 39f0a100..80033e55 100644
--- a/modules/customer-invoices/package.json
+++ b/modules/customer-invoices/package.json
@@ -39,10 +39,10 @@
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
-    "@erp/auth": "workspace:*",
     "@erp/core": "workspace:*",
     "@erp/catalogs": "workspace:*",
     "@erp/customers": "workspace:*",
+    "@erp/identity": "workspace:*",
     "@hookform/resolvers": "^5.2.2",
     "@lglab/react-qr-code": "^1.4.10",
     "@repo/i18next": "workspace:*",
@@ -67,4 +67,4 @@
     "sequelize": "^6.37.8",
     "zod": "^4.3.6"
   }
-}
\ No newline at end of file
+}
diff --git a/modules/customer-invoices/src/api/application/issued-invoices/use-cases/report-issued-invoice.use-case.ts b/modules/customer-invoices/src/api/application/issued-invoices/use-cases/report-issued-invoice.use-case.ts
index 8a782d74..ba478769 100644
--- a/modules/customer-invoices/src/api/application/issued-invoices/use-cases/report-issued-invoice.use-case.ts
+++ b/modules/customer-invoices/src/api/application/issued-invoices/use-cases/report-issued-invoice.use-case.ts
@@ -8,7 +8,6 @@ import type { IIssuedInvoiceReportSnapshotBuilder } from "../snapshot-builders/r
 
 type ReportIssuedInvoiceUseCaseInput = {
   companyId: UniqueID;
-  companySlug: string;
   invoice_id: string;
   format: RendererFormat;
 };
diff --git a/modules/customer-invoices/src/api/application/proformas/use-cases/report-proforma.use-case.ts b/modules/customer-invoices/src/api/application/proformas/use-cases/report-proforma.use-case.ts
index 7001d2ac..af070efe 100644
--- a/modules/customer-invoices/src/api/application/proformas/use-cases/report-proforma.use-case.ts
+++ b/modules/customer-invoices/src/api/application/proformas/use-cases/report-proforma.use-case.ts
@@ -8,7 +8,6 @@ import type { IProformaReportSnapshotBuilder } from "../snapshot-builders/report
 
 type ReportProformaUseCaseInput = {
   companyId: UniqueID;
-  companySlug: string;
   proforma_id: string;
   format: RendererFormat;
 };
diff --git a/modules/customer-invoices/src/api/index.ts b/modules/customer-invoices/src/api/index.ts
index ea98e5d1..53330d83 100644
--- a/modules/customer-invoices/src/api/index.ts
+++ b/modules/customer-invoices/src/api/index.ts
@@ -15,7 +15,7 @@ export type { IProformaPublicServices } from "./application";
 export const customerInvoicesAPIModule: IModuleServer = {
   name: "customer-invoices",
   version: "1.0.0",
-  dependencies: ["catalogs", "customers"],
+  dependencies: ["catalogs", "customers", "identity"],
 
   /**
    * Fase de SETUP
diff --git a/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/controllers/report-issued-invoice.controller.ts b/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/controllers/report-issued-invoice.controller.ts
index debe2b1b..eccae37e 100644
--- a/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/controllers/report-issued-invoice.controller.ts
+++ b/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/controllers/report-issued-invoice.controller.ts
@@ -29,14 +29,12 @@ export class ReportIssuedInvoiceController extends ExpressController {
       return this.forbiddenError("Tenant ID not found");
     }
 
-    const { companySlug } = this.getUser();
     const { invoice_id } = this.req.params;
     const { format } = this.req.query as ReportIssueInvoiceByIdQueryRequestDTO;
 
     const result = await this.useCase.execute({
       invoice_id,
       companyId,
-      companySlug,
       format: format as RendererFormat,
     });
 
diff --git a/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/issued-invoices.routes.ts b/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/issued-invoices.routes.ts
index d34aa8c6..dd38a695 100644
--- a/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/issued-invoices.routes.ts
+++ b/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/issued-invoices.routes.ts
@@ -1,5 +1,5 @@
-import { mockUser, requireAuthenticated, requireCompanyContext } from "@erp/auth/api";
-import { type RequestWithAuth, type StartParams, validateRequest } from "@erp/core/api";
+import { type StartParams, validateRequest } from "@erp/core/api";
+import { requireIdentityTenant } from "@erp/identity/api";
 import { type NextFunction, type Request, type Response, Router } from "express";
 
 import {
@@ -25,21 +25,7 @@ export const issuedInvoicesRouter = (params: StartParams) => {
 
   // ----------------------------------------------
 
-  if (process.env.NODE_ENV === "development" || process.env.NODE_ENV === "production") {
-    // 🔐 Autenticación + Tenancy para TODO el router
-    router.use(
-      (req: Request, res: Response, next: NextFunction) =>
-        mockUser(req as RequestWithAuth, res, next) // Debe ir antes de las rutas protegidas
-    );
-  }
-
-  router.use([
-    (req: Request, res: Response, next: NextFunction) =>
-      requireAuthenticated()(req as RequestWithAuth, res, next), // Debe ir antes de las rutas protegidas
-
-    (req: Request, res: Response, next: NextFunction) =>
-      requireCompanyContext()(req as RequestWithAuth, res, next), // Debe ir antes de las rutas protegidas
-  ]);
+  router.use(...requireIdentityTenant(params));
 
   // ----------------------------------------------
 
diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/report-proforma.controller.ts b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/report-proforma.controller.ts
index 477dd10b..013e0a5a 100644
--- a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/report-proforma.controller.ts
+++ b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/report-proforma.controller.ts
@@ -29,14 +29,12 @@ export class ReportProformaController extends ExpressController {
       return this.forbiddenError("Tenant ID not found");
     }
 
-    const { companySlug } = this.getUser();
     const { proforma_id } = this.req.params;
     const { format } = this.req.query as ReportProformaByIdQueryRequestDTO;
 
     const result = await this.useCase.execute({
       proforma_id,
       companyId,
-      companySlug,
       format: format as RendererFormat,
     });
 
diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/express/proformas.routes.ts b/modules/customer-invoices/src/api/infrastructure/proformas/express/proformas.routes.ts
index d9a305d5..08dc53c5 100644
--- a/modules/customer-invoices/src/api/infrastructure/proformas/express/proformas.routes.ts
+++ b/modules/customer-invoices/src/api/infrastructure/proformas/express/proformas.routes.ts
@@ -1,5 +1,5 @@
-import { mockUser, requireAuthenticated, requireCompanyContext } from "@erp/auth/api";
-import { type RequestWithAuth, type StartParams, validateRequest } from "@erp/core/api";
+import { type StartParams, validateRequest } from "@erp/core/api";
+import { requireIdentityTenant } from "@erp/identity/api";
 import { type NextFunction, type Request, type Response, Router } from "express";
 
 import {
@@ -43,21 +43,7 @@ export const proformasRouter = (params: StartParams) => {
 
   // ----------------------------------------------
 
-  if (process.env.NODE_ENV === "development" || process.env.NODE_ENV === "production") {
-    // 🔐 Autenticación + Tenancy para TODO el router
-    router.use(
-      (req: Request, res: Response, next: NextFunction) =>
-        mockUser(req as RequestWithAuth, res, next) // Debe ir antes de las rutas protegidas
-    );
-  }
-
-  router.use([
-    (req: Request, res: Response, next: NextFunction) =>
-      requireAuthenticated()(req as RequestWithAuth, res, next), // Debe ir antes de las rutas protegidas
-
-    (req: Request, res: Response, next: NextFunction) =>
-      requireCompanyContext()(req as RequestWithAuth, res, next), // Debe ir antes de las rutas protegidas
-  ]);
+  router.use(...requireIdentityTenant(params));
 
   // ----------------------------------------------
 
diff --git a/modules/customer-invoices/tsconfig.json b/modules/customer-invoices/tsconfig.json
index 65a9250e..12ed1dd1 100644
--- a/modules/customer-invoices/tsconfig.json
+++ b/modules/customer-invoices/tsconfig.json
@@ -2,7 +2,8 @@
   "extends": "../../tsconfig.json",
   "compilerOptions": {
     "paths": {
-      "@erp/customer-invoices/*": ["./src/*"]
+      "@erp/customer-invoices/*": ["./src/*"],
+      "@erp/identity/*": ["../identity/src/*"]
     },
 
     "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
diff --git a/modules/factuges/package.json b/modules/factuges/package.json
index db0a138b..14da44d3 100644
--- a/modules/factuges/package.json
+++ b/modules/factuges/package.json
@@ -21,11 +21,11 @@
     "typescript": "^6.0.2"
   },
   "dependencies": {
-    "@erp/auth": "workspace:*",
     "@erp/core": "workspace:*",
     "@erp/catalogs": "workspace:*",
     "@erp/customer-invoices": "workspace:*",
     "@erp/customers": "workspace:*",
+    "@erp/identity": "workspace:*",
     "@repo/i18next": "workspace:*",
     "@repo/rdx-criteria": "workspace:*",
     "@repo/rdx-ddd": "workspace:*",
@@ -35,4 +35,4 @@
     "sequelize": "^6.37.8",
     "zod": "^4.3.6"
   }
-}
\ No newline at end of file
+}
diff --git a/modules/factuges/src/api/index.ts b/modules/factuges/src/api/index.ts
index 4de63c91..2c8d1493 100644
--- a/modules/factuges/src/api/index.ts
+++ b/modules/factuges/src/api/index.ts
@@ -6,7 +6,7 @@ import { buildFactugesDependencies } from "./infraestructure/di";
 export const factugesAPIModule: IModuleServer = {
   name: "factuges",
   version: "1.0.0",
-  dependencies: ["catalogs", "customers", "customer-invoices"],
+  dependencies: ["catalogs", "customers", "customer-invoices", "identity"],
 
   /**
    * Fase de SETUP
diff --git a/modules/factuges/src/api/infraestructure/express/factuges.routes.ts b/modules/factuges/src/api/infraestructure/express/factuges.routes.ts
index 0c085481..11883c4f 100644
--- a/modules/factuges/src/api/infraestructure/express/factuges.routes.ts
+++ b/modules/factuges/src/api/infraestructure/express/factuges.routes.ts
@@ -1,8 +1,8 @@
-import { mockUser, requireAuthenticated, requireCompanyContext } from "@erp/auth/api";
-import { type RequestWithAuth, type StartParams, validateRequest } from "@erp/core/api";
+import { type StartParams, validateRequest } from "@erp/core/api";
 import type { IProformaPublicServices } from "@erp/customer-invoices/api";
 import type { ICustomerPublicServices } from "@erp/customers/api";
 import { CreateProformaFromFactugesRequestSchema } from "@erp/factuges/common";
+import { requireIdentityTenant } from "@erp/identity/api";
 import { type NextFunction, type Request, type Response, Router } from "express";
 
 import type { FactugesInternalDeps } from "../di/factuges.di";
@@ -27,21 +27,7 @@ export const factugesRouter = (params: StartParams) => {
   const router: Router = Router({ mergeParams: true });
 
   // 🔐 Autenticación + Tenancy para TODO el router
-  if (process.env.NODE_ENV === "development" || process.env.NODE_ENV === "production") {
-    router.use(
-      (req: Request, res: Response, next: NextFunction) =>
-        mockUser(req as RequestWithAuth, res, next) // Debe ir antes de las rutas protegidas
-    );
-  }
-
-  //router.use(/*authenticateJWT(),*/ enforceTenant() /*checkTabContext*/);
-  router.use([
-    (req: Request, res: Response, next: NextFunction) =>
-      requireAuthenticated()(req as RequestWithAuth, res, next), // Debe ir antes de las rutas protegidas
-
-    (req: Request, res: Response, next: NextFunction) =>
-      requireCompanyContext()(req as RequestWithAuth, res, next), // Debe ir antes de las rutas protegidas
-  ]);
+  router.use(...requireIdentityTenant(params));
 
   // ----------------------------------------------
 
diff --git a/modules/factuges/tsconfig.json b/modules/factuges/tsconfig.json
index 76415a29..b7696d59 100644
--- a/modules/factuges/tsconfig.json
+++ b/modules/factuges/tsconfig.json
@@ -2,7 +2,8 @@
   "extends": "../../tsconfig.json",
   "compilerOptions": {
     "paths": {
-      "@erp/factuges/*": ["./src/*"]
+      "@erp/factuges/*": ["./src/*"],
+      "@erp/identity/*": ["../identity/src/*"]
     },
 
     "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",