diff --git a/ctl/server.go b/ctl/server.go
index d53bf81af..ac1dcd204 100644
--- a/ctl/server.go
+++ b/ctl/server.go
@@ -121,4 +121,11 @@ func BuildServerFlags(cmd *cobra.Command, srv *server.Command) {
 
 	// Toggle /schema/details endpoint.
 	flags.BoolVar(&srv.Config.SchemaDetailsOn, "schema-details-on", true, "Disable /schema/details endpoint")
+
+	// OAuth2.0 identity provider configuration
+	flags.BoolVar(&srv.Config.Auth.Enable, "auth.enable", false, "Enable AuthN/AuthZ of featurebase, disabled by default.")
+	flags.StringVar(&srv.Config.Auth.IdentityProviderURL, "auth.identity-provider-url", srv.Config.Auth.IdentityProviderURL, "Base URL for identity provider.")
+	flags.StringVar(&srv.Config.Auth.AuthorizeURL, "auth.authorize-url", srv.Config.Auth.AuthorizeURL, "Base URL for authorize.")
+	flags.StringVar(&srv.Config.Auth.UserInfoURL, "auth.user-info-url", srv.Config.Auth.UserInfoURL, "Base URL for user info.")
+	flags.StringVar(&srv.Config.Auth.ClientId, "auth.client-id", srv.Config.Auth.ClientId, "Application/Client ID")
 }
diff --git a/server/config.go b/server/config.go
index a42eb7917..da9c9e43a 100644
--- a/server/config.go
+++ b/server/config.go
@@ -240,6 +240,24 @@ type Config struct {
 
 	// Toggles /schema/details endpoint. If off, it returns empty.
 	SchemaDetailsOn bool `toml:"schema-details-on"`
+
+	// Enable AuthZ/AuthN
+	Auth struct {
+		// Enable AuthZ/AuthN for featurebase server
+		Enable bool `toml:"enable"`
+
+		// Base URL for identity provider
+		IdentityProviderURL string `toml:"identity-provider-url"`
+
+		// Authorize URL
+		AuthorizeURL string `toml:"authorize-url"`
+
+		// User info URL
+		UserInfoURL string `toml:"user-info-url"`
+
+		// Application/Client ID
+		ClientId string `toml:"client-id"`
+	} `toml:"auth"`
 }
 
 // Namespace returns the namespace to use based on the Future flag.
@@ -392,6 +410,13 @@ func NewConfig() *Config {
 	// Schema Details Toggle
 	c.SchemaDetailsOn = true
 
+	// AuthZ/AuthN disabled by default
+	c.Auth.Enable = false
+	c.Auth.IdentityProviderURL = ""
+	c.Auth.AuthorizeURL = ""
+	c.Auth.UserInfoURL = ""
+	c.Auth.ClientId = ""
+
 	return c
 }