diff --git a/como_auth/Cargo.toml b/como_auth/Cargo.toml
index d853b77..ed803d3 100644
--- a/como_auth/Cargo.toml
+++ b/como_auth/Cargo.toml
@@ -11,6 +11,7 @@ como_core.workspace = true
 como_domain.workspace = true
 como_infrastructure.workspace = true
 
+clap.workspace = true
 async-trait.workspace = true
 async-graphql.workspace = true
 async-graphql-axum.workspace = true
diff --git a/como_auth/src/oauth.rs b/como_auth/src/oauth.rs
index 5969a31..280a422 100644
--- a/como_auth/src/oauth.rs
+++ b/como_auth/src/oauth.rs
@@ -1,6 +1,23 @@
 use async_trait::async_trait;
 use oauth2::{basic::BasicClient, AuthUrl, ClientId, ClientSecret, RedirectUrl, TokenUrl};
-use std::{env, ops::Deref, sync::Arc};
+use std::ops::Deref;
+use std::sync::Arc;
+
+#[derive(Clone, clap::Args)]
+pub struct OAuthClientClap {
+    #[clap(flatten)]
+    zitadel: Option<ZitadelConfig>,
+
+    #[clap(flatten)]
+    noop: Option<NoopConfig>,
+}
+
+#[derive(Clone, clap::Args)]
+#[group(conflicts_with = "ZitadelConfig")]
+pub struct NoopConfig {
+    #[clap(env = "OAUTH_NOOP", long = "oauth-noop")]
+    pub oauth_noop: Option<bool>,
+}
 
 #[async_trait]
 pub trait OAuthClient {
@@ -18,6 +35,7 @@ impl OAuth {
     }
 }
 
+#[derive(Clone)]
 pub enum OAuthConfig {
     Zitadel(ZitadelConfig),
     Noop,
@@ -47,6 +65,7 @@ impl From<ZitadelConfig> for OAuth {
 }
 
 // -- Noop
+#[derive(clap::Args, Clone)]
 pub struct NoopOAuthClient;
 #[async_trait]
 impl OAuthClient for NoopOAuthClient {
@@ -57,11 +76,18 @@ impl OAuthClient for NoopOAuthClient {
 
 // -- Zitadel
 
+#[derive(clap::Args, Clone)]
+#[group(conflicts_with = "NoopConfig")]
 pub struct ZitadelConfig {
-    client_id: String,
-    client_secret: String,
-    redirect_url: String,
+    #[clap(env = "ZITADEL_AUTH_URL", long = "zitadel-auth-url")]
     auth_url: String,
+    #[clap(env = "ZITADEL_CLIENT_ID", long = "zitadel-client-id")]
+    client_id: String,
+    #[clap(env = "ZITADEL_CLIENT_SECRET", long = "zitadel-client-secret")]
+    client_secret: String,
+    #[clap(env = "ZITADEL_REDIRECT_URL", long = "zitadel-redirect-url")]
+    redirect_url: String,
+    #[clap(env = "ZITADEL_TOKEN_URL", long = "zitadel-token-url")]
     token_url: String,
 }
 
@@ -120,7 +146,15 @@ impl OAuthClient for ZitadelOAuthClient {
 
 #[cfg(test)]
 mod tests {
-    use crate::oauth::{OAuth, OAuthConfig, ZitadelConfig};
+    use crate::oauth::{OAuth, OAuthClientClap, OAuthConfig, ZitadelConfig};
+    use clap::Parser;
+
+    #[derive(Parser)]
+    #[command()]
+    pub struct Cli {
+        #[clap(flatten)]
+        options: OAuthClientClap,
+    }
 
     #[tokio::test]
     async fn test_noop() {
@@ -140,4 +174,9 @@ mod tests {
         .await
         .unwrap();
     }
+
+    #[tokio::test]
+    async fn test_parse_clap() {
+        let cmd = Cli::parse_from(&["--oauth-noop"]);
+    }
 }