| port | Port to run stubidp on | no | 8484 |
| issuer | OIDC issuer URL (defaults to http://localhost:<port>) | no | "" |
| client-id | OIDC client ID (auto-generated if not provided) | no | "" |
| client-secret | OIDC client secret (auto-generated if not provided) | no | "" |
| redirect-uri | Allowed redirect URI for the OIDC client | no | "" |
| skip-prompt | Auto-approve login/consent prompts for headless CI | no | true |
| default-user | JSON object of OIDC claims for the stub user | no | "" |
| preset | Preconfigure for a specific auth library (better-auth, next-auth) | no | "" |
| jwks-file | Path to a JWKS JSON file (key pair auto-generated if omitted) | no | "" |
| log-level | Log level (fatal, error, warn, info, debug, trace, silent) | no | "" |
| rate-limit-disabled | Disable rate limiting | no | true |
| rate-limit-window-ms | Rate limit time window in milliseconds (default 900000 = 15 min) | no | "" |
| rate-limit-max | Max requests per window per IP (default 100) | no | "" |
| enable-registration | Enable dynamic client registration (RFC 7591) and management (RFC 7592) | no | "" |
| registration-initial-access-token | Bearer token required to register new clients (omit for open registration) | no | "" |
| trust-proxy | Trust reverse proxy headers (X-Forwarded-*) | no | "" |
| https-redirect | Redirect HTTP requests to HTTPS | no | "" |
| security-headers | Enable security headers (CSP, HSTS, etc.) via helmet | no | "" |
| post-logout-redirect-uri | Allowed post-logout redirect URI | no | "" |
| public-client | Configure as public client (no client_secret, token_endpoint_auth_method=none). For SPAs and native apps | no | "" |
| version | Version of @cerberauth/stubidp to install (pin for reliable caching) | no | latest |