diff --git a/internal/config/audit.go b/internal/config/audit.go
index 321450c5bc..fbe9483b44 100644
--- a/internal/config/audit.go
+++ b/internal/config/audit.go
@@ -13,9 +13,9 @@ var _ defaulter = (*AuditConfig)(nil)
 // AuditConfig contains fields, which enable and configure
 // Flipt's various audit sink mechanisms.
 type AuditConfig struct {
-	Sinks  SinksConfig  `json:"sinks,omitempty" mapstructure:"sinks"`
-	Buffer BufferConfig `json:"buffer,omitempty" mapstructure:"buffer"`
-	Events []string     `json:"events,omitempty" mapstructure:"events"`
+	Sinks  SinksConfig  `json:"sinks,omitempty" mapstructure:"sinks" yaml:"sinks,omitempty"`
+	Buffer BufferConfig `json:"buffer,omitempty" mapstructure:"buffer" yaml:"buffer,omitempty"`
+	Events []string     `json:"events,omitempty" mapstructure:"events" yaml:"events,omitempty"`
 }
 
 // Enabled returns true if any nested sink is enabled
@@ -67,29 +67,29 @@ func (c *AuditConfig) validate() error {
 // SinksConfig contains configuration held in structures for the different sinks
 // that we will send audits to.
 type SinksConfig struct {
-	LogFile LogFileSinkConfig `json:"log,omitempty" mapstructure:"log"`
-	Webhook WebhookSinkConfig `json:"webhook,omitempty" mapstructure:"webhook"`
+	LogFile LogFileSinkConfig `json:"log,omitempty" mapstructure:"log" yaml:"log,omitempty"`
+	Webhook WebhookSinkConfig `json:"webhook,omitempty" mapstructure:"webhook" yaml:"webhook,omitempty"`
 }
 
 // WebhookSinkConfig contains configuration for sending POST requests to specific
 // URL as its configured.
 type WebhookSinkConfig struct {
-	Enabled            bool          `json:"enabled,omitempty" mapstructure:"enabled"`
-	URL                string        `json:"url,omitempty" mapstructure:"url"`
-	MaxBackoffDuration time.Duration `json:"maxBackoffDuration,omitempty" mapstructure:"max_backoff_duration"`
-	SigningSecret      string        `json:"signingSecret,omitempty" mapstructure:"signing_secret"`
+	Enabled            bool          `json:"enabled" mapstructure:"enabled" yaml:"enabled"`
+	URL                string        `json:"url,omitempty" mapstructure:"url" yaml:"url,omitempty"`
+	MaxBackoffDuration time.Duration `json:"maxBackoffDuration,omitempty" mapstructure:"max_backoff_duration" yaml:"max_backoff_duration,omitempty"`
+	SigningSecret      string        `json:"-" mapstructure:"signing_secret" yaml:"-"`
 }
 
 // LogFileSinkConfig contains fields that hold configuration for sending audits
 // to a log file.
 type LogFileSinkConfig struct {
-	Enabled bool   `json:"enabled,omitempty" mapstructure:"enabled"`
-	File    string `json:"file,omitempty" mapstructure:"file"`
+	Enabled bool   `json:"enabled,omitempty" mapstructure:"enabled" yaml:"enabled,omitempty"`
+	File    string `json:"file,omitempty" mapstructure:"file" yaml:"file,omitempty"`
 }
 
 // BufferConfig holds configuration for the buffering of sending the audit
 // events to the sinks.
 type BufferConfig struct {
-	Capacity    int           `json:"capacity,omitempty" mapstructure:"capacity"`
-	FlushPeriod time.Duration `json:"flushPeriod,omitempty" mapstructure:"flush_period"`
+	Capacity    int           `json:"capacity,omitempty" mapstructure:"capacity" yaml:"capacity,omitempty"`
+	FlushPeriod time.Duration `json:"flushPeriod,omitempty" mapstructure:"flush_period" yaml:"flush_period,omitempty"`
 }
diff --git a/internal/config/authentication.go b/internal/config/authentication.go
index b045307dad..fee5657e37 100644
--- a/internal/config/authentication.go
+++ b/internal/config/authentication.go
@@ -37,22 +37,22 @@ type AuthenticationConfig struct {
 	// Required designates whether authentication credentials are validated.
 	// If required == true, then authentication is required for all API endpoints.
 	// Else, authentication is not required and Flipt's APIs are not secured.
-	Required bool `json:"required,omitempty" mapstructure:"required"`
+	Required bool `json:"required" mapstructure:"required" yaml:"required"`
 
 	// Exclude allows you to skip enforcing authentication on the different
 	// top-level sections of the API.
 	// By default, given required == true, the API is fully protected.
 	Exclude struct {
 		// Management refers to the section of the API with the prefix /api/v1
-		Management bool `json:"management,omitempty" mapstructure:"management"`
+		Management bool `json:"management,omitempty" mapstructure:"management" yaml:"management,omitempty"`
 		// Metadata refers to the section of the API with the prefix /meta
-		Metadata bool `json:"metadata,omitempty" mapstructure:"metadata"`
+		Metadata bool `json:"metadata,omitempty" mapstructure:"metadata" yaml:"metadata,omitempty"`
 		// Evaluation refers to the section of the API with the prefix /evaluation/v1
-		Evaluation bool `json:"evaluation,omitempty" mapstructure:"evaluation"`
-	} `json:"exclude,omitempty" mapstructure:"exclude"`
+		Evaluation bool `json:"evaluation,omitempty" mapstructure:"evaluation" yaml:"evaluation,omitempty"`
+	} `json:"exclude,omitempty" mapstructure:"exclude" yaml:"exclude,omitempty"`
 
-	Session AuthenticationSession `json:"session,omitempty" mapstructure:"session"`
-	Methods AuthenticationMethods `json:"methods,omitempty" mapstructure:"methods"`
+	Session AuthenticationSession `json:"session,omitempty" mapstructure:"session" yaml:"session,omitempty"`
+	Methods AuthenticationMethods `json:"methods,omitempty" mapstructure:"methods" yaml:"methods,omitempty"`
 }
 
 // Enabled returns true if authentication is marked as required
@@ -181,16 +181,16 @@ func getHostname(rawurl string) (string, error) {
 // establishing authentication via HTTP.
 type AuthenticationSession struct {
 	// Domain is the domain on which to register session cookies.
-	Domain string `json:"domain,omitempty" mapstructure:"domain"`
+	Domain string `json:"domain,omitempty" mapstructure:"domain" yaml:"domain,omitempty"`
 	// Secure sets the secure property (i.e. HTTPS only) on both the state and token cookies.
-	Secure bool `json:"secure" mapstructure:"secure"`
+	Secure bool `json:"secure,omitempty" mapstructure:"secure" yaml:"secure,omitempty"`
 	// TokenLifetime is the duration of the flipt client token generated once
 	// authentication has been established via a session compatible method.
-	TokenLifetime time.Duration `json:"tokenLifetime,omitempty" mapstructure:"token_lifetime"`
+	TokenLifetime time.Duration `json:"tokenLifetime,omitempty" mapstructure:"token_lifetime" yaml:"token_lifetime,omitempty"`
 	// StateLifetime is the lifetime duration of the state cookie.
-	StateLifetime time.Duration `json:"stateLifetime,omitempty" mapstructure:"state_lifetime"`
+	StateLifetime time.Duration `json:"stateLifetime,omitempty" mapstructure:"state_lifetime" yaml:"state_lifetime,omitempty"`
 	// CSRF configures CSRF provention mechanisms.
-	CSRF AuthenticationSessionCSRF `json:"csrf,omitempty" mapstructure:"csrf"`
+	CSRF AuthenticationSessionCSRF `json:"csrf,omitempty" mapstructure:"csrf" yaml:"csrf,omitempty"`
 }
 
 // AuthenticationSessionCSRF configures cross-site request forgery prevention.
@@ -202,10 +202,10 @@ type AuthenticationSessionCSRF struct {
 // AuthenticationMethods is a set of configuration for each authentication
 // method available for use within Flipt.
 type AuthenticationMethods struct {
-	Token      AuthenticationMethod[AuthenticationMethodTokenConfig]      `json:"token,omitempty" mapstructure:"token"`
-	Github     AuthenticationMethod[AuthenticationMethodGithubConfig]     `json:"github,omitempty" mapstructure:"github"`
-	OIDC       AuthenticationMethod[AuthenticationMethodOIDCConfig]       `json:"oidc,omitempty" mapstructure:"oidc"`
-	Kubernetes AuthenticationMethod[AuthenticationMethodKubernetesConfig] `json:"kubernetes,omitempty" mapstructure:"kubernetes"`
+	Token      AuthenticationMethod[AuthenticationMethodTokenConfig]      `json:"token,omitempty" mapstructure:"token" yaml:"token,omitempty"`
+	Github     AuthenticationMethod[AuthenticationMethodGithubConfig]     `json:"github,omitempty" mapstructure:"github" yaml:"github,omitempty"`
+	OIDC       AuthenticationMethod[AuthenticationMethodOIDCConfig]       `json:"oidc,omitempty" mapstructure:"oidc" yaml:"oidc,omitempty"`
+	Kubernetes AuthenticationMethod[AuthenticationMethodKubernetesConfig] `json:"kubernetes,omitempty" mapstructure:"kubernetes" yaml:"kubernetes,omitempty"`
 }
 
 // AllMethods returns all the AuthenticationMethod instances available.
@@ -288,8 +288,8 @@ type AuthenticationMethodInfoProvider interface {
 // nolint:musttag
 type AuthenticationMethod[C AuthenticationMethodInfoProvider] struct {
 	Method  C                              `mapstructure:",squash"`
-	Enabled bool                           `json:"enabled,omitempty" mapstructure:"enabled"`
-	Cleanup *AuthenticationCleanupSchedule `json:"cleanup,omitempty" mapstructure:"cleanup,omitempty"`
+	Enabled bool                           `json:"enabled,omitempty" mapstructure:"enabled" yaml:"enabled,omitempty"`
+	Cleanup *AuthenticationCleanupSchedule `json:"cleanup,omitempty" mapstructure:"cleanup,omitempty" yaml:"cleanup,omitempty"`
 }
 
 func (a *AuthenticationMethod[C]) setDefaults(defaults map[string]any) {
@@ -317,7 +317,7 @@ func (a *AuthenticationMethod[C]) info() StaticAuthenticationMethodInfo {
 // This authentication method supports the ability to create static tokens via the
 // /auth/v1/method/token prefix of endpoints.
 type AuthenticationMethodTokenConfig struct {
-	Bootstrap AuthenticationMethodTokenBootstrapConfig `json:"bootstrap" mapstructure:"bootstrap"`
+	Bootstrap AuthenticationMethodTokenBootstrapConfig `json:"bootstrap" mapstructure:"bootstrap" yaml:"bootstrap"`
 }
 
 func (a AuthenticationMethodTokenConfig) setDefaults(map[string]any) {}
@@ -333,15 +333,15 @@ func (a AuthenticationMethodTokenConfig) info() AuthenticationMethodInfo {
 // AuthenticationMethodTokenBootstrapConfig contains fields used to configure the
 // bootstrap process for the authentication method "token".
 type AuthenticationMethodTokenBootstrapConfig struct {
-	Token      string        `json:"-" mapstructure:"token"`
-	Expiration time.Duration `json:"expiration,omitempty" mapstructure:"expiration"`
+	Token      string        `json:"-" mapstructure:"token" yaml:"token"`
+	Expiration time.Duration `json:"expiration,omitempty" mapstructure:"expiration" yaml:"expiration,omitempty"`
 }
 
 // AuthenticationMethodOIDCConfig configures the OIDC authentication method.
 // This method can be used to establish browser based sessions.
 type AuthenticationMethodOIDCConfig struct {
-	EmailMatches []string                                    `json:"emailMatches,omitempty" mapstructure:"email_matches"`
-	Providers    map[string]AuthenticationMethodOIDCProvider `json:"providers,omitempty" mapstructure:"providers"`
+	EmailMatches []string                                    `json:"emailMatches,omitempty" mapstructure:"email_matches" yaml:"email_matches,omitempty"`
+	Providers    map[string]AuthenticationMethodOIDCProvider `json:"providers,omitempty" mapstructure:"providers" yaml:"providers,omitempty"`
 }
 
 func (a AuthenticationMethodOIDCConfig) setDefaults(map[string]any) {}
@@ -376,18 +376,18 @@ func (a AuthenticationMethodOIDCConfig) info() AuthenticationMethodInfo {
 
 // AuthenticationOIDCProvider configures provider credentials
 type AuthenticationMethodOIDCProvider struct {
-	IssuerURL       string   `json:"issuerURL,omitempty" mapstructure:"issuer_url"`
-	ClientID        string   `json:"clientID,omitempty" mapstructure:"client_id"`
-	ClientSecret    string   `json:"clientSecret,omitempty" mapstructure:"client_secret"`
-	RedirectAddress string   `json:"redirectAddress,omitempty" mapstructure:"redirect_address"`
-	Scopes          []string `json:"scopes,omitempty" mapstructure:"scopes"`
-	UsePKCE         bool     `json:"usePKCE,omitempty" mapstructure:"use_pkce"`
+	IssuerURL       string   `json:"issuerURL,omitempty" mapstructure:"issuer_url" yaml:"issuer_url,omitempty"`
+	ClientID        string   `json:"clientID,omitempty" mapstructure:"client_id" yaml:"client_id,omitempty"`
+	ClientSecret    string   `json:"-" mapstructure:"client_secret" yaml:"-"`
+	RedirectAddress string   `json:"redirectAddress,omitempty" mapstructure:"redirect_address" yaml:"redirect_address,omitempty"`
+	Scopes          []string `json:"scopes,omitempty" mapstructure:"scopes" yaml:"scopes,omitempty"`
+	UsePKCE         bool     `json:"usePKCE,omitempty" mapstructure:"use_pkce" yaml:"use_pkce,omitempty"`
 }
 
 // AuthenticationCleanupSchedule is used to configure a cleanup goroutine.
 type AuthenticationCleanupSchedule struct {
-	Interval    time.Duration `json:"interval,omitempty" mapstructure:"interval"`
-	GracePeriod time.Duration `json:"gracePeriod,omitempty" mapstructure:"grace_period"`
+	Interval    time.Duration `json:"interval,omitempty" mapstructure:"interval" yaml:"interval,omitempty"`
+	GracePeriod time.Duration `json:"gracePeriod,omitempty" mapstructure:"grace_period" yaml:"grace_period,omitempty"`
 }
 
 // AuthenticationMethodKubernetesConfig contains the fields necessary for the Kubernetes authentication
@@ -397,13 +397,13 @@ type AuthenticationMethodKubernetesConfig struct {
 	// DiscoveryURL is the URL to the local Kubernetes cluster serving the "well-known" OIDC discovery endpoint.
 	// https://openid.net/specs/openid-connect-discovery-1_0.html
 	// The URL is used to fetch the OIDC configuration and subsequently the JWKS certificates.
-	DiscoveryURL string `json:"discoveryURL,omitempty" mapstructure:"discovery_url"`
+	DiscoveryURL string `json:"discoveryURL,omitempty" mapstructure:"discovery_url" yaml:"discovery_url,omitempty"`
 	// CAPath is the path on disk to the trusted certificate authority certificate for validating
 	// HTTPS requests to the issuer.
-	CAPath string `json:"caPath,omitempty" mapstructure:"ca_path"`
+	CAPath string `json:"caPath,omitempty" mapstructure:"ca_path" yaml:"ca_path,omitempty"`
 	// ServiceAccountTokenPath is the location on disk to the Flipt instances service account token.
 	// This should be the token issued for the service account associated with Flipt in the environment.
-	ServiceAccountTokenPath string `json:"serviceAccountTokenPath,omitempty" mapstructure:"service_account_token_path"`
+	ServiceAccountTokenPath string `json:"serviceAccountTokenPath,omitempty" mapstructure:"service_account_token_path" yaml:"service_account_token_path,omitempty"`
 }
 
 func (a AuthenticationMethodKubernetesConfig) setDefaults(defaults map[string]any) {
@@ -423,10 +423,10 @@ func (a AuthenticationMethodKubernetesConfig) info() AuthenticationMethodInfo {
 // AuthenticationMethodGithubConfig contains configuration and information for completing an OAuth
 // 2.0 flow with GitHub as a provider.
 type AuthenticationMethodGithubConfig struct {
-	ClientSecret    string   `json:"clientSecret,omitempty" mapstructure:"client_secret"`
-	ClientId        string   `json:"clientId,omitempty" mapstructure:"client_id"`
-	RedirectAddress string   `json:"redirectAddress,omitempty" mapstructure:"redirect_address"`
-	Scopes          []string `json:"scopes,omitempty" mapstructure:"scopes"`
+	ClientId        string   `json:"clientId,omitempty" mapstructure:"client_id" yaml:"client_id,omitempty"`
+	ClientSecret    string   `json:"-" mapstructure:"client_secret" yaml:"-"`
+	RedirectAddress string   `json:"redirectAddress,omitempty" mapstructure:"redirect_address" yaml:"redirect_address,omitempty"`
+	Scopes          []string `json:"scopes,omitempty" mapstructure:"scopes" yaml:"scopes,omitempty"`
 }
 
 func (a AuthenticationMethodGithubConfig) setDefaults(defaults map[string]any) {}
diff --git a/internal/config/cache.go b/internal/config/cache.go
index a096b216b6..54161cbb6a 100644
--- a/internal/config/cache.go
+++ b/internal/config/cache.go
@@ -15,11 +15,11 @@ var _ defaulter = (*CacheConfig)(nil)
 //
 // Currently, flipt support in-memory and redis backed caching.
 type CacheConfig struct {
-	Enabled bool              `json:"enabled" mapstructure:"enabled"`
-	TTL     time.Duration     `json:"ttl,omitempty" mapstructure:"ttl"`
-	Backend CacheBackend      `json:"backend,omitempty" mapstructure:"backend"`
-	Memory  MemoryCacheConfig `json:"memory,omitempty" mapstructure:"memory"`
-	Redis   RedisCacheConfig  `json:"redis,omitempty" mapstructure:"redis"`
+	Enabled bool              `json:"enabled" mapstructure:"enabled" yaml:"enabled"`
+	TTL     time.Duration     `json:"ttl,omitempty" mapstructure:"ttl" yaml:"ttl,omitempty"`
+	Backend CacheBackend      `json:"backend,omitempty" mapstructure:"backend" yaml:"backend,omitempty"`
+	Memory  MemoryCacheConfig `json:"memory,omitempty" mapstructure:"memory" yaml:"memory,omitempty"`
+	Redis   RedisCacheConfig  `json:"redis,omitempty" mapstructure:"redis" yaml:"redis,omitempty"`
 }
 
 func (c *CacheConfig) setDefaults(v *viper.Viper) error {
@@ -75,19 +75,19 @@ var (
 
 // MemoryCacheConfig contains fields, which configure in-memory caching.
 type MemoryCacheConfig struct {
-	EvictionInterval time.Duration `json:"evictionInterval,omitempty" mapstructure:"eviction_interval"`
+	EvictionInterval time.Duration `json:"evictionInterval,omitempty" mapstructure:"eviction_interval" yaml:"eviction_interval,omitempty"`
 }
 
 // RedisCacheConfig contains fields, which configure the connection
 // credentials for redis backed caching.
 type RedisCacheConfig struct {
-	Host            string        `json:"host,omitempty" mapstructure:"host"`
-	Port            int           `json:"port,omitempty" mapstructure:"port"`
-	RequireTLS      bool          `json:"requireTLS" mapstructure:"require_tls"`
-	Password        string        `json:"password,omitempty" mapstructure:"password"`
-	DB              int           `json:"db,omitempty" mapstructure:"db"`
-	PoolSize        int           `json:"poolSize" mapstructure:"pool_size"`
-	MinIdleConn     int           `json:"minIdleConn" mapstructure:"min_idle_conn"`
-	ConnMaxIdleTime time.Duration `json:"connMaxIdleTime" mapstructure:"conn_max_idle_time"`
-	NetTimeout      time.Duration `json:"netTimeout" mapstructure:"net_timeout"`
+	Host            string        `json:"host,omitempty" mapstructure:"host" yaml:"host,omitempty"`
+	Port            int           `json:"port,omitempty" mapstructure:"port" yaml:"port,omitempty"`
+	RequireTLS      bool          `json:"requireTLS,omitempty" mapstructure:"require_tls" yaml:"require_tls,omitempty"`
+	Password        string        `json:"-" mapstructure:"password" yaml:"-"`
+	DB              int           `json:"db,omitempty" mapstructure:"db" yaml:"db,omitempty"`
+	PoolSize        int           `json:"poolSize" mapstructure:"pool_size" yaml:"pool_size"`
+	MinIdleConn     int           `json:"minIdleConn" mapstructure:"min_idle_conn" yaml:"min_idle_conn"`
+	ConnMaxIdleTime time.Duration `json:"connMaxIdleTime" mapstructure:"conn_max_idle_time" yaml:"conn_max_idle_time"`
+	NetTimeout      time.Duration `json:"netTimeout" mapstructure:"net_timeout" yaml:"net_timeout"`
 }
diff --git a/internal/config/config.go b/internal/config/config.go
index b59c185065..b776d1e74a 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -42,19 +42,19 @@ var DecodeHooks = []mapstructure.DecodeHookFunc{
 // then this will be called after unmarshalling, such that the function can emit
 // any errors derived from the resulting state of the configuration.
 type Config struct {
-	Version        string               `json:"version,omitempty" mapstructure:"version,omitempty"`
-	Experimental   ExperimentalConfig   `json:"experimental,omitempty" mapstructure:"experimental"`
-	Log            LogConfig            `json:"log,omitempty" mapstructure:"log"`
-	UI             UIConfig             `json:"ui,omitempty" mapstructure:"ui"`
-	Cors           CorsConfig           `json:"cors,omitempty" mapstructure:"cors"`
-	Cache          CacheConfig          `json:"cache,omitempty" mapstructure:"cache"`
-	Server         ServerConfig         `json:"server,omitempty" mapstructure:"server"`
-	Storage        StorageConfig        `json:"storage,omitempty" mapstructure:"storage"`
-	Tracing        TracingConfig        `json:"tracing,omitempty" mapstructure:"tracing"`
-	Database       DatabaseConfig       `json:"db,omitempty" mapstructure:"db"`
-	Meta           MetaConfig           `json:"meta,omitempty" mapstructure:"meta"`
-	Authentication AuthenticationConfig `json:"authentication,omitempty" mapstructure:"authentication"`
-	Audit          AuditConfig          `json:"audit,omitempty" mapstructure:"audit"`
+	Version        string               `json:"version,omitempty" mapstructure:"version,omitempty" yaml:"version,omitempty"`
+	Experimental   ExperimentalConfig   `json:"experimental,omitempty" mapstructure:"experimental" yaml:"experimental,omitempty"`
+	Log            LogConfig            `json:"log,omitempty" mapstructure:"log" yaml:"log,omitempty"`
+	UI             UIConfig             `json:"ui,omitempty" mapstructure:"ui" yaml:"ui,omitempty"`
+	Cors           CorsConfig           `json:"cors,omitempty" mapstructure:"cors" yaml:"cors,omitempty"`
+	Cache          CacheConfig          `json:"cache,omitempty" mapstructure:"cache" yaml:"cache,omitempty"`
+	Server         ServerConfig         `json:"server,omitempty" mapstructure:"server" yaml:"server,omitempty"`
+	Storage        StorageConfig        `json:"storage,omitempty" mapstructure:"storage" yaml:"storage,omitempty"`
+	Tracing        TracingConfig        `json:"tracing,omitempty" mapstructure:"tracing" yaml:"tracing,omitempty"`
+	Database       DatabaseConfig       `json:"db,omitempty" mapstructure:"db" yaml:"db,omitempty"`
+	Meta           MetaConfig           `json:"meta,omitempty" mapstructure:"meta" yaml:"meta,omitempty"`
+	Authentication AuthenticationConfig `json:"authentication,omitempty" mapstructure:"authentication" yaml:"authentication,omitempty"`
+	Audit          AuditConfig          `json:"audit,omitempty" mapstructure:"audit" yaml:"audit,omitempty"`
 }
 
 type Result struct {
diff --git a/internal/config/cors.go b/internal/config/cors.go
index 6049a60dc6..7bcb019d65 100644
--- a/internal/config/cors.go
+++ b/internal/config/cors.go
@@ -8,8 +8,8 @@ var _ defaulter = (*CorsConfig)(nil)
 // CorsConfig contains fields, which configure behaviour in the
 // HTTPServer relating to the CORS header-based mechanisms.
 type CorsConfig struct {
-	Enabled        bool     `json:"enabled" mapstructure:"enabled"`
-	AllowedOrigins []string `json:"allowedOrigins,omitempty" mapstructure:"allowed_origins"`
+	Enabled        bool     `json:"enabled" mapstructure:"enabled" yaml:"enabled"`
+	AllowedOrigins []string `json:"allowedOrigins,omitempty" mapstructure:"allowed_origins" yaml:"allowedOrigins,omitempty"`
 }
 
 func (c *CorsConfig) setDefaults(v *viper.Viper) error {
diff --git a/internal/config/database.go b/internal/config/database.go
index f42c129883..a959d14951 100644
--- a/internal/config/database.go
+++ b/internal/config/database.go
@@ -29,17 +29,17 @@ const (
 //
 // Flipt currently supports SQLite, Postgres and MySQL backends.
 type DatabaseConfig struct {
-	URL                       string           `json:"url,omitempty" mapstructure:"url,omitempty"`
-	MaxIdleConn               int              `json:"maxIdleConn,omitempty" mapstructure:"max_idle_conn"`
-	MaxOpenConn               int              `json:"maxOpenConn,omitempty" mapstructure:"max_open_conn"`
-	ConnMaxLifetime           time.Duration    `json:"connMaxLifetime,omitempty" mapstructure:"conn_max_lifetime"`
-	Name                      string           `json:"name,omitempty" mapstructure:"name,omitempty"`
-	User                      string           `json:"user,omitempty" mapstructure:"user,omitempty"`
-	Password                  string           `json:"password,omitempty" mapstructure:"password,omitempty"`
-	Host                      string           `json:"host,omitempty" mapstructure:"host,omitempty"`
-	Port                      int              `json:"port,omitempty" mapstructure:"port,omitempty"`
-	Protocol                  DatabaseProtocol `json:"protocol,omitempty" mapstructure:"protocol,omitempty"`
-	PreparedStatementsEnabled bool             `json:"preparedStatementsEnabled,omitempty" mapstructure:"prepared_statements_enabled"`
+	URL                       string           `json:"url,omitempty" mapstructure:"url,omitempty" yaml:"url,omitempty"`
+	MaxIdleConn               int              `json:"maxIdleConn,omitempty" mapstructure:"max_idle_conn" yaml:"max_idle_conn,omitempty"`
+	MaxOpenConn               int              `json:"maxOpenConn,omitempty" mapstructure:"max_open_conn" yaml:"max_open_conn,omitempty"`
+	ConnMaxLifetime           time.Duration    `json:"connMaxLifetime,omitempty" mapstructure:"conn_max_lifetime" yaml:"conn_max_lifetime,omitempty"`
+	Name                      string           `json:"name,omitempty" mapstructure:"name,omitempty" yaml:"name,omitempty"`
+	User                      string           `json:"user,omitempty" mapstructure:"user,omitempty" yaml:"user,omitempty"`
+	Password                  string           `json:"-" mapstructure:"password,omitempty" yaml:"-"`
+	Host                      string           `json:"host,omitempty" mapstructure:"host,omitempty" yaml:"host,omitempty"`
+	Port                      int              `json:"port,omitempty" mapstructure:"port,omitempty" yaml:"port,omitempty"`
+	Protocol                  DatabaseProtocol `json:"protocol,omitempty" mapstructure:"protocol,omitempty" yaml:"protocol,omitempty"`
+	PreparedStatementsEnabled bool             `json:"preparedStatementsEnabled,omitempty" mapstructure:"prepared_statements_enabled" yaml:"prepared_statements_enabled,omitempty"`
 }
 
 func (c *DatabaseConfig) setDefaults(v *viper.Viper) error {
diff --git a/internal/config/experimental.go b/internal/config/experimental.go
index 5e28b4f805..8a7fd2258f 100644
--- a/internal/config/experimental.go
+++ b/internal/config/experimental.go
@@ -20,5 +20,5 @@ func (c *ExperimentalConfig) deprecations(v *viper.Viper) []deprecated {
 // ExperimentalFlag is a structure which has properties to configure
 // experimental feature enablement.
 type ExperimentalFlag struct {
-	Enabled bool `json:"enabled,omitempty" mapstructure:"enabled"`
+	Enabled bool `json:"enabled,omitempty" mapstructure:"enabled" yaml:"enabled,omitempty"`
 }
diff --git a/internal/config/log.go b/internal/config/log.go
index b4fec764d5..dcf773d759 100644
--- a/internal/config/log.go
+++ b/internal/config/log.go
@@ -12,17 +12,17 @@ var _ defaulter = (*LogConfig)(nil)
 // LogConfig contains fields which control, direct and filter
 // the logging telemetry produces by Flipt.
 type LogConfig struct {
-	Level     string      `json:"level,omitempty" mapstructure:"level"`
-	File      string      `json:"file,omitempty" mapstructure:"file"`
-	Encoding  LogEncoding `json:"encoding,omitempty" mapstructure:"encoding"`
-	GRPCLevel string      `json:"grpcLevel,omitempty" mapstructure:"grpc_level"`
-	Keys      LogKeys     `json:"keys" mapstructure:"keys"`
+	Level     string      `json:"level,omitempty" mapstructure:"level" yaml:"level,omitempty"`
+	File      string      `json:"file,omitempty" mapstructure:"file" yaml:"file,omitempty"`
+	Encoding  LogEncoding `json:"encoding,omitempty" mapstructure:"encoding" yaml:"encoding,omitempty"`
+	GRPCLevel string      `json:"grpcLevel,omitempty" mapstructure:"grpc_level" yaml:"grpc_level,omitempty"`
+	Keys      LogKeys     `json:"keys,omitempty" mapstructure:"keys" yaml:"keys,omitempty"`
 }
 
 type LogKeys struct {
-	Time    string `json:"time" mapstructure:"time"`
-	Level   string `json:"level" mapstructure:"level"`
-	Message string `json:"message" mapstructure:"message"`
+	Time    string `json:"time,omitempty" mapstructure:"time" yaml:"time,omitempty"`
+	Level   string `json:"level,omitempty" mapstructure:"level" yaml:"level,omitempty"`
+	Message string `json:"message,omitempty" mapstructure:"message" yaml:"message,omitempty"`
 }
 
 func (c *LogConfig) setDefaults(v *viper.Viper) error {
diff --git a/internal/config/meta.go b/internal/config/meta.go
index c3a7b28d93..546c864509 100644
--- a/internal/config/meta.go
+++ b/internal/config/meta.go
@@ -7,9 +7,9 @@ var _ defaulter = (*MetaConfig)(nil)
 
 // MetaConfig contains a variety of meta configuration fields.
 type MetaConfig struct {
-	CheckForUpdates  bool   `json:"checkForUpdates" mapstructure:"check_for_updates"`
-	TelemetryEnabled bool   `json:"telemetryEnabled" mapstructure:"telemetry_enabled"`
-	StateDirectory   string `json:"stateDirectory" mapstructure:"state_directory"`
+	CheckForUpdates  bool   `json:"checkForUpdates" mapstructure:"check_for_updates" yaml:"check_for_updates"`
+	TelemetryEnabled bool   `json:"telemetryEnabled" mapstructure:"telemetry_enabled" yaml:"telemetry_enabled"`
+	StateDirectory   string `json:"stateDirectory,omitempty" mapstructure:"state_directory" yaml:"state_directory,omitempty"`
 }
 
 func (c *MetaConfig) setDefaults(v *viper.Viper) error {
diff --git a/internal/config/server.go b/internal/config/server.go
index b7c45dfe25..a4a79fc06a 100644
--- a/internal/config/server.go
+++ b/internal/config/server.go
@@ -13,13 +13,13 @@ var _ defaulter = (*ServerConfig)(nil)
 // ServerConfig contains fields, which configure both HTTP and gRPC
 // API serving.
 type ServerConfig struct {
-	Host      string `json:"host,omitempty" mapstructure:"host"`
-	Protocol  Scheme `json:"protocol,omitempty" mapstructure:"protocol"`
-	HTTPPort  int    `json:"httpPort,omitempty" mapstructure:"http_port"`
-	HTTPSPort int    `json:"httpsPort,omitempty" mapstructure:"https_port"`
-	GRPCPort  int    `json:"grpcPort,omitempty" mapstructure:"grpc_port"`
-	CertFile  string `json:"certFile,omitempty" mapstructure:"cert_file"`
-	CertKey   string `json:"certKey,omitempty" mapstructure:"cert_key"`
+	Host      string `json:"host,omitempty" mapstructure:"host" yaml:"host,omitempty"`
+	Protocol  Scheme `json:"protocol,omitempty" mapstructure:"protocol" yaml:"protocol,omitempty"`
+	HTTPPort  int    `json:"httpPort,omitempty" mapstructure:"http_port" yaml:"http_port,omitempty"`
+	HTTPSPort int    `json:"httpsPort,omitempty" mapstructure:"https_port" yaml:"https_port,omitempty"`
+	GRPCPort  int    `json:"grpcPort,omitempty" mapstructure:"grpc_port" yaml:"grpc_port,omitempty"`
+	CertFile  string `json:"certFile,omitempty" mapstructure:"cert_file" yaml:"cert_file,omitempty"`
+	CertKey   string `json:"-" mapstructure:"cert_key" yaml:"-"`
 }
 
 func (c *ServerConfig) setDefaults(v *viper.Viper) error {
diff --git a/internal/config/storage.go b/internal/config/storage.go
index 54b56e079a..87a25088df 100644
--- a/internal/config/storage.go
+++ b/internal/config/storage.go
@@ -28,11 +28,11 @@ const (
 // StorageConfig contains fields which will configure the type of backend in which Flipt will serve
 // flag state.
 type StorageConfig struct {
-	Type     StorageType `json:"type,omitempty" mapstructure:"type"`
-	Local    *Local      `json:"local,omitempty" mapstructure:"local,omitempty"`
-	Git      *Git        `json:"git,omitempty" mapstructure:"git,omitempty"`
-	Object   *Object     `json:"object,omitempty" mapstructure:"object,omitempty"`
-	ReadOnly *bool       `json:"readOnly,omitempty" mapstructure:"readOnly,omitempty"`
+	Type     StorageType `json:"type,omitempty" mapstructure:"type" yaml:"type,omitempty"`
+	Local    *Local      `json:"local,omitempty" mapstructure:"local,omitempty" yaml:"local,omitempty"`
+	Git      *Git        `json:"git,omitempty" mapstructure:"git,omitempty" yaml:"git,omitempty"`
+	Object   *Object     `json:"object,omitempty" mapstructure:"object,omitempty" yaml:"object,omitempty"`
+	ReadOnly *bool       `json:"readOnly,omitempty" mapstructure:"readOnly,omitempty" yaml:"read_only,omitempty"`
 }
 
 func (c *StorageConfig) setDefaults(v *viper.Viper) error {
@@ -102,16 +102,16 @@ type Local struct {
 
 // Git contains configuration for referencing a git repository.
 type Git struct {
-	Repository     string         `json:"repository,omitempty" mapstructure:"repository"`
-	Ref            string         `json:"ref,omitempty" mapstructure:"ref"`
-	PollInterval   time.Duration  `json:"pollInterval,omitempty" mapstructure:"poll_interval"`
-	Authentication Authentication `json:"authentication,omitempty" mapstructure:"authentication,omitempty"`
+	Repository     string         `json:"repository,omitempty" mapstructure:"repository" yaml:"repository,omitempty"`
+	Ref            string         `json:"ref,omitempty" mapstructure:"ref" yaml:"ref,omitempty"`
+	PollInterval   time.Duration  `json:"pollInterval,omitempty" mapstructure:"poll_interval" yaml:"poll_interval,omitempty"`
+	Authentication Authentication `json:"authentication,omitempty" mapstructure:"authentication,omitempty" yaml:"authentication,omitempty"`
 }
 
 // Object contains configuration of readonly object storage.
 type Object struct {
-	Type ObjectSubStorageType `json:"type,omitempty" mapstructure:"type"`
-	S3   *S3                  `json:"s3,omitempty" mapstructure:"s3,omitempty"`
+	Type ObjectSubStorageType `json:"type,omitempty" mapstructure:"type" yaml:"type,omitempty"`
+	S3   *S3                  `json:"s3,omitempty" mapstructure:"s3,omitempty" yaml:"s3,omitempty"`
 }
 
 // validate is only called if storage.type == "object"
@@ -129,11 +129,11 @@ func (o *Object) validate() error {
 
 // S3 contains configuration for referencing a s3 bucket
 type S3 struct {
-	Endpoint     string        `json:"endpoint,omitempty" mapstructure:"endpoint"`
-	Bucket       string        `json:"bucket,omitempty" mapstructure:"bucket"`
-	Prefix       string        `json:"prefix,omitempty" mapstructure:"prefix"`
-	Region       string        `json:"region,omitempty" mapstructure:"region"`
-	PollInterval time.Duration `json:"pollInterval,omitempty" mapstructure:"poll_interval"`
+	Endpoint     string        `json:"endpoint,omitempty" mapstructure:"endpoint" yaml:"endpoint,omitempty"`
+	Bucket       string        `json:"bucket,omitempty" mapstructure:"bucket" yaml:"bucket,omitempty"`
+	Prefix       string        `json:"prefix,omitempty" mapstructure:"prefix" yaml:"prefix,omitempty"`
+	Region       string        `json:"region,omitempty" mapstructure:"region" yaml:"region,omitempty"`
+	PollInterval time.Duration `json:"pollInterval,omitempty" mapstructure:"poll_interval" yaml:"poll_interval,omitempty"`
 }
 
 // Authentication holds structures for various types of auth we support.
@@ -143,8 +143,8 @@ type S3 struct {
 // not all inputs are given but only partially, we will return a validation error.
 // (e.g. if username for basic auth is given, and token is also given a validation error will be returned)
 type Authentication struct {
-	BasicAuth *BasicAuth `json:"basic,omitempty" mapstructure:"basic,omitempty"`
-	TokenAuth *TokenAuth `json:"token,omitempty" mapstructure:"token,omitempty"`
+	BasicAuth *BasicAuth `json:"basic,omitempty" mapstructure:"basic,omitempty" yaml:"basic,omitempty"`
+	TokenAuth *TokenAuth `json:"token,omitempty" mapstructure:"token,omitempty" yaml:"token,omitempty"`
 }
 
 func (a *Authentication) validate() error {
@@ -165,8 +165,8 @@ func (a *Authentication) validate() error {
 // BasicAuth has configuration for authenticating with private git repositories
 // with basic auth.
 type BasicAuth struct {
-	Username string `json:"username,omitempty" mapstructure:"username"`
-	Password string `json:"password,omitempty" mapstructure:"password"`
+	Username string `json:"username,omitempty" mapstructure:"username" yaml:"username,omitempty"`
+	Password string `json:"-" mapstructure:"password" yaml:"-"`
 }
 
 func (b BasicAuth) validate() error {
@@ -180,7 +180,7 @@ func (b BasicAuth) validate() error {
 // TokenAuth has configuration for authenticating with private git repositories
 // with token auth.
 type TokenAuth struct {
-	AccessToken string `json:"accessToken,omitempty" mapstructure:"access_token"`
+	AccessToken string `json:"-" mapstructure:"access_token" yaml:"-"`
 }
 
 func (t TokenAuth) validate() error { return nil }
diff --git a/internal/config/tracing.go b/internal/config/tracing.go
index 40b2131971..0a6749b292 100644
--- a/internal/config/tracing.go
+++ b/internal/config/tracing.go
@@ -12,11 +12,11 @@ var _ defaulter = (*TracingConfig)(nil)
 // TracingConfig contains fields, which configure tracing telemetry
 // output destinations.
 type TracingConfig struct {
-	Enabled  bool                `json:"enabled,omitempty" mapstructure:"enabled"`
-	Exporter TracingExporter     `json:"exporter,omitempty" mapstructure:"exporter"`
-	Jaeger   JaegerTracingConfig `json:"jaeger,omitempty" mapstructure:"jaeger"`
-	Zipkin   ZipkinTracingConfig `json:"zipkin,omitempty" mapstructure:"zipkin"`
-	OTLP     OTLPTracingConfig   `json:"otlp,omitempty" mapstructure:"otlp"`
+	Enabled  bool                `json:"enabled" mapstructure:"enabled" yaml:"enabled"`
+	Exporter TracingExporter     `json:"exporter,omitempty" mapstructure:"exporter" yaml:"exporter,omitempty"`
+	Jaeger   JaegerTracingConfig `json:"jaeger,omitempty" mapstructure:"jaeger" yaml:"jaeger,omitempty"`
+	Zipkin   ZipkinTracingConfig `json:"zipkin,omitempty" mapstructure:"zipkin" yaml:"zipkin,omitempty"`
+	OTLP     OTLPTracingConfig   `json:"otlp,omitempty" mapstructure:"otlp" yaml:"otlp,omitempty"`
 }
 
 func (c *TracingConfig) setDefaults(v *viper.Viper) error {
@@ -93,18 +93,18 @@ var (
 // JaegerTracingConfig contains fields, which configure
 // Jaeger span and tracing output destination.
 type JaegerTracingConfig struct {
-	Host string `json:"host,omitempty" mapstructure:"host"`
-	Port int    `json:"port,omitempty" mapstructure:"port"`
+	Host string `json:"host,omitempty" mapstructure:"host" yaml:"host,omitempty"`
+	Port int    `json:"port,omitempty" mapstructure:"port" yaml:"port,omitempty"`
 }
 
 // ZipkinTracingConfig contains fields, which configure
 // Zipkin span and tracing output destination.
 type ZipkinTracingConfig struct {
-	Endpoint string `json:"endpoint,omitempty" mapstructure:"endpoint"`
+	Endpoint string `json:"endpoint,omitempty" mapstructure:"endpoint" yaml:"endpoint,omitempty"`
 }
 
 // OTLPTracingConfig contains fields, which configure
 // OTLP span and tracing output destination.
 type OTLPTracingConfig struct {
-	Endpoint string `json:"endpoint,omitempty" mapstructure:"endpoint"`
+	Endpoint string `json:"endpoint,omitempty" mapstructure:"endpoint" yaml:"endpoint,omitempty"`
 }
diff --git a/internal/config/ui.go b/internal/config/ui.go
index 50b6f71299..819b5d9f33 100644
--- a/internal/config/ui.go
+++ b/internal/config/ui.go
@@ -16,7 +16,7 @@ var _ defaulter = (*UIConfig)(nil)
 // UIConfig contains fields, which control the behaviour
 // of Flipt's user interface.
 type UIConfig struct {
-	DefaultTheme UITheme `json:"defaultTheme" mapstructure:"default_theme"`
+	DefaultTheme UITheme `json:"defaultTheme" mapstructure:"default_theme" yaml:"default_theme"`
 }
 
 func (c *UIConfig) setDefaults(v *viper.Viper) error {