diff --git a/auth/flags.go b/auth/flags.go
index 6edc5f006..57d1bf448 100644
--- a/auth/flags.go
+++ b/auth/flags.go
@@ -14,17 +14,9 @@ type (
 
 var config *configuration
 
-func (configuration) New() *configuration {
-	return &configuration{
-		new(httpFlags),
-		new(dbFlags),
-		new(jwtFlags),
-	}
-}
-
 func (c *configuration) validate() error {
 	if c == nil {
-		return errors.New("CRM config is not initialized, need to call Flags()")
+		return errors.New("CRM config is not initialized, need to call Flags() or FullFlags()")
 	}
 	if err := c.http.validate(); err != nil {
 		return err
@@ -45,8 +37,21 @@ func Flags(prefix ...string) {
 	if len(prefix) == 0 {
 		panic("crm.Flags() needs prefix on first call")
 	}
-	config = configuration{}.New()
-	config.http.flags(prefix...)
-	config.db.flags(prefix...)
-	config.jwt.flags(prefix...)
+	config = &configuration{
+		jwt: new(jwtFlags).flags(prefix...),
+	}
+}
+
+func FullFlags(prefix ...string) {
+	if config != nil {
+		return
+	}
+	if len(prefix) == 0 {
+		panic("crm.Flags() needs prefix on first call")
+	}
+	config = &configuration{
+		new(httpFlags).flags(prefix...),
+		new(dbFlags).flags(prefix...),
+		new(jwtFlags).flags(prefix...),
+	}
 }
diff --git a/auth/flags_db.go b/auth/flags_db.go
index 9b72ddfea..c26bad4df 100644
--- a/auth/flags_db.go
+++ b/auth/flags_db.go
@@ -13,17 +13,22 @@ type (
 )
 
 func (c *dbFlags) validate() error {
+	if c == nil {
+		return nil
+	}
 	if c.dsn == "" {
 		return errors.New("No DB DSN is set, can't connect to database")
 	}
 	return nil
 }
 
-func (c *dbFlags) flags(prefix ...string) {
+func (c *dbFlags) flags(prefix ...string) *dbFlags {
 	p := func(s string) string {
 		return prefix[0] + "-" + s
 	}
 
 	flag.StringVar(&c.dsn, p("db-dsn"), "crust:crust@tcp(db1:3306)/crust?collation=utf8mb4_general_ci", "DSN for database connection")
 	flag.StringVar(&c.profiler, p("db-profiler"), "", "Profiler for DB queries (none, stdout)")
+
+	return c
 }
diff --git a/auth/flags_http.go b/auth/flags_http.go
index f4b78ed1e..f4f908918 100644
--- a/auth/flags_http.go
+++ b/auth/flags_http.go
@@ -16,13 +16,16 @@ type (
 )
 
 func (c *httpFlags) validate() error {
+	if c == nil {
+		return nil
+	}
 	if c.addr == "" {
 		return errors.New("No HTTP Addr is set, can't listen for HTTP")
 	}
 	return nil
 }
 
-func (c *httpFlags) flags(prefix ...string) {
+func (c *httpFlags) flags(prefix ...string) *httpFlags {
 	p := func(s string) string {
 		return prefix[0] + "-" + s
 	}
@@ -32,4 +35,6 @@ func (c *httpFlags) flags(prefix ...string) {
 	flag.BoolVar(&c.pretty, p("http-pretty-json"), false, "Prettify returned JSON output")
 	flag.BoolVar(&c.tracing, p("http-error-tracing"), false, "Return error stack frame")
 	flag.BoolVar(&c.metrics, p("http-metrics"), false, "Provide metrics export for prometheus")
+
+	return c
 }
diff --git a/auth/flags_jwt.go b/auth/flags_jwt.go
index 96ee96cd2..bf526ebf4 100644
--- a/auth/flags_jwt.go
+++ b/auth/flags_jwt.go
@@ -14,14 +14,18 @@ type (
 )
 
 func (c *jwtFlags) validate() error {
+	if c == nil {
+		return nil
+	}
 	if c.secret == "" {
 		return errors.New("JWT Secret not set for AUTH")
 	}
 	return nil
 }
 
-func (c *jwtFlags) flags(prefix ...string) {
+func (c *jwtFlags) flags(prefix ...string) *jwtFlags {
 	flag.StringVar(&c.secret, "auth-jwt-secret", "", "JWT Secret")
 	flag.Int64Var(&c.expiry, "auth-jwt-expiry", 3600, "JWT Expiration in minutes")
 	flag.BoolVar(&c.debugToken, "auth-jwt-debug", false, "Generate debug JWT key")
+	return c
 }
diff --git a/cmd/auth/main.go b/cmd/auth/main.go
index b65f2fecf..a0cb5928b 100644
--- a/cmd/auth/main.go
+++ b/cmd/auth/main.go
@@ -9,7 +9,7 @@ import (
 )
 
 func main() {
-	config := flags("auth", rbac.Flags, auth.Flags)
+	config := flags("auth", rbac.Flags, auth.FullFlags)
 
 	// log to stdout not stderr
 	log.SetOutput(os.Stdout)