diff --git a/README.md b/README.md
index 80b39e2..a49a38c 100644
--- a/README.md
+++ b/README.md
@@ -125,10 +125,15 @@ Full reference in [docs/CONFIGURATION.md](docs/CONFIGURATION.md).
 | `refreshGracePeriodSeconds` | `60` | Proactively refresh tokens this many seconds before expiry. |
 | `maxRefreshTokenAgeSeconds` | `21600` | Heuristic max stored refresh-token lifetime (6h). Past this, the plugin treats the RT as expired without contacting the IdP — returns 401 to AJAX, full re-auth on navigations. Set `0` to disable. Tune to match your IdP's RT TTL. |
 | `rateLimit` | `100` | Requests/sec. Min `10`. |
+| `perSourceLoginRateLimit` | `0` (off) | Throttle OIDC auth events (authorization-code callback + login initiation) per external client source, auth events per minute. Internal/loopback sources (proxies, in-cluster) are never throttled. `0` disables. |
 | `logLevel` | `info` | `debug`, `info`, `error`. |
 | `audience` | `clientID` | Custom access-token audience (Auth0 custom APIs). |
 | `strictAudienceValidation` | `false` | Reject mismatched audiences. **Set `true` in production.** |
 | `allowOpaqueTokens` / `requireTokenIntrospection` | `false` | Accept opaque access tokens via RFC 7662. |
+| `revocationURL` / `oidcEndSessionURL` / `introspectionURL` | `""` | Override the discovered revocation / end-session / introspection endpoints; take precedence when discovery omits them. |
+| `maxIdentifierLength` | `256` | Bound the post-sanitisation length of the bearer identity header (`X-Forwarded-User`). |
+| `bearerFailureWindowSeconds` | `60` | Rolling window (s) over which per-IP bearer 401s are counted toward the throttle. |
+| `bearerFailurePenaltySeconds` | `60` | Seconds an IP is kept in the 429 penalty box after the bearer failure threshold. |
 | `disableReplayDetection` | `false` | Disable JTI cache. Use Redis instead for multi-replica. |
 | `allowPrivateIPAddresses` | `false` | Permit private-IP `providerURL` (internal Keycloak, etc.). |
 | `minimalHeaders` | `false` | Reduce forwarded headers (mitigates HTTP 431). |
diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md
index 7ff8a51..411fa99 100644
--- a/docs/CONFIGURATION.md
+++ b/docs/CONFIGURATION.md
@@ -189,6 +189,15 @@ clientSecret: your-client-secret
 | `clientAssertionKeyPath` | string | none | Path to PEM private key on disk for `private_key_jwt`. Mutually exclusive with `clientAssertionPrivateKey`. |
 | `clientAssertionKeyID` | string | none | `kid` header for `private_key_jwt` assertions. Required when `clientAuthMethod: private_key_jwt`. |
 | `clientAssertionAlg` | string | `RS256` | Signing algorithm for `private_key_jwt`. One of `RS256/384/512`, `PS256/384/512`, `ES256/384/512`. |
+| `extraAuthParams` | map | none | Extra query parameters appended to the authorization request (e.g. re-selective prompt). |
+| `perSourceLoginRateLimit` | int | `0` (off) | Throttle OIDC auth events (callback + login initiation) per external client source, in auth events per minute. Internal/loopback sources are never throttled. |
+| `stripAuthCookies` | bool | `false` | Strip OIDC session cookies from the hop to the backend (mitigates HTTP 431). |
+| `enableBackchannelLogout` | bool | `false` | Enable OIDC back-channel logout (IdP-initiated, server-to-server). |
+| `backchannelLogoutURL` | string | derived | Back-channel logout endpoint path. |
+| `enableFrontchannelLogout` | bool | `false` | Enable OIDC front-channel logout (browser iframe logout). |
+| `frontchannelLogoutURL` | string | derived | Front-channel logout endpoint path. |
+| `caCertPath` / `caCertPEM` | string | none | Custom CA bundle for OIDC TLS verification (filesystem path, or inline PEM). Mutually exclusive with `insecureSkipVerify`. |
+| `insecureSkipVerify` | bool | `false` | Disable TLS verification for the OIDC client (load balancer / mTLS edge). Emits a loud warning at startup. |
 
 ### TLS Termination at Load Balancer
 
diff --git a/examples/complete-traefik-config.yaml b/examples/complete-traefik-config.yaml
index dffd8d6..e13bff2 100644
--- a/examples/complete-traefik-config.yaml
+++ b/examples/complete-traefik-config.yaml
@@ -445,22 +445,22 @@ spec:
 # you can set these. NOTE: Plugin configuration takes precedence!
 
 # Docker Compose env file (.env)
----
+# ----- (below is an example .env file, NOT YAML — shown for reference) -----
 # OIDC Configuration
-OIDC_CLIENT_ID=your-client-id
-OIDC_CLIENT_SECRET=your-client-secret
-OIDC_PROVIDER_URL=https://auth.example.com
+# OIDC_CLIENT_ID=your-client-id
+# OIDC_CLIENT_SECRET=your-client-secret
+# OIDC_PROVIDER_URL=https://auth.example.com
 
 # Redis Configuration (fallback)
-REDIS_ENABLED=true
-REDIS_ADDRESS=redis:6379
-REDIS_PASSWORD=yourredispassword
-REDIS_DB=0
-REDIS_KEY_PREFIX=traefikoidc:
-REDIS_CACHE_MODE=hybrid
-REDIS_POOL_SIZE=20
-REDIS_ENABLE_CIRCUIT_BREAKER=true
-REDIS_ENABLE_HEALTH_CHECK=true
+# REDIS_ENABLED=true
+# REDIS_ADDRESS=redis:6379
+# REDIS_PASSWORD=yourredispassword
+# REDIS_DB=0
+# REDIS_KEY_PREFIX=traefikoidc:
+# REDIS_CACHE_MODE=hybrid
+# REDIS_POOL_SIZE=20
+# REDIS_ENABLE_CIRCUIT_BREAKER=true
+# REDIS_ENABLE_HEALTH_CHECK=true
 
 
 # ============================================================================