diff --git a/source/extensions/filters/http/oauth2/config.cc b/source/extensions/filters/http/oauth2/config.cc
index e73e4861da54..51636e75f7e7 100644
--- a/source/extensions/filters/http/oauth2/config.cc
+++ b/source/extensions/filters/http/oauth2/config.cc
@@ -37,11 +37,11 @@ secretsProvider(const envoy::extensions::transport_sockets::tls::v3::SdsSecretCo
 }
 } // namespace
 
-Http::FilterFactoryCb OAuth2Config::createFilterFactoryFromProtoTyped(
+absl::StatusOr<Http::FilterFactoryCb> OAuth2Config::createFilterFactoryFromProtoTyped(
     const envoy::extensions::filters::http::oauth2::v3::OAuth2& proto,
     const std::string& stats_prefix, Server::Configuration::FactoryContext& context) {
   if (!proto.has_config()) {
-    throw EnvoyException("config must be present for global config");
+    return absl::InvalidArgumentError("config must be present for global config");
   }
 
   const auto& proto_config = proto.config();
@@ -56,16 +56,16 @@ Http::FilterFactoryCb OAuth2Config::createFilterFactoryFromProtoTyped(
   auto secret_provider_client_secret = secretsProvider(
       client_secret, secret_manager, transport_socket_factory, context.initManager());
   if (secret_provider_client_secret == nullptr) {
-    throw EnvoyException("invalid token secret configuration");
+    return absl::InvalidArgumentError("invalid token secret configuration");
   }
   auto secret_provider_hmac_secret =
       secretsProvider(hmac_secret, secret_manager, transport_socket_factory, context.initManager());
   if (secret_provider_hmac_secret == nullptr) {
-    throw EnvoyException("invalid HMAC secret configuration");
+    return absl::InvalidArgumentError("invalid HMAC secret configuration");
   }
 
   if (proto_config.preserve_authorization_header() && proto_config.forward_bearer_token()) {
-    throw EnvoyException(
+    return absl::InvalidArgumentError(
         "invalid combination of forward_bearer_token and preserve_authorization_header "
         "configuration. If forward_bearer_token is set to true, then "
         "preserve_authorization_header must be false");
diff --git a/source/extensions/filters/http/oauth2/config.h b/source/extensions/filters/http/oauth2/config.h
index 6db0c0d48052..c33e6c651cbb 100644
--- a/source/extensions/filters/http/oauth2/config.h
+++ b/source/extensions/filters/http/oauth2/config.h
@@ -12,12 +12,12 @@ namespace Extensions {
 namespace HttpFilters {
 namespace Oauth2 {
 
-class OAuth2Config : public Extensions::HttpFilters::Common::FactoryBase<
+class OAuth2Config : public Extensions::HttpFilters::Common::ExceptionFreeFactoryBase<
                          envoy::extensions::filters::http::oauth2::v3::OAuth2> {
 public:
-  OAuth2Config() : FactoryBase("envoy.filters.http.oauth2") {}
+  OAuth2Config() : ExceptionFreeFactoryBase("envoy.filters.http.oauth2") {}
 
-  Http::FilterFactoryCb
+  absl::StatusOr<Http::FilterFactoryCb>
   createFilterFactoryFromProtoTyped(const envoy::extensions::filters::http::oauth2::v3::OAuth2&,
                                     const std::string&,
                                     Server::Configuration::FactoryContext&) override;
diff --git a/test/extensions/filters/http/oauth2/config_test.cc b/test/extensions/filters/http/oauth2/config_test.cc
index c0d140bc0cf7..ffe97822c0d4 100644
--- a/test/extensions/filters/http/oauth2/config_test.cc
+++ b/test/extensions/filters/http/oauth2/config_test.cc
@@ -1,6 +1,3 @@
-#include <memory>
-#include <string>
-
 #include "envoy/extensions/filters/http/oauth2/v3/oauth.pb.h"
 
 #include "source/common/protobuf/message_validator_impl.h"
@@ -10,7 +7,6 @@
 
 #include "test/mocks/server/factory_context.h"
 
-#include "gmock/gmock.h"
 #include "gtest/gtest.h"
 
 namespace Envoy {
@@ -25,7 +21,7 @@ namespace {
 
 // This loads one of the secrets in credentials, and fails the other one.
 void expectInvalidSecretConfig(const std::string& failed_secret_name,
-                               const std::string& exception_message) {
+                               const std::string& status_message) {
   const std::string yaml = R"EOF(
 config:
   token_endpoint:
@@ -74,9 +70,9 @@ void expectInvalidSecretConfig(const std::string& failed_secret_name,
       .WillByDefault(Return(std::make_shared<Secret::GenericSecretConfigProviderImpl>(
           envoy::extensions::transport_sockets::tls::v3::GenericSecret())));
 
-  EXPECT_THROW_WITH_MESSAGE(
-      factory.createFilterFactoryFromProto(*proto_config, "stats", context).status().IgnoreError(),
-      EnvoyException, exception_message);
+  const auto result = factory.createFilterFactoryFromProto(*proto_config, "stats", context);
+  EXPECT_FALSE(result.ok());
+  EXPECT_EQ(result.status().message(), status_message);
 }
 
 } // namespace
@@ -164,9 +160,10 @@ TEST(ConfigTest, CreateFilterMissingConfig) {
   envoy::extensions::filters::http::oauth2::v3::OAuth2 proto_config;
 
   NiceMock<Server::Configuration::MockFactoryContext> factory_context;
-  EXPECT_THROW_WITH_MESSAGE(
-      config.createFilterFactoryFromProtoTyped(proto_config, "whatever", factory_context),
-      EnvoyException, "config must be present for global config");
+  const auto result =
+      config.createFilterFactoryFromProtoTyped(proto_config, "whatever", factory_context);
+  EXPECT_FALSE(result.ok());
+  EXPECT_EQ(result.status().message(), "config must be present for global config");
 }
 
 TEST(ConfigTest, WrongCookieName) {
@@ -275,10 +272,12 @@ TEST(ConfigTest, WrongCombinationOfPreserveAuthorizationAndForwardBearer) {
       .WillByDefault(Return(std::make_shared<Secret::GenericSecretConfigProviderImpl>(
           envoy::extensions::transport_sockets::tls::v3::GenericSecret())));
 
-  EXPECT_THROW_WITH_REGEX(
-      factory.createFilterFactoryFromProto(*proto_config, "stats", context).status().IgnoreError(),
-      EnvoyException,
-      "invalid combination of forward_bearer_token and preserve_authorization_header");
+  const auto result = factory.createFilterFactoryFromProto(*proto_config, "stats", context);
+  EXPECT_FALSE(result.ok());
+  EXPECT_EQ(result.status().message(),
+            "invalid combination of forward_bearer_token and preserve_authorization_header "
+            "configuration. If forward_bearer_token is set to true, then "
+            "preserve_authorization_header must be false");
 }
 
 } // namespace Oauth2
diff --git a/tools/code_format/config.yaml b/tools/code_format/config.yaml
index 19640df2a3db..81eae247e7c7 100644
--- a/tools/code_format/config.yaml
+++ b/tools/code_format/config.yaml
@@ -190,7 +190,6 @@ paths:
     - source/extensions/filters/http/json_to_metadata
     - source/extensions/filters/http/jwt_authn
     - source/extensions/filters/http/local_ratelimit
-    - source/extensions/filters/http/oauth2
     - source/extensions/filters/http/file_system_buffer
     - source/extensions/filters/http/header_to_metadata
     - source/extensions/filters/http/on_demand