diff --git a/cmd/keyctl/main.go b/cmd/keyctl/main.go
index ffe2ddc..0de233c 100644
--- a/cmd/keyctl/main.go
+++ b/cmd/keyctl/main.go
@@ -45,10 +45,10 @@ func usage() {
 }
 
 func main() {
-	if len(os.Args) == 0 {
+	if len(os.Args) < 2 {
 		usage()
 	}
-	arg := os.Args[0]
+	arg := os.Args[1]
 	switch arg {
 	case "new", "get", "ls", "req", "approve", "reject", "del":
 		//flag.StringVar(&config, "config", "/etc/keyctl/url.conf", "path to client config file")
diff --git a/pkg/api/v1/schema/schema.go b/pkg/api/v1/schema/schema.go
index 68b05c8..1af00b8 100644
--- a/pkg/api/v1/schema/schema.go
+++ b/pkg/api/v1/schema/schema.go
@@ -25,6 +25,7 @@ type NewKey struct {
 }
 
 var (
+	ErrEmptyKeyName   = errors.New("empty key name")
 	ErrInvalidKeyName = errors.New("invalid key name")
 	ErrInvalidKeySize = errors.New("invalid key size")
 )
@@ -35,6 +36,9 @@ const (
 )
 
 func (nk NewKey) Validate() error {
+	if nk.Name == "" {
+		return ErrEmptyKeyName
+	}
 	if core.NameRe.MatchString(nk.Name) {
 		return ErrInvalidKeyName
 	}
diff --git a/pkg/cli/cli.go b/pkg/cli/cli.go
index 5f73992..012d390 100644
--- a/pkg/cli/cli.go
+++ b/pkg/cli/cli.go
@@ -10,26 +10,20 @@ import (
 	"os"
 
 	apiclient "git.giftfish.de/ston1th/keyctl/pkg/api/client"
-	"git.giftfish.de/ston1th/keyctl/pkg/api/v1/client"
+	clientv1 "git.giftfish.de/ston1th/keyctl/pkg/api/v1/client"
 	"git.giftfish.de/ston1th/keyctl/pkg/api/v1/schema"
 	"git.giftfish.de/ston1th/keyctl/pkg/core"
 )
 
+var fs = flag.NewFlagSet("", flag.ExitOnError)
+
 func exit(err error) {
 	fmt.Println(err)
 	os.Exit(1)
 }
 
 func Run(arg string) {
-	opts, err := apiclient.ClientOptionsFromEnv()
-	if err != nil {
-		exit(err)
-	}
-	apic := apiclient.NewClient(opts...)
-	c, err := client.NewClient(apic)
-	if err != nil {
-		exit(err)
-	}
+	var err error
 	ctx := context.Background()
 	switch arg {
 	case "new":
@@ -39,18 +33,23 @@ func Run(arg string) {
 			Size:     size,
 			Encoding: core.EncodingFromString(encoding),
 		}
+		c := client()
 		err = c.CreateKey(ctx, newKey)
 	case "del":
 		id := idFlags("key id")
+		c := client()
 		err = c.DeleteKey(ctx, id)
 	case "approve":
 		id := idFlags("approval id")
+		c := client()
 		err = c.AcceptApproval(ctx, id)
 	case "reject":
 		id := idFlags("approval id")
+		c := client()
 		err = c.RejectApproval(ctx, id)
 	case "get":
 		id, json := getFlags()
+		c := client()
 		key, err := c.GetKey(ctx, id)
 		if err != nil {
 			exit(err)
@@ -61,6 +60,7 @@ func Run(arg string) {
 		fmt.Println(key.Key)
 	case "ls":
 		json := outputFlags()
+		c := client()
 		keys, err := c.GetKeys(ctx)
 		if err != nil {
 			exit(err)
@@ -79,6 +79,7 @@ func Run(arg string) {
 		}
 	case "req":
 		json := outputFlags()
+		c := client()
 		approvals, err := c.GetApprovals(ctx)
 		if err != nil {
 			exit(err)
@@ -102,6 +103,19 @@ func Run(arg string) {
 	os.Exit(0)
 }
 
+func client() (c *clientv1.Client) {
+	opts, err := apiclient.ClientOptionsFromEnv()
+	if err != nil {
+		exit(err)
+	}
+	apic := apiclient.NewClient(opts...)
+	c, err = clientv1.NewClient(apic)
+	if err != nil {
+		exit(err)
+	}
+	return
+}
+
 func jsonOutput(v any) {
 	b, err := json.Marshal(v)
 	if err != nil {
@@ -112,28 +126,28 @@ func jsonOutput(v any) {
 }
 
 func idFlags(desc string) (id string) {
-	flag.StringVar(&id, "id", "", desc)
-	flag.Parse()
+	fs.StringVar(&id, "id", "", desc)
+	fs.Parse(os.Args[2:])
 	return
 }
 
 func getFlags() (id string, json bool) {
-	flag.StringVar(&id, "id", "", "key id")
-	flag.BoolVar(&json, "json", false, "json output")
-	flag.Parse()
+	fs.StringVar(&id, "id", "", "key id")
+	fs.BoolVar(&json, "json", false, "json output")
+	fs.Parse(os.Args[2:])
 	return
 }
 
 func outputFlags() (json bool) {
-	flag.BoolVar(&json, "json", false, "json output")
-	flag.Parse()
+	fs.BoolVar(&json, "json", false, "json output")
+	fs.Parse(os.Args[2:])
 	return
 }
 
 func newKeyFlags() (name, encoding string, size int) {
-	flag.StringVar(&name, "name", "", "key name")
-	flag.StringVar(&encoding, "enc", "hex", "key encoding scheme [hex|base32|base64|base64url]")
-	flag.IntVar(&size, "size", 16, "key size in bytes")
-	flag.Parse()
+	fs.StringVar(&name, "name", "", "key name")
+	fs.StringVar(&encoding, "enc", "hex", "key encoding scheme [hex|base32|base64|base64url]")
+	fs.IntVar(&size, "size", 16, "key size in bytes")
+	fs.Parse(os.Args[2:])
 	return
 }