diff --git a/api/auth.go b/api/auth.go
index 1a36603..7e5c98c 100644
--- a/api/auth.go
+++ b/api/auth.go
@@ -2,6 +2,7 @@ package api
 
 import (
 	"errors"
+	"fmt"
 	"io/ioutil"
 	"log"
 	"net/http"
@@ -10,9 +11,7 @@ import (
 )
 
 const (
-	privKeyPath = "keys/app.rsa"     // openssl genrsa -out app.rsa keysize
-	pubKeyPath  = "keys/app.rsa.pub" // openssl rsa -in app.rsa -pubout > app.rsa.pub
-	tokenName   = "AccessToken"
+	tokenName = "AccessToken"
 )
 
 var (
@@ -24,29 +23,28 @@ var (
 	errGenericError       = errors.New("generic error")
 )
 
-func init() {
+func SetupCerts(p string) error {
 	var err error
-
-	signKey, err = ioutil.ReadFile(privKeyPath)
-
 	if err != nil {
-		// Before exploding, check up one level...
-		signKey, err = ioutil.ReadFile("../" + privKeyPath)
-		if err != nil {
-			log.Fatalf("Error reading private key: ", err)
-			return
-		}
+		log.Fatalf("Path error: ", err)
 	}
 
+	// openssl genrsa -out app.rsa keysize
+	privKeyPath := fmt.Sprintf("%vapp.rsa", p)
+	signKey, err = ioutil.ReadFile(privKeyPath)
+	if err != nil {
+		log.Fatalf("Error reading private key: ", err)
+		return err
+	}
+
+	// openssl rsa -in app.rsa -pubout > app.rsa.pub
+	pubKeyPath := fmt.Sprintf("%vapp.rsa.pub", p)
 	verifyKey, err = ioutil.ReadFile(pubKeyPath)
 	if err != nil {
-		// Before exploding, check up one level...
-		verifyKey, err = ioutil.ReadFile("../" + pubKeyPath)
-		if err != nil {
-			log.Fatalf("Error reading public key: ", err)
-			return
-		}
+		log.Fatalf("Error reading public key: ", err)
+		return err
 	}
+	return nil
 }
 
 type authHandler func(http.ResponseWriter, *http.Request) error
diff --git a/cmd/bactdb/bactdb.go b/cmd/bactdb/bactdb.go
index 63a228f..97e1dde 100644
--- a/cmd/bactdb/bactdb.go
+++ b/cmd/bactdb/bactdb.go
@@ -1,125 +1,83 @@
 package main
 
 import (
-	"flag"
 	"fmt"
 	"log"
 	"net/http"
 	"os"
 
+	"github.com/codegangsta/cli"
 	"github.com/thermokarst/bactdb/api"
 	"github.com/thermokarst/bactdb/datastore"
 )
 
-func init() {
-	flag.Usage = func() {
-		fmt.Fprintln(os.Stderr, `bactdb is a database for bacteria.
-
-Usage:
-
-		bactdb [options] command [arg...]
-
-The commands are:
-`)
-		for _, c := range subcmds {
-			fmt.Fprintf(os.Stderr, "    %-24s %s\n", c.name, c.description)
-		}
-		fmt.Fprintln(os.Stderr, `
-Use "bactdb command -h" for more information about a command.
-
-The options are:
-`)
-		flag.PrintDefaults()
-		os.Exit(1)
-	}
-}
-
 func main() {
-	flag.Parse()
+	app := cli.NewApp()
+	app.Name = "bactdb"
+	app.Usage = "a database for bacteria"
 
-	if flag.NArg() == 0 {
-		flag.Usage()
-	}
-	log.SetFlags(0)
-
-	subcmd := flag.Arg(0)
-	for _, c := range subcmds {
-		if c.name == subcmd {
-			c.run(flag.Args()[1:])
-			return
-		}
+	app.Commands = []cli.Command{
+		{
+			Name:      "serve",
+			ShortName: "s",
+			Usage:     "Start web server",
+			Flags: []cli.Flag{
+				cli.IntFlag{
+					Name:  "port",
+					Usage: "HTTP service port",
+					Value: 8901,
+				},
+				cli.StringFlag{
+					Name:  "keys",
+					Usage: "path to keys",
+					Value: "keys/",
+				},
+			},
+			Action: cmdServe,
+		},
+		{
+			Name:      "createdb",
+			ShortName: "c",
+			Usage:     "create the database schema",
+			Flags: []cli.Flag{
+				cli.BoolFlag{
+					Name:  "drop",
+					Usage: "drop DB before creating",
+				},
+				cli.StringFlag{
+					Name:  "migration_path",
+					Usage: "path to migrations",
+					Value: "./datastore/migrations",
+				},
+			},
+			Action: cmdCreateDB,
+		},
 	}
 
-	fmt.Fprintf(os.Stderr, "unknown subcmd %q\n", subcmd)
-	fmt.Fprintln(os.Stderr, `Run "bactdb -h" for usage.`)
-	os.Exit(1)
+	app.Run(os.Args)
 }
 
-type subcmd struct {
-	name        string
-	description string
-	run         func(args []string)
-}
-
-var subcmds = []subcmd{
-	{"serve", "start web server", serveCmd},
-	{"createdb", "create the database schema", createDBCmd},
-}
-
-func serveCmd(args []string) {
-	fs := flag.NewFlagSet("serve", flag.ExitOnError)
-	httpAddr := flag.String("http", ":8901", "HTTP service address")
-	fs.Usage = func() {
-		fmt.Fprintln(os.Stderr, `usage: bactdb serve [options]
-
-Starts the web server that serves the API.
-
-The options are:
-`)
-		fs.PrintDefaults()
-		os.Exit(1)
-	}
-	fs.Parse(args)
-
-	if fs.NArg() != 0 {
-		fs.Usage()
-	}
+func cmdServe(c *cli.Context) {
+	httpAddr := fmt.Sprintf(":%v", c.Int("port"))
 
 	datastore.Connect()
+	api.SetupCerts(c.String("keys"))
 
 	m := http.NewServeMux()
 	m.Handle("/api/", http.StripPrefix("/api", api.Handler()))
-
-	log.Print("Listening on ", *httpAddr)
-	err := http.ListenAndServe(*httpAddr, m)
+	log.Print("Listening on ", httpAddr)
+	err := http.ListenAndServe(httpAddr, m)
 	if err != nil {
-		log.Fatal("ListenAndServe:", err)
+		log.Fatal("ListenAndServe: ", err)
 	}
 }
 
-func createDBCmd(args []string) {
-	fs := flag.NewFlagSet("createdb", flag.ExitOnError)
-	drop := fs.Bool("drop", false, "drop DB before creating")
-	fs.Usage = func() {
-		fmt.Fprintln(os.Stderr, `usage: bactdb createdb [options]
-
-Creates the necessary DB schema.
-
-The options are:
-`)
-		fs.PrintDefaults()
-		os.Exit(1)
-	}
-	fs.Parse(args)
-
-	if fs.NArg() != 0 {
-		fs.Usage()
-	}
+func cmdCreateDB(c *cli.Context) {
+	migrationsPath := c.String("migration_path")
 
 	datastore.Connect()
-	migrationsPath := "./datastore/migrations"
 
-	if *drop {
+	if c.Bool("drop") {
 		datastore.Drop(migrationsPath)
 	}
 	datastore.Create(migrationsPath)