diff --git a/cmd/route/main.go b/cmd/route/main.go
new file mode 100644
index 0000000..034e562
--- /dev/null
+++ b/cmd/route/main.go
@@ -0,0 +1,131 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+
+	"git.xeserv.us/xena/route/database"
+	"git.xeserv.us/xena/route/lib/routecrypto"
+
+	"github.com/Xe/ln"
+	"github.com/Xe/uuid"
+	"github.com/dickeyxxx/netrc"
+
+	"gopkg.in/alecthomas/kingpin.v2"
+)
+
+var allScopes = []string{
+	"token:get", "token:getall", "token:put", "token:delete", "token:deactivate",
+	"route:get", "route:getall", "route:put", "route:delete",
+	"connect",
+}
+
+var whoami string
+
+func userHomeDir() string {
+	if runtime.GOOS == "windows" {
+		home := os.Getenv("HOMEDRIVE") + os.Getenv("HOMEPATH")
+		if home == "" {
+			home = os.Getenv("USERPROFILE")
+		}
+		return home
+	}
+	return os.Getenv("HOME")
+}
+
+var (
+	app        = kingpin.New("route", "An interface to routed")
+	grpcServer = app.Flag("routed-addr", "routed grpc address").Default("127.0.0.1:12823").String()
+	netrcPath  = app.Flag("netrc", "netrc path").Default(filepath.Join(userHomeDir(), ".netrc")).String()
+
+	generateKey = app.Command("generate-key", "generate SSL cert crypto key")
+
+	routes = app.Command("route", "route management")
+
+	routesList = routes.Command("list", "list all routes owned by you")
+
+	routesInspect   = routes.Command("inspect", "inspect one route")
+	routesInspectID = routesInspect.Flag("route-id", "route ID to inspect").Required().String()
+
+	routesCreate       = routes.Command("create", "create a new route")
+	routesCreateDomain = routesCreate.Flag("domain", "domain for the route (if not given one will be generated for you)").String()
+
+	routesRm   = routes.Command("rm", "remove a route")
+	routesRmID = routes.Flag("id", "route ID to remove").Required().String()
+
+	token = app.Command("token", "token management")
+
+	tokenGenerate             = token.Command("generate-root", "generate a root token")
+	tokenGenerateKey          = tokenGenerate.Flag("key", "token crypto key").Required().String()
+	tokenGenerateScopes       = tokenGenerate.Flag("scopes", "token scopes").Default(allScopes...).Strings()
+	tokenGenerateUsername     = tokenGenerate.Flag("username", "token username").Required().String()
+	tokenGenerateDatabasePath = tokenGenerate.Flag("db", "database file to add the root token to").Required().String()
+
+	tokenList            = token.Command("list", "list all tokens belonging to you")
+	tokenListDeactivated = tokenList.Flag("deactivated", "list deactivated tokens?").Default("false").Bool()
+
+	tokenInspect   = token.Command("inspect", "inspect a token")
+	tokenInspectID = tokenInspect.Arg("token-id", "token id").Required().String()
+
+	tokenCreate       = token.Command("create", "create a new token")
+	tokenCreateScopes = tokenCreate.Flag("scope", "token scopes").Default(allScopes...).Strings()
+
+	tokenRm     = token.Command("rm", "remove a token")
+	tokenRmHard = tokenRm.Flag("hard", "hard-delete the token instead of deactivating it").Default("false").Bool()
+	tokenRmID   = tokenRm.Flag("id", "token id").Required().String()
+
+	// testServer     = app.Command("test-server", "spawn a simple HTTP test server on a TCP address")
+	// testServerAddr = testServer.Flag("addr", "TCP address").Default(":9090").String()
+
+	// connect = app.Command("connect", "connect to the backend server and relay client HTTP traffic")
+)
+
+func main() {
+	cmdline := kingpin.MustParse(app.Parse(os.Args[1:]))
+
+	n, err := netrc.Parse(*netrcPath)
+	if err != nil {
+		ln.Fatal(ln.F{"err": err, "action": "netrc.Parse"})
+	}
+	_ = n
+
+	switch cmdline {
+	case "generate-key":
+		key, err := routecrypto.GenerateKey()
+		if err != nil {
+			ln.Fatal(ln.F{"err": err, "action": "routecrypto.GenerateKey"})
+		}
+
+		fmt.Println(routecrypto.ShowKey(key))
+	case "token generate-root":
+		key, err := routecrypto.ParseKey(*tokenGenerateKey)
+		if err != nil {
+			ln.Fatal(ln.F{"err": err, "action": "routecrypto.ParseKey"})
+		}
+		db, err := database.NewBoltStorage(*tokenGenerateDatabasePath, key)
+		if err != nil {
+			ln.Fatal(ln.F{"err": err, "action": "database.NewBoltStorage"})
+		}
+
+		tBody := uuid.New()
+
+		_, err = db.PutToken(context.Background(), tBody, *tokenGenerateUsername, *tokenGenerateScopes)
+		if err != nil {
+			ln.Fatal(ln.F{"err": err, "action": "db.PutToken"})
+		}
+		defer db.Close()
+
+		fmt.Println("Your token is:", tBody)
+
+		n.AddMachine(*grpcServer, *tokenGenerateUsername, tBody)
+		err = n.Save()
+		if err != nil {
+			ln.Fatal(ln.F{"err": err, "action": "n.Save"})
+		}
+
+		return
+	}
+}