diff --git a/.gitignore b/.gitignore
index e35d8850..94938f7e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,5 @@
 _build
+
+# default output files of offline-tool
+response.json
+request.json
diff --git a/data/eddsa_master_offline b/data/master_offline_private_key
similarity index 100%
rename from data/eddsa_master_offline
rename to data/master_offline_private_key
diff --git a/src/management.ml b/src/management.ml
index 7e21f511..e1e21617 100644
--- a/src/management.ml
+++ b/src/management.ml
@@ -109,10 +109,3 @@ let keys_get req server _env =
   let* () = with_string req s in
   let* () = add ~field:"content-type" "application/json" in
   respond `OK
-
-let keys_post req _server _env =
-  let open Vif.Response in
-  let open Syntax in
-  let* () = with_string req {||} in
-  let* () = add ~field:"content-type" "application/json" in
-  respond `OK
diff --git a/src/mte.ml b/src/mte.ml
index 8439cdb0..4f660718 100644
--- a/src/mte.ml
+++ b/src/mte.ml
@@ -23,17 +23,12 @@ let hello req _server _env =
 let routes =
   let open Vif.Uri in
   let open Vif.Route in
-  let open Vif.Type in
-  (* just for alignement *)
-  let get_ = get in
-  let post = Fun.flip post in
+  (*let open Vif.Type in*)
   [
-    get_ (rel /?? nil) --> hello;
-    get_ (rel / "terms" /?? nil) --> Static.terms;
-    get_ (rel / "privacy" /?? nil) --> Static.privacy;
-    get_ (rel / "test" /?? nil) --> Database.test_activate;
-    get_ (rel / "management" / "keys" /?? nil) --> Management.keys_get;
-    post (rel / "management" / "keys" /?? nil) any --> Management.keys_post;
+    get (rel /?? nil) --> hello;
+    get (rel / "terms" /?? nil) --> Static.terms;
+    get (rel / "privacy" /?? nil) --> Static.privacy;
+    get (rel / "management" / "keys" /?? nil) --> Management.keys_get;
   ]
 
 let () =
diff --git a/tools/dune b/tools/dune
index acb8c8bb..dc7b5c6a 100644
--- a/tools/dune
+++ b/tools/dune
@@ -1,5 +1,7 @@
 (executable
  (public_name offline)
  (name offline)
- (modules offline offline_signature)
+ (modules offline offline_impl offline_bin)
  (libraries cmdliner bos fmt mirage-crypto ptime mte vif))
+
+; todo depends on curl
diff --git a/tools/offline.ml b/tools/offline.ml
index a4aa0843..ba191e35 100644
--- a/tools/offline.ml
+++ b/tools/offline.ml
@@ -1,86 +1,26 @@
-(* TODO
-   - clean up cmdliner
-   - don't depends on wget
-   - setup: need public key in config file
-   - check sigs *)
-(* doc: https://docs.taler.net/manpages/taler-exchange-offline.1.html *)
-let version = "%%VERSION%%"
-
-let download ~base_url ~output =
-  let open Bos in
-  let uri =
-    Uri.with_path (Uri.of_string base_url) "/management/keys/" |> Uri.to_string
-  in
-  let wget = Cmd.(v "wget" % "-O" % output % uri) in
-  OS.Cmd.run wget
-
-let upload ~base_url ~input =
-  let open Bos in
-  let uri =
-    Uri.with_path (Uri.of_string base_url) "/management/keys/" |> Uri.to_string
-  in
-  let wget =
-    Cmd.(
-      v "wget"
-      % "--method=POST"
-      % "--header='Content-Type: application/json'"
-      % "--body-file"
-      % input
-      % "-O"
-      % "/dev/null"
-      % uri)
-  in
-  OS.Cmd.run wget
-
-let setup ~output =
-  let output = Fpath.v output in
-  let () = Mirage_crypto_rng_unix.use_default () in
-  let priv, pub = Mirage_crypto_ec.Ed25519.generate () in
-  Fmt.pr "generated master public key:@\n%s@."
-    (Mirage_crypto_ec.Ed25519.pub_to_octets pub |> B32.encode);
-  let priv_data = Mirage_crypto_ec.Ed25519.priv_to_octets priv in
-  Bos.OS.File.write output priv_data
-
-let sign ~input ~output ~master_key =
-  let open Syntax in
-  let open Bos.OS in
-  let open Crypto in
-  let input = Fpath.v input in
-  let output = Fpath.v output in
-  let master_key = Fpath.v master_key in
-  let* input = File.read input |> unwrap_err_msg in
-  let* master_key = File.read master_key |> unwrap_err_msg in
-  let master_key = EddsaPrivateKey.of_octets master_key in
-  let* future_key_response = Api.decode Api.FutureKeysResponse.jsont input in
-  let master_signatures =
-    Offline_signature.master_signatures ~master_key future_key_response
-  in
-  let* s = Api.encode Api.MasterSignatures.jsont master_signatures in
-  let* () = File.write output s |> unwrap_err_msg in
-  Ok ()
-
-(* CLI *)
-
 open Cmdliner
 open Cmdliner.Term.Syntax
+open Offline_impl
+
+let default_master_offline_key_file = "data/master_offline_private_key"
+let default_response_file = "response.json"
+let default_request_file = "request.json"
+
+(*let to_term_ret = function Error e -> `Error (false, e) | Ok () -> `Ok ()*)
+let to_term_ret = Fun.id
 
 let setup_cmd =
   let doc = "Generate offline master keys" in
   let output =
-    let doc = "Output file for the generated private Eddsa key." in
     Arg.(
       value
-      & opt filepath "data/eddsa_master_offline"
+      & opt filepath default_master_offline_key_file
       & info [ "o"; "output" ] ~doc)
   in
-  Cmd.make (Cmd.info "setup" ~version ~doc)
+  Cmd.make (Cmd.info "setup" ~doc)
   @@
   let+ output = output in
-  match setup ~output with
-  | Error (`Msg err) ->
-      Fmt.epr "Setup failure: %s@." err;
-      exit 1
-  | Ok () -> ()
+  setup ~output |> to_term_ret
 
 let download_cmd =
   let doc = "GET /management/keys/" in
@@ -88,21 +28,13 @@ let download_cmd =
     [ `S Manpage.s_description; `P "$(cmd) download /management/keys." ]
   in
   let output =
-    let doc = "File to save data to be signed." in
-    Arg.(value & opt filepath "future_keys.json" & info [ "o"; "output" ] ~doc)
+    Arg.(
+      value & opt filepath default_response_file & info [ "o"; "output" ] ~doc)
   in
-  let base_url =
-    let doc = "Base url of the exchange." in
-    Arg.(value & opt string "http://localhost:3434/" & info [ "base-url" ] ~doc)
-  in
-  Cmd.make (Cmd.info "download" ~version ~doc ~man)
+  Cmd.make (Cmd.info "download" ~doc ~man)
   @@
-  let+ output = output and+ base_url = base_url in
-  match download ~base_url ~output with
-  | Error (`Msg err) ->
-      Fmt.epr "Download failure: %s@." err;
-      exit 1
-  | Ok () -> ()
+  let+ output = output in
+  download ~output |> to_term_ret
 
 let upload_cmd =
   let doc = "POST /management/keys/" in
@@ -110,58 +42,37 @@ let upload_cmd =
     [ `S Manpage.s_description; `P "$(cmd) upload /management/keys." ]
   in
   let input =
-    let doc = "Input file." in
-    Arg.(
-      value & opt filepath "master_signatures.json" & info [ "i"; "input" ] ~doc)
+    Arg.(value & opt file default_request_file & info [ "i"; "input" ] ~doc)
   in
-  let base_url =
-    let doc = "Base url of the exchange." in
-    Arg.(value & opt string "http://localhost:3434/" & info [ "base-url" ] ~doc)
-  in
-  Cmd.make (Cmd.info "upload" ~version ~doc ~man)
+  Cmd.make (Cmd.info "upload" ~doc ~man)
   @@
-  let+ input = input and+ base_url = base_url in
-  match upload ~base_url ~input with
-  | Error (`Msg err) ->
-      Fmt.epr "Upload failure: %s@." err;
-      exit 1
-  | Ok () -> ()
+  let+ input = input in
+  upload ~input |> to_term_ret
 
 let sign_cmd =
   let doc = "Sign FutureKeysResponse." in
-  let input =
-    let doc = "File with FutureKeysResponse data." in
-    Arg.(value & opt filepath "future_keys.json" & info [ "i"; "input" ] ~doc)
-  in
-  let output =
-    let doc = "File to save signature to." in
-    Arg.(
-      value
-      & opt filepath "master_signatures.json"
-      & info [ "o"; "output" ] ~doc)
-  in
   let master_key =
     let doc = "Master offline Eddsa private key file." in
-    Arg.(
-      value
-      & opt filepath "data/eddsa_master_offline"
-      & info [ "master-key" ] ~doc)
+    Arg.(value & opt file default_master_offline_key_file & info [ "key" ] ~doc)
   in
-  Cmd.make (Cmd.info "sign" ~version ~doc)
+  let input =
+    Arg.(value & opt file default_response_file & info [ "i"; "input" ] ~doc)
+  in
+  let output =
+    Arg.(
+      value & opt filepath default_request_file & info [ "o"; "output" ] ~doc)
+  in
+  Cmd.make (Cmd.info "sign" ~doc)
   @@
   let+ input = input and+ output = output and+ master_key = master_key in
-  match sign ~input ~output ~master_key with
-  | Error (*`Msg*) err ->
-      Fmt.epr "Signature failure: %s@." err;
-      exit 1
-  | Ok () -> ()
+  sign ~input ~output ~master_key |> to_term_ret
 
 let cli =
   let info =
     let doc = "MTE Offline CLI tool" in
-    Cmd.info "mte-offline" ~version ~doc
+    Cmd.info "mte-offline" ~doc
   in
   Cmd.group info [ setup_cmd; download_cmd; sign_cmd; upload_cmd ]
 
-let main () = Cmd.eval cli
-let () = exit (main ())
+let main () = Cmd.eval_result cli
+let () = if !Sys.interactive then () else exit (main ())
diff --git a/tools/offline_signature.ml b/tools/offline_bin.ml
similarity index 70%
rename from tools/offline_signature.ml
rename to tools/offline_bin.ml
index 3e9f4b25..016667d0 100644
--- a/tools/offline_signature.ml
+++ b/tools/offline_bin.ml
@@ -1,5 +1,9 @@
+open Crypto
+open Bin_type
+open Api
+
 let denom_signature ~master_key
-    Api.FutureDenom.
+    FutureDenom.
       {
         section_name= _;
         value;
@@ -21,15 +25,14 @@ let denom_signature ~master_key
       | Rsa v -> v
       | CS _ -> Fmt.failwith "CS key types are not supported."
     in
-    let pub = denom_pub.Api.RsaDenominationKey.rsa_pub in
-    Crypto.RsaPublicKey.to_octets pub
+    let pub = denom_pub.RsaDenominationKey.rsa_pub in
+    RsaPublicKey.to_octets pub
   in
-  let h_denom_pub = Api.HashCode.hash pub_octets in
-  let master = Crypto.EddsaPrivateKey.(pub_of_priv master_key) in
-  let denom_hash = Bin_type.DenominationHash.hash pub_octets in
+  let h_denom_pub = HashCode.hash pub_octets in
   let master_sig =
-    (*let open Bin_type in*)
     let open Bin_signature.DenominationKeyValidityPS in
+    let master = EddsaPrivateKey.(pub_of_priv master_key) in
+    let denom_hash = DenominationHash.hash pub_octets in
     {
       master;
       start= stamp_start;
@@ -43,12 +46,12 @@ let denom_signature ~master_key
       denom_hash;
     }
     |> Bin.to_string bin
-    |> Crypto.EddsaSignature.sign ~key:master_key
+    |> EddsaSignature.sign ~key:master_key
   in
-  Api.DenomSignature.{ h_denom_pub; master_sig }
+  DenomSignature.{ h_denom_pub; master_sig }
 
 let signkey_signature ~master_key
-    Api.FutureSignKey.
+    FutureSignKey.
       {
         key;
         stamp_start;
@@ -66,12 +69,12 @@ let signkey_signature ~master_key
       signkey_pub= key;
     }
     |> Bin.to_string bin
-    |> Crypto.EddsaSignature.sign ~key:master_key
+    |> EddsaSignature.sign ~key:master_key
   in
-  Api.SignKeySignature.{ key; master_sig }
+  SignKeySignature.{ key; master_sig }
 
-let master_signatures ~master_key
-    Api.FutureKeysResponse.
+let make_master_signatures ~master_key
+    FutureKeysResponse.
       {
         future_denoms;
         future_signkeys;
@@ -82,4 +85,8 @@ let master_signatures ~master_key
       } =
   let denom_sigs = List.map (denom_signature ~master_key) future_denoms in
   let signkey_sigs = List.map (signkey_signature ~master_key) future_signkeys in
-  Api.MasterSignatures.{ denom_sigs; signkey_sigs }
+  MasterSignatures.{ denom_sigs; signkey_sigs }
+
+let verify_future_key_response _future_key_response =
+  (* TODO *)
+  Ok ()
diff --git a/tools/offline_impl.ml b/tools/offline_impl.ml
new file mode 100644
index 00000000..2a0c09f4
--- /dev/null
+++ b/tools/offline_impl.ml
@@ -0,0 +1,55 @@
+open Syntax
+
+let read_file fname = Bos.OS.File.read (Fpath.v fname) |> unwrap_err_msg
+
+let write_file fname content =
+  Bos.OS.File.write (Fpath.v fname) content |> unwrap_err_msg
+
+let base_url = Uri.of_string "http://localhost:3434/"
+
+let management_keys_url =
+  Uri.with_path base_url "/management/keys/" |> Uri.to_string
+
+let download ~output =
+  let open Bos in
+  let uri = management_keys_url in
+  OS.Cmd.run Cmd.(v "curl" % "-s" % "-o" % output % "-X" % "GET" % uri)
+  |> unwrap_err_msg
+
+let upload ~input =
+  let open Bos in
+  let uri = management_keys_url in
+  OS.Cmd.run
+    Cmd.(
+      v "curl"
+      % "-i"
+      % "-X"
+      % "POST"
+      % "-H"
+      % "Content-Type: application/json"
+      % "--data"
+      % ("@" ^ input)
+      % uri)
+  |> unwrap_err_msg
+
+let setup ~output =
+  let () = Mirage_crypto_rng_unix.use_default () in
+  let priv, pub = Mirage_crypto_ec.Ed25519.generate () in
+  Fmt.pr "generated master public key:@\n%s@."
+    (Mirage_crypto_ec.Ed25519.pub_to_octets pub |> B32.encode);
+  let priv_data = Mirage_crypto_ec.Ed25519.priv_to_octets priv in
+  write_file output priv_data
+
+let sign ~master_key ~input ~output =
+  let open Crypto in
+  let* input = read_file input in
+  let* master_key = read_file master_key in
+  let master_key = EddsaPrivateKey.of_octets master_key in
+  let* future_key_response = Api.decode Api.FutureKeysResponse.jsont input in
+  let* () = Offline_bin.verify_future_key_response future_key_response in
+  let master_signatures =
+    Offline_bin.make_master_signatures ~master_key future_key_response
+  in
+  let* s = Api.encode Api.MasterSignatures.jsont master_signatures in
+  let* () = write_file output s in
+  Ok ()