diff --git a/tools/dune b/tools/dune
index 3375a448..3366e550 100644
--- a/tools/dune
+++ b/tools/dune
@@ -2,4 +2,4 @@
  (public_name offline)
  (name offline)
  (modules offline)
- (libraries cmdliner bos fmt mirage-crypto ptime mte))
+ (libraries cmdliner bos fmt mirage-crypto ptime mte vif))
diff --git a/tools/offline.ml b/tools/offline.ml
index 5d06c89b..a2e4faf3 100644
--- a/tools/offline.ml
+++ b/tools/offline.ml
@@ -1 +1,38 @@
-let () = Fmt.pr "hello~@."; ()
+let download ~base_url ~output_file =
+  let open Bos in
+  let uri =
+    Uri.with_path (Uri.of_string base_url) "/management/keys/" |> Uri.to_string
+  in
+  let wget = Cmd.(v "wget" % "-O" % output_file % uri) in
+  OS.Cmd.run wget
+
+(* CLI *)
+
+open Cmdliner
+open Cmdliner.Term.Syntax
+
+let output =
+  let doc = "File to save data to be signed." in
+  Arg.(
+    value & opt filepath "management_keys.json" & info [ "o"; "output" ] ~doc)
+
+let base_url =
+  let doc = "Base url of the exchange." in
+  Arg.(value & opt string "http://localhost:3434/" & info [ "base-url" ] ~doc)
+
+let download_cmd =
+  let doc = "Downloads /management/keys/" in
+  let man =
+    [ `S Manpage.s_description; `P "$(cmd) download /management/keys." ]
+  in
+  Cmd.make (Cmd.info "offline" ~version:"%%VERSION%%" ~doc ~man)
+  @@
+  let+ output_file = output and+ base_url = base_url in
+  match download ~base_url ~output_file with
+  | Error (`Msg err) ->
+      Fmt.epr "Download failure: %s@." err;
+      exit 1
+  | Ok () -> ()
+
+let main () = Cmd.eval download_cmd
+let () = if !Sys.interactive then () else exit (main ())