diff --git a/cmd/common.go b/cmd/common.go
index 56c9afbab..eb7a158ae 100644
--- a/cmd/common.go
+++ b/cmd/common.go
@@ -22,14 +22,15 @@ It is here for experimentation of re-use between go-keys and light-client.
 *********/
 
 const (
-	RootFlag   = "root"
-	OutputFlag = "output"
+	RootFlag     = "root"
+	OutputFlag   = "output"
+	EncodingFlag = "encoding"
 )
 
 func PrepareMainCmd(cmd *cobra.Command, envPrefix, defautRoot string) func() {
 	cobra.OnInitialize(func() { initEnv(envPrefix) })
 	cmd.PersistentFlags().StringP(RootFlag, "r", defautRoot, "root directory for config and data")
-	cmd.PersistentFlags().StringP("encoding", "e", "hex", "Binary encoding (hex|b64|btc)")
+	cmd.PersistentFlags().StringP(EncodingFlag, "e", "hex", "Binary encoding (hex|b64|btc)")
 	cmd.PersistentFlags().StringP(OutputFlag, "o", "text", "Output format (text|json)")
 	cmd.PersistentPreRunE = multiE(bindFlags, setEncoding, validateOutput, cmd.PersistentPreRunE)
 	return func() { execute(cmd) }
diff --git a/cmd/get.go b/cmd/get.go
index 10d528807..9b8718996 100644
--- a/cmd/get.go
+++ b/cmd/get.go
@@ -32,7 +32,7 @@ var getCmd = &cobra.Command{
 		}
 		name := args[0]
 
-		info, err := Manager.Get(name)
+		info, err := GetKeyManager().Get(name)
 		if err != nil {
 			fmt.Println(err.Error())
 			return
diff --git a/cmd/keys/main.go b/cmd/keys/main.go
index 40bf31808..8b92b3f49 100644
--- a/cmd/keys/main.go
+++ b/cmd/keys/main.go
@@ -21,7 +21,6 @@ import (
 )
 
 func main() {
-	cmd.RootCmd.PersistentPreRunE = cmd.SetupKeys
 	cmd.PrepareMainCmd(cmd.RootCmd, "TM", os.ExpandEnv("$HOME/.tlc"))
 	cmd.RootCmd.Execute()
 	// exec()
diff --git a/cmd/list.go b/cmd/list.go
index bf4d14b68..875520159 100644
--- a/cmd/list.go
+++ b/cmd/list.go
@@ -27,7 +27,7 @@ var listCmd = &cobra.Command{
 	Long: `Return a list of all public keys stored by this key manager
 along with their associated name and address.`,
 	Run: func(cmd *cobra.Command, args []string) {
-		infos, err := Manager.List()
+		infos, err := GetKeyManager().List()
 		if err != nil {
 			fmt.Println(err.Error())
 			return
diff --git a/cmd/new.go b/cmd/new.go
index 3564ddf90..b59874bb0 100644
--- a/cmd/new.go
+++ b/cmd/new.go
@@ -50,7 +50,7 @@ func newPassword(cmd *cobra.Command, args []string) {
 		return
 	}
 
-	info, err := Manager.Create(name, pass, algo)
+	info, err := GetKeyManager().Create(name, pass, algo)
 	if err != nil {
 		fmt.Println(err.Error())
 		return
diff --git a/cmd/root.go b/cmd/root.go
index ffe5cc36b..64adf2b0b 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -27,7 +27,7 @@ import (
 const KeySubdir = "keys"
 
 var (
-	Manager keys.Manager
+	manager keys.Manager
 )
 
 // RootCmd represents the base command when called without any subcommands
@@ -41,17 +41,17 @@ used by light-clients, full nodes, or any other application that
 needs to sign with a private key.`,
 }
 
-// SetupKeys must be registered in main() on the top level command
-// here this is RootCmd, but if we embed keys in eg. light-client,
-// that must be responsible for the update
-func SetupKeys(cmd *cobra.Command, args []string) error {
-	// store the keys directory
-	rootDir := viper.GetString("root")
-	keyDir := filepath.Join(rootDir, KeySubdir)
-	// and construct the key manager
-	Manager = cryptostore.New(
-		cryptostore.SecretBox,
-		filestorage.New(keyDir),
-	)
-	return nil
+// GetKeyManager initializes a key manager based on the configuration
+func GetKeyManager() keys.Manager {
+	if manager == nil {
+		// store the keys directory
+		rootDir := viper.GetString("root")
+		keyDir := filepath.Join(rootDir, KeySubdir)
+		// and construct the key manager
+		manager = cryptostore.New(
+			cryptostore.SecretBox,
+			filestorage.New(keyDir),
+		)
+	}
+	return manager
 }
diff --git a/cmd/serve.go b/cmd/serve.go
index 5268f0b92..c3f7dbe39 100644
--- a/cmd/serve.go
+++ b/cmd/serve.go
@@ -64,7 +64,7 @@ func serveHTTP(cmd *cobra.Command, args []string) error {
 	}
 
 	router := mux.NewRouter()
-	ks := server.New(Manager, viper.GetString("type"))
+	ks := server.New(GetKeyManager(), viper.GetString("type"))
 	ks.Register(router)
 
 	// only set cors for tcp listener
diff --git a/cmd/update.go b/cmd/update.go
index 63b6f84df..3835242c5 100644
--- a/cmd/update.go
+++ b/cmd/update.go
@@ -50,7 +50,7 @@ func updatePassword(cmd *cobra.Command, args []string) {
 		return
 	}
 
-	err = Manager.Update(name, oldpass, newpass)
+	err = GetKeyManager().Update(name, oldpass, newpass)
 	if err != nil {
 		fmt.Println(err.Error())
 	} else {