diff --git a/README.md b/README.md
index 6b9f030..5652c8a 100644
--- a/README.md
+++ b/README.md
@@ -34,6 +34,12 @@ imscli authorize user help
 
 The complete documentation of the project is available in the [DOCUMENTATION.md](DOCUMENTATION.md) file.
 
+## Development Notes
+
+### PersistentPreRunE and subcommands
+
+The root command defines a `PersistentPreRunE` that loads configuration from flags, environment variables, and config files (see `cmd/root.go`). In cobra, if a subcommand defines its own `PersistentPreRunE`, it **overrides** the parent's — the root's `PersistentPreRunE` will not run for that subcommand or its children. If you need to add a `PersistentPreRunE` to a subcommand, you must explicitly call the parent's first.
+
 ## Contributing
 
 Contributions are welcomed! Read the [Contributing Guide](CONTRIBUTING.md) for more information.
diff --git a/cmd/admin/organizations.go b/cmd/admin/organizations.go
index 5318d35..8e2759b 100644
--- a/cmd/admin/organizations.go
+++ b/cmd/admin/organizations.go
@@ -38,7 +38,7 @@ func OrganizationsCmd(imsConfig *ims.Config) *cobra.Command {
 		},
 	}
 	cmd.Flags().StringVarP(&imsConfig.Guid, "guid", "g", "", "User ID.")
-	cmd.Flags().StringVarP(&imsConfig.AuthSrc, "authSrc", "s", "", "Authorization source.")
+	cmd.Flags().StringVarP(&imsConfig.AuthSrc, "authSrc", "A", "", "Authorization source.")
 	cmd.Flags().StringVarP(&imsConfig.ClientID, "clientID", "c", "", "IMS client ID.")
 	cmd.Flags().StringVarP(&imsConfig.ServiceToken, "serviceToken", "t", "", "Service token.")
 	cmd.Flags().StringVarP(&imsConfig.OrgsAPIVersion, "orgsApiVersion", "a", "v5", "Admin organizations API version.")
diff --git a/cmd/admin/profile.go b/cmd/admin/profile.go
index bcce154..9904ad8 100644
--- a/cmd/admin/profile.go
+++ b/cmd/admin/profile.go
@@ -36,7 +36,7 @@ func ProfileCmd(imsConfig *ims.Config) *cobra.Command {
 		},
 	}
 	cmd.Flags().StringVarP(&imsConfig.Guid, "guid", "g", "", "User ID.")
-	cmd.Flags().StringVarP(&imsConfig.AuthSrc, "authSrc", "s", "", "Authorization source.")
+	cmd.Flags().StringVarP(&imsConfig.AuthSrc, "authSrc", "A", "", "Authorization source.")
 	cmd.Flags().StringVarP(&imsConfig.ClientID, "clientID", "c", "", "IMS client ID.")
 	cmd.Flags().StringVarP(&imsConfig.ServiceToken, "serviceToken", "t", "", "Service token.")
 	cmd.Flags().StringVarP(&imsConfig.ProfileAPIVersion, "profileApiVersion", "a", "v1", "Admin profile API version.")
diff --git a/cmd/authz/jwt.go b/cmd/authz/jwt.go
index 9ab54d2..90898c7 100644
--- a/cmd/authz/jwt.go
+++ b/cmd/authz/jwt.go
@@ -36,9 +36,9 @@ func JWTCmd(imsConfig *ims.Config) *cobra.Command {
 	}
 
 	cmd.Flags().StringVarP(&imsConfig.ClientID, "clientID", "c", "", "IMS Client ID.")
-	cmd.Flags().StringVarP(&imsConfig.ClientSecret, "clientSecret", "s", "", "IMS Client secret.")
+	cmd.Flags().StringVarP(&imsConfig.ClientSecret, "clientSecret", "p", "", "IMS Client secret.")
 	cmd.Flags().StringVarP(&imsConfig.Organization, "organization", "o", "", "IMS Organization.")
-	cmd.Flags().StringVarP(&imsConfig.Account, "account", "a", "", "Technical Account ID.")
+	cmd.Flags().StringVarP(&imsConfig.Account, "account", "A", "", "Technical Account ID.")
 	cmd.Flags().StringVarP(&imsConfig.PrivateKeyPath, "privateKey", "k", "", "Private Key file.")
 	cmd.Flags().StringSliceVarP(&imsConfig.Metascopes, "metascopes", "m", []string{}, "Metascopes to request.")
 
diff --git a/cmd/authz/pkce.go b/cmd/authz/pkce.go
index 463e286..36d4e76 100644
--- a/cmd/authz/pkce.go
+++ b/cmd/authz/pkce.go
@@ -27,8 +27,7 @@ func UserPkceCmd(imsConfig *ims.Config) *cobra.Command {
 		RunE: func(cmd *cobra.Command, args []string) error {
 			cmd.SilenceUsage = true
 
-			imsConfig.PKCE = true
-			resp, err := imsConfig.AuthorizeUser()
+			resp, err := imsConfig.AuthorizeUserPKCE()
 			if err != nil {
 				return fmt.Errorf("error in user authorization: %w", err)
 			}
diff --git a/cmd/authz/service.go b/cmd/authz/service.go
index 391e58c..c47e272 100644
--- a/cmd/authz/service.go
+++ b/cmd/authz/service.go
@@ -37,7 +37,7 @@ func ServiceCmd(imsConfig *ims.Config) *cobra.Command {
 
 	cmd.Flags().StringVarP(&imsConfig.ClientID, "clientID", "c", "", "IMS client ID.")
 	cmd.Flags().StringVarP(&imsConfig.ClientSecret, "clientSecret", "p", "", "IMS client secret.")
-	cmd.Flags().StringVarP(&imsConfig.AuthorizationCode, "authorizationCode", "a", "", "Permanent authorization code.")
+	cmd.Flags().StringVarP(&imsConfig.AuthorizationCode, "authorizationCode", "x", "", "Permanent authorization code.")
 
 	return cmd
 }
diff --git a/cmd/invalidate/invalidate.go b/cmd/invalidate/invalidate.go
index 714b166..4a5f82a 100644
--- a/cmd/invalidate/invalidate.go
+++ b/cmd/invalidate/invalidate.go
@@ -68,7 +68,7 @@ func RefreshTokenCmd(imsConfig *ims.Config) *cobra.Command {
 		flagName: "refreshToken", field: &imsConfig.RefreshToken,
 		successMsg: "Refresh token successfully invalidated.",
 		extraFlags: func(cmd *cobra.Command, c *ims.Config) {
-			cmd.Flags().BoolVarP(&c.Cascading, "cascading", "a", false,
+			cmd.Flags().BoolVarP(&c.Cascading, "cascading", "C", false,
 				"Also invalidate all tokens obtained with the refresh token.")
 		},
 	})
@@ -80,7 +80,7 @@ func DeviceTokenCmd(imsConfig *ims.Config) *cobra.Command {
 		flagName: "deviceToken", field: &imsConfig.DeviceToken,
 		successMsg: "Token invalidated successfully.",
 		extraFlags: func(cmd *cobra.Command, c *ims.Config) {
-			cmd.Flags().BoolVarP(&c.Cascading, "cascading", "a", false,
+			cmd.Flags().BoolVarP(&c.Cascading, "cascading", "C", false,
 				"Also invalidate all tokens obtained with the device token.")
 		},
 	})
@@ -92,7 +92,7 @@ func ServiceTokenCmd(imsConfig *ims.Config) *cobra.Command {
 		flagName: "serviceToken", field: &imsConfig.ServiceToken,
 		successMsg: "Service token successfully invalidated.",
 		extraFlags: func(cmd *cobra.Command, c *ims.Config) {
-			cmd.Flags().StringVarP(&c.ClientSecret, "clientSecret", "s", "", "IMS Client Secret.")
+			cmd.Flags().StringVarP(&c.ClientSecret, "clientSecret", "p", "", "IMS Client Secret.")
 		},
 	})
 }
diff --git a/cmd/refresh.go b/cmd/refresh.go
index 648b59b..877dfb7 100644
--- a/cmd/refresh.go
+++ b/cmd/refresh.go
@@ -33,10 +33,10 @@ func refreshCmd(imsConfig *ims.Config) *cobra.Command {
 				return fmt.Errorf("error during the token refresh: %w", err)
 			}
 			if imsConfig.FullOutput {
-				data := map[string]interface{}{
-					"access_token":  resp.AccessToken,
-					"refresh_token": resp.RefreshToken,
-				}
+				data := struct {
+					AccessToken  string `json:"access_token"`
+					RefreshToken string `json:"refresh_token"`
+				}{resp.AccessToken, resp.RefreshToken}
 				jsonData, err := json.MarshalIndent(data, "", "  ")
 				if err != nil {
 					return fmt.Errorf("error marshalling full JSON response: %w", err)
diff --git a/ims/authz_user.go b/ims/authz_user.go
index b02cba2..07685e2 100644
--- a/ims/authz_user.go
+++ b/ims/authz_user.go
@@ -24,8 +24,6 @@ import (
 	"github.com/pkg/browser"
 )
 
-const defaultPort = 8888
-
 // Validate that:
 //   - the ims.Config struct has the necessary parameters for AuthorizeUser
 //   - the provided environment exists
@@ -42,6 +40,8 @@ func (i Config) validateAuthorizeUserConfig() error {
 		return fmt.Errorf("missing client id parameter")
 	case i.Organization == "":
 		return fmt.Errorf("missing organization parameter")
+	case i.Port <= 0:
+		return fmt.Errorf("missing or invalid port parameter")
 	case i.ClientSecret == "":
 		if i.PublicClient {
 			log.Println("all needed parameters verified not empty")
@@ -55,21 +55,23 @@ func (i Config) validateAuthorizeUserConfig() error {
 	return nil
 }
 
-// AuthorizeUser uses the standard Oauth2 authorization code grant flow. The Oauth2 configuration is
-// taken from the Config struct.
+// AuthorizeUser uses the standard OAuth2 authorization code grant flow.
 func (i Config) AuthorizeUser() (string, error) {
+	return i.authorizeUser(false)
+}
+
+// AuthorizeUserPKCE uses the OAuth2 authorization code grant flow with PKCE.
+func (i Config) AuthorizeUserPKCE() (string, error) {
+	return i.authorizeUser(true)
+}
+
+func (i Config) authorizeUser(pkce bool) (string, error) {
 	// Perform parameter validation
 	err := i.validateAuthorizeUserConfig()
 	if err != nil {
 		return "", fmt.Errorf("invalid parameters for login user: %w", err)
 	}
 
-	// Use default port if not specified
-	port := i.Port
-	if port == 0 {
-		port = defaultPort
-	}
-
 	c, err := i.newIMSClient()
 	if err != nil {
 		return "", fmt.Errorf("error creating the IMS client: %w", err)
@@ -80,8 +82,8 @@ func (i Config) AuthorizeUser() (string, error) {
 		ClientID:     i.ClientID,
 		ClientSecret: i.ClientSecret,
 		Scope:        i.Scopes,
-		UsePKCE:      i.PKCE,
-		RedirectURI:  fmt.Sprintf("http://localhost:%d", port),
+		UsePKCE:      pkce,
+		RedirectURI:  fmt.Sprintf("http://localhost:%d", i.Port),
 		OnError: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			fmt.Fprintln(w, `
 				<h1>An error occurred</h1>
@@ -99,15 +101,15 @@ func (i Config) AuthorizeUser() (string, error) {
 		return "", fmt.Errorf("create authorization server: %w", err)
 	}
 
-	listener, err := net.Listen("tcp", fmt.Sprintf(":%d", port))
+	listener, err := net.Listen("tcp", fmt.Sprintf(":%d", i.Port))
 	if err != nil {
-		return "", fmt.Errorf("unable to listen at port %d", port)
+		return "", fmt.Errorf("unable to listen at port %d", i.Port)
 	}
 	defer listener.Close()
 
 	log.Println("Local server successfully launched and contacted.")
 
-	localUrl := fmt.Sprintf("http://localhost:%d/", port)
+	localUrl := fmt.Sprintf("http://localhost:%d/", i.Port)
 
 	// Suppress "Opening in existing browser session." messages from chromium-based
 	// browsers. The CLI token output goes to stdout, so stray browser messages
diff --git a/ims/config.go b/ims/config.go
index 5c9dd82..8500eca 100644
--- a/ims/config.go
+++ b/ims/config.go
@@ -41,7 +41,6 @@ type Config struct {
 	Cascading             bool
 	Token                 string
 	Port                  int
-	PKCE                  bool
 	FullOutput            bool
 	Guid                  string
 	AuthSrc               string
@@ -53,7 +52,6 @@ type Config struct {
 // Access token information
 type TokenInfo struct {
 	AccessToken string
-	Expires     int //(response.ExpiresIn * time.Millisecond),
 	Valid       bool
 	Info        string
 }
diff --git a/ims/config_test.go b/ims/config_test.go
index ced8041..c628844 100644
--- a/ims/config_test.go
+++ b/ims/config_test.go
@@ -224,6 +224,7 @@ func TestValidateAuthorizeUserConfig(t *testing.T) {
 		ClientSecret: "s",
 		Organization: "org",
 		Scopes:       []string{"openid"},
+		Port:         8888,
 	}
 	tests := []struct {
 		name    string
@@ -239,6 +240,7 @@ func TestValidateAuthorizeUserConfig(t *testing.T) {
 		{name: "missing clientID", config: withField(validConfig, func(c *Config) { c.ClientID = "" }), wantErr: "missing client id"},
 		{name: "missing organization", config: withField(validConfig, func(c *Config) { c.Organization = "" }), wantErr: "missing organization"},
 		{name: "missing secret non-public", config: withField(validConfig, func(c *Config) { c.ClientSecret = "" }), wantErr: "missing client secret"},
+		{name: "missing port", config: withField(validConfig, func(c *Config) { c.Port = 0 }), wantErr: "missing or invalid port"},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/ims/exchange.go b/ims/exchange.go
index 6bd1d43..c1405d4 100644
--- a/ims/exchange.go
+++ b/ims/exchange.go
@@ -12,7 +12,6 @@ package ims
 
 import (
 	"fmt"
-	"time"
 
 	"github.com/adobe/ims-go/ims"
 )
@@ -62,6 +61,5 @@ func (i Config) ClusterExchange() (TokenInfo, error) {
 
 	return TokenInfo{
 		AccessToken: r.AccessToken,
-		Expires:     int(r.ExpiresIn * time.Millisecond),
 	}, nil
 }
diff --git a/ims/jwt_exchange.go b/ims/jwt_exchange.go
index a30277b..42a91f4 100644
--- a/ims/jwt_exchange.go
+++ b/ims/jwt_exchange.go
@@ -13,6 +13,7 @@ package ims
 import (
 	"fmt"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/adobe/ims-go/ims"
@@ -29,14 +30,20 @@ func (i Config) AuthorizeJWTExchange() (TokenInfo, error) {
 	if err != nil {
 		return TokenInfo{}, fmt.Errorf("error read private key file: %s, %w", i.PrivateKeyPath, err)
 	}
+	defer func() {
+		for i := range key {
+			key[i] = 0
+		}
+	}()
 
 	// 	Metascopes are passed as generic claims with the format map[string]interface{}
 	//  where the strings are in the form: baseIMSUrl/s/metascope
 	//  and the interface{} is 'true'
 
+	baseURL := strings.TrimRight(i.URL, "/")
 	claims := make(map[string]interface{})
 	for _, metascope := range i.Metascopes {
-		claims[fmt.Sprintf("%s/s/%s", i.URL, metascope)] = true
+		claims[fmt.Sprintf("%s/s/%s", baseURL, metascope)] = true
 	}
 
 	r, err := c.ExchangeJWT(&ims.ExchangeJWTRequest{
@@ -54,6 +61,5 @@ func (i Config) AuthorizeJWTExchange() (TokenInfo, error) {
 
 	return TokenInfo{
 		AccessToken: r.AccessToken,
-		Expires:     int(r.ExpiresIn * time.Millisecond),
 	}, nil
 }
diff --git a/ims/organizations.go b/ims/organizations.go
index 5853c9b..c9fadc4 100644
--- a/ims/organizations.go
+++ b/ims/organizations.go
@@ -22,7 +22,7 @@ func (i Config) validateGetOrganizationsConfig() error {
 	switch i.OrgsAPIVersion {
 	case "v1", "v2", "v3", "v4", "v5", "v6":
 	default:
-		return fmt.Errorf("invalid API version parameter, use something like v5")
+		return fmt.Errorf("invalid API version parameter, latest version is v6")
 	}
 
 	switch {
diff --git a/ims/refresh.go b/ims/refresh.go
index 185a258..82ce08e 100644
--- a/ims/refresh.go
+++ b/ims/refresh.go
@@ -12,8 +12,8 @@ package ims
 
 import (
 	"fmt"
+
 	"github.com/adobe/ims-go/ims"
-	"time"
 )
 
 func (i Config) validateRefreshConfig() error {
@@ -56,7 +56,6 @@ func (i Config) Refresh() (RefreshInfo, error) {
 	return RefreshInfo{
 		TokenInfo: TokenInfo{
 			AccessToken: r.AccessToken,
-			Expires:     int(r.ExpiresIn * time.Second),
 		},
 		RefreshToken: r.RefreshToken,
 	}, nil