diff --git a/app/cli.go b/app/cli.go
index b88946e38..3e035cc42 100644
--- a/app/cli.go
+++ b/app/cli.go
@@ -2,7 +2,6 @@ package app
 
 import (
 	"context"
-	"fmt"
 	"sync"
 
 	authCommands "github.com/cortezaproject/corteza-server/auth/commands"
@@ -30,40 +29,41 @@ func (app *CortezaApp) InitCLI() {
 	)
 
 	app.Command = cli.RootCommand(func() (err error) {
-		if len(envs) == 0 {
-			envs = []string{"."}
-		}
+		log := app.Log.Named("plugins")
+		if app.Opt.Plugins.Enabled && len(app.Opt.Plugins.Paths) > 0 {
+			log.Warn("loading", zap.String("paths", app.Opt.Plugins.Paths))
 
-		if err := cli.LoadEnv(envs...); err != nil {
-			return fmt.Errorf("failed to load environmental variables: %w", err)
-		}
+			var paths []string
+			paths, err = plugin.Resolve(app.Opt.Plugins.Paths)
+			log.Warn("loading", zap.Strings("resolved-paths", paths))
 
-		// Environmental variables (from the env, files, see cli.LoadEnv) MUST be
-		// loaded at this point!
-		app.Opt = options.Init()
-
-		{
-			log := app.Log.Named("plugins")
-			if app.Opt.Plugins.Enabled && len(app.Opt.Plugins.Paths) > 0 {
-				log.Warn("loading", zap.String("paths", app.Opt.Plugins.Paths))
-
-				var paths []string
-				paths, err = plugin.Resolve(app.Opt.Plugins.Paths)
-				log.Warn("loading", zap.Strings("resolved-paths", paths))
-
-				app.plugins, err = plugin.Load(paths...)
-				if err != nil {
-					return err
-				}
-			} else {
-				// Empty set of plugins
-				app.plugins = plugin.Set{}
+			app.plugins, err = plugin.Load(paths...)
+			if err != nil {
+				return err
 			}
+		} else {
+			// Empty set of plugins
+			app.plugins = plugin.Set{}
 		}
 
 		return err
 	})
 
+	// Environmental variables (from the env, files, see cli.LoadEnv) MUST be
+	// loaded at this point!
+	if len(envs) == 0 {
+		envs = []string{"."}
+	}
+
+	// Loading env after the rootcommand is added, so as not to break
+	// the Execute() if there is an error
+	if err := cli.LoadEnv(envs...); err != nil {
+		app.Log.Error("failed to load environmental variables", zap.Error(err))
+		return
+	}
+
+	app.Opt = options.Init()
+
 	app.Command.Flags().StringSliceVar(&envs, "env-file", nil,
 		"Load environmental variables from files and directories containing .env file.\n"+
 			"Values from loaded files DO NOT override existing variables from the environment.\n"+
diff --git a/auth/commands/commands.go b/auth/commands/commands.go
index 6d15fbd2e..7fb6497ab 100644
--- a/auth/commands/commands.go
+++ b/auth/commands/commands.go
@@ -2,6 +2,7 @@ package commands
 
 import (
 	"context"
+	"time"
 
 	"github.com/cortezaproject/corteza-server/auth/external"
 	"github.com/cortezaproject/corteza-server/pkg/auth"
@@ -32,8 +33,9 @@ func Command(ctx context.Context, app serviceInitializer, storeInit func(ctx con
 		enableDiscoveredProvider               bool
 		skipValidationOnAutoDiscoveredProvider bool
 
-		clientID uint64
-		scope    []string
+		clientID      uint64
+		scope         []string
+		tokenDuration time.Duration
 	)
 
 	cmd := &cobra.Command{
@@ -116,6 +118,10 @@ func Command(ctx context.Context, app serviceInitializer, storeInit func(ctx con
 				opts = append(opts, auth.WithClientID(clientID))
 			}
 
+			if tokenDuration > 0 {
+				opts = append(opts, auth.WithExpiration(tokenDuration))
+			}
+
 			signedToken, err = auth.TokenIssuer.Issue(ctx, opts...)
 
 			cli.HandleError(err)
@@ -135,6 +141,12 @@ func Command(ctx context.Context, app serviceInitializer, storeInit func(ctx con
 		[]string{"profile", "api"},
 		"Scope")
 
+	jwtCmd.Flags().DurationVar(
+		&tokenDuration,
+		"duration",
+		app.Options().Auth.Expiry,
+		"Token expiry duration")
+
 	testEmails := &cobra.Command{
 		Use:     "test-notifications [recipient]",
 		Short:   "Sends samples of all authentication notification to recipient",
diff --git a/pkg/auth/token_issuer.go b/pkg/auth/token_issuer.go
index c1ca9240e..592ffc649 100644
--- a/pkg/auth/token_issuer.go
+++ b/pkg/auth/token_issuer.go
@@ -340,6 +340,13 @@ func (req *TokenRequest) apply(opt ...IssueOptFn) (err error) {
 	return
 }
 
+func WithExpiration(e time.Duration) IssueOptFn {
+	return func(t *TokenRequest) (err error) {
+		t.Expiration = e
+		return
+	}
+}
+
 func WithIdentity(i Identifiable) IssueOptFn {
 	return func(t *TokenRequest) (err error) {
 		t.UserID = i.Identity()