diff --git a/auth.lisp b/auth.lisp
index e6a34ed..fdb3c73 100644
--- a/auth.lisp
+++ b/auth.lisp
@@ -3,21 +3,25 @@
 (in-package :seanut)
 
 (defun get-access-token (domain options)
-  (if (getf options :quick-connect-p)
-      
-      ;; go through the whole quick connect rigamarole 
-      (quick-connect-dance domain)
-
-      ;; authenticates the user via username and password
-      (gethash "AccessToken"
-               (json-request (format-url domain "Users/AuthenticateByName")
-                             (generate-authorization "")
-                             :method :post
-                             :content `(("Username" . ,(getf options :username))
-                                        ("Pw" . ,(getf options :password)))))))
+  (let ((token
+          (if (getf options :quick-connect-p)
+              
+              ;; go through the whole quick connect rigamarole 
+              (quick-connect-dance domain)
+              
+              ;; authenticates the user via username and password
+              (gethash "AccessToken"
+                       (json-request (format-url domain "Users/AuthenticateByName")
+                                     (generate-authorization)
+                                     :method :post
+                                     :content `(("Username" . ,(getf options :username))
+                                                ("Pw" . ,(getf options :password))))))))
+    (format t "Your access token: ~A~&Next time you use seanut, pass this with -t to skip having to authorize~&"
+            token)
+    token))
 
 (defun quick-connect-dance (domain)
-  (let* ((auth (generate-authorization ""))
+  (let* ((auth (generate-authorization))
          (qc-session (handler-case
                          (json-request (format-url domain "QuickConnect/Initiate") auth)
                        (dex:http-request-unauthorized ()
diff --git a/command-line.lisp b/command-line.lisp
index 0d97ad1..68cdf7a 100644
--- a/command-line.lisp
+++ b/command-line.lisp
@@ -18,6 +18,12 @@
    :short #\q
    :long "quick-connect"
    :description "alternative login method to providing username/password - times out after ~1min")
+  (:name :token
+   :short #\t
+   :long "token"
+   :meta-var "TOKEN"
+   :arg-parser #'identity
+   :description "access token - if you do not have one please authenticate first")
   (:name :output
    :short #\o
    :long "output"
diff --git a/seanut.lisp b/seanut.lisp
index 6f19dbf..b1de2e2 100644
--- a/seanut.lisp
+++ b/seanut.lisp
@@ -65,7 +65,6 @@
       (download-item-or-children item))))
 
 
-
 (defun main ()
   "binary entry point"
   (handle-user-abort
@@ -82,8 +81,9 @@
 
      (unless (or (and (getf opts :username)
                       (getf opts :password))
-                 (getf opts :quick-connect-p))
-       (quit-with-message 1 "please provide username & password, or use quick connect"))
+                 (getf opts :quick-connect-p)
+                 (getf opts :token))
+       (quit-with-message 1 "please provide an access token, username & password, or use quick connect"))
 
      (unless (getf opts :media-type)
        (quit-with-message 1 "Please specify media type to download.~%~A ~{~A~^, ~}"
@@ -94,7 +94,8 @@
        (quit-with-message 1 "domain and/or media name not provided"))
 
      (destructuring-bind (domain search-term) args
-       (let* ((authorization (generate-authorization (get-access-token domain opts)))
+       (let* ((authorization (or (getf opts :token)
+                                 (generate-authorization (get-access-token domain opts))))
               (results (run-search-query domain authorization
                                          (getf opts :media-type)
                                          (url-encode search-term))))
diff --git a/web.lisp b/web.lisp
index df78173..10c2b40 100644
--- a/web.lisp
+++ b/web.lisp
@@ -5,11 +5,11 @@
 (eval-when (:compile-toplevel)
   (declaim (inline json-request format-url generate-authorization download-media)))
 
-(defun generate-authorization (token)
+(defun generate-authorization (&optional token)
   "generates a properly formatted authorization header"
   (format nil *authorization-format*
           (seanut-version) (uiop:hostname) (md5-string (uiop:hostname))
-          (seanut-version) token))
+          (seanut-version) (or token "")))
 
 (defun format-url (domain slug &rest args)
   "formats DOMAIN into a url, ensures we include the url scheme
@@ -27,7 +27,7 @@ if EXTRA-HEADERS is non-nil, includes them in the headers alongside the X-Emby-A
 if CONTENT is non-nil, passes that along to the request"
   (parse (dex:request url :method method
                           :content content
-                          :headers `(("X-Emby-Authorization" . ,auth)
+                          :headers `(("Authorization" . ,auth)
                                      ,@extra-headers))))
 
 (defun run-search-query (domain auth type name)