diff --git a/README.md b/README.md
index b62fd88..7098579 100644
--- a/README.md
+++ b/README.md
@@ -2,92 +2,177 @@
 
 Command line interface for [Hotdata](https://www.hotdata.dev).
 
-## Installation
+## Install
 
-Build from source (requires Rust):
+**Homebrew**
+
+```sh
+brew install hotdata-dev/tap/hotdata-cli
+```
+
+**Binary (macOS, Linux)**
+
+Download a binary from [Releases](https://github.com/hotdata-dev/hotdata-cli/releases).
+
+**Build from source** (requires Rust)
 
 ```sh
 cargo build --release
 cp target/release/hotdata /usr/local/bin/hotdata
 ```
 
-## Getting Started
+## Connect
+
+Run the following command to authenticate:
 
 ```sh
-# Initialize config
-hotdata init
+hotdata auth
+```
+
+This launches a browser window where you can authorize the CLI to access your Hotdata account.
 
-# Log in via browser
-hotdata auth login
+Alternatively, authenticate with an API key using the `--api-key` flag:
 
-# Check auth status
-hotdata auth status
+```sh
+hotdata <command> --api-key <api_key>
 ```
 
+Or set the `HOTDATA_API_KEY` environment variable (also loaded from `.env` files):
+
+```sh
+export HOTDATA_API_KEY=<api_key>
+hotdata <command>
+```
+
+API key priority (lowest to highest): config file → `HOTDATA_API_KEY` env var → `--api-key` flag.
+
 ## Commands
 
-### Workspaces
+| Command | Subcommands | Description |
+| :-- | :-- | :-- |
+| `auth` | `status`, `logout` | Authenticate (run without subcommand to log in) |
+| `workspaces` | `list`, `set`, `get`, `create`, `update` | Manage workspaces |
+| `connections` | `list`, `get`, `create`, `refresh`, `update`, `delete`, `new` | Manage connections |
+| `tables` | `list` | List tables and columns |
+| `datasets` | `list`, `create` | Manage uploaded datasets |
+| `query` | | Execute a SQL query |
+| `results` | `list` | Retrieve stored query results |
+| `skills` | `install`, `status` | Manage the hotdata-cli agent skill |
+
+## Global options
+
+| Option | Description | Type | Default |
+| :-- | :-- | :-- | :-- |
+| `--api-key` | API key (overrides env var and config) | string | |
+| `-v, --version` | Print version | boolean | |
+| `-h, --help` | Print help | boolean | |
+
+## Workspaces
 
 ```sh
-hotdata workspace list [--format table|json|yaml]
+hotdata workspaces list [--format table|json|yaml]
+hotdata workspaces set [<workspace_id>]
 ```
 
-### Connections
+- `list` shows all workspaces with a `*` marker on the active one.
+- `set` switches the active workspace. Omit the ID for interactive selection.
+- The active workspace is used as the default for all commands that accept `--workspace-id`.
+
+## Connections
 
 ```sh
-hotdata connections list <workspace_id> [--format table|json|yaml]
+hotdata connections list [--workspace-id <id>] [--format table|json|yaml]
+hotdata connections get <connection_id> [--workspace-id <id>] [--format yaml|json|table]
+hotdata connections refresh <connection_id> [--workspace-id <id>]
+hotdata connections new [--workspace-id <id>]
 ```
 
-### Tables
+- `list` returns `id`, `name`, `source_type` for each connection.
+- `refresh` triggers a schema refresh for a connection.
+- `new` launches an interactive connection creation wizard.
+
+### Create a connection
 
 ```sh
-# List all tables in a workspace
-hotdata tables list <workspace_id> [--format table|json|yaml]
+# List available connection types
+hotdata connections create list [--format table|json|yaml]
+
+# Inspect schema for a connection type
+hotdata connections create list <type_name> --format json
 
-# List columns for a specific connection
-hotdata tables list <workspace_id> --connection-id <connection_id> [--format table|json|yaml]
+# Create a connection
+hotdata connections create --name "my-conn" --type postgres --config '{"host":"...","port":5432,...}'
 ```
 
-### Query
+## Tables
 
 ```sh
-hotdata query "<sql>" --workspace-id <workspace_id> [--connection <connection_id>] [--format table|json|csv]
+hotdata tables list [--workspace-id <id>] [--connection-id <id>] [--schema <pattern>] [--table <pattern>] [--limit <n>] [--cursor <token>] [--format table|json|yaml]
 ```
 
-## Releasing
-
-Releases use a two-phase workflow wrapping [`cargo-release`](https://github.com/crate-ci/cargo-release).
+- Without `--connection-id`: lists all tables with `table`, `synced`, `last_sync`.
+- With `--connection-id`: includes column details (`column`, `data_type`, `nullable`).
+- `--schema` and `--table` support SQL `%` wildcard patterns.
+- Tables are displayed as `<connection>.<schema>.<table>` — use this format in SQL queries.
 
-**Phase 1 — prepare**
+## Datasets
 
 ```sh
-scripts/release.sh prepare <version>
-# e.g. scripts/release.sh prepare 0.2.0
+hotdata datasets list [--workspace-id <id>] [--limit <n>] [--offset <n>] [--format table|json|yaml]
+hotdata datasets <dataset_id> [--workspace-id <id>] [--format table|json|yaml]
+hotdata datasets create --file data.csv [--label "My Dataset"] [--table-name my_dataset]
+hotdata datasets create --sql "SELECT ..." --label "My Dataset"
 ```
 
-This will:
-1. Create a `release/<version>` branch
-2. Bump the version in `Cargo.toml`, update `CHANGELOG.md`, and push the branch
-3. Open a GitHub pull request and launch it in the browser
+- Datasets are queryable as `datasets.main.<table_name>`.
+- `--file`, `--sql`, and `--query-id` are mutually exclusive.
+- Format is auto-detected from file extension or content.
+- Piped stdin is supported: `cat data.csv | hotdata datasets create --label "My Dataset"`
 
-Squash and merge the PR into `main` when ready.
+## Query
 
-**Phase 2 — finish**
+```sh
+hotdata query "<sql>" [--workspace-id <id>] [--connection <connection_id>] [--format table|json|csv]
+```
+
+- Default format is `table`, which prints results with row count and execution time.
+- Use `--connection` to scope the query to a specific connection.
+
+## Results
 
 ```sh
-scripts/release.sh finish
+hotdata results <result_id> [--workspace-id <id>] [--format table|json|csv]
+hotdata results list [--workspace-id <id>] [--limit <n>] [--offset <n>] [--format table|json|yaml]
 ```
 
-Run this from any branch after the PR is merged. It will switch to `main`, pull the latest, tag the release, and trigger the dist workflow.
+- Query results include a `result-id` in the table footer — use it to retrieve past results without re-running queries.
 
 ## Configuration
 
 Config is stored at `~/.hotdata/config.yml` keyed by profile (default: `default`).
 
-Environment variable overrides:
+| Variable | Description | Default |
+| :-- | :-- | :-- |
+| `HOTDATA_API_KEY` | API key (overrides config file) | |
+| `HOTDATA_API_URL` | API base URL | `https://api.hotdata.dev/v1` |
+| `HOTDATA_APP_URL` | App URL for browser login | `https://app.hotdata.dev` |
+
+## Releasing
+
+Releases use a two-phase workflow wrapping [`cargo-release`](https://github.com/crate-ci/cargo-release).
+
+**Phase 1 — prepare**
+
+```sh
+scripts/release.sh prepare <version>
+```
+
+Creates a `release/<version>` branch, bumps the version, updates `CHANGELOG.md`, pushes the branch, and opens a pull request.
+
+**Phase 2 — finish**
+
+```sh
+scripts/release.sh finish
+```
 
-| Variable           | Description                              |
-|--------------------|------------------------------------------|
-| `HOTDATA_API_KEY`  | API key (overrides config)               |
-| `HOTDATA_API_URL`  | API base URL (default: `https://api.hotdata.dev/v1`) |
-| `HOTDATA_APP_URL`  | App URL for browser login (default: `https://app.hotdata.dev`) |
+Switches to `main`, pulls latest, tags the release, and triggers the dist workflow.
diff --git a/skills/hotdata-cli/SKILL.md b/skills/hotdata-cli/SKILL.md
index 5c6e438..e8c3dae 100644
--- a/skills/hotdata-cli/SKILL.md
+++ b/skills/hotdata-cli/SKILL.md
@@ -1,12 +1,12 @@
 ---
 name: hotdata-cli
-description: Use this skill when the user wants to run hotdata CLI commands, query the HotData API, list workspaces, list connections, create connections, list tables, manage datasets, execute SQL queries, or interact with the hotdata service. Activate when the user says "run hotdata", "query hotdata", "list workspaces", "list connections", "create a connection", "list tables", "list datasets", "create a dataset", "upload a dataset", "execute a query", or asks you to use the hotdata CLI.
+description: Use this skill when the user wants to run hotdata CLI commands, query the Hotdata API, list workspaces, list connections, create connections, list tables, manage datasets, execute SQL queries, or interact with the hotdata service. Activate when the user says "run hotdata", "query hotdata", "list workspaces", "list connections", "create a connection", "list tables", "list datasets", "create a dataset", "upload a dataset", "execute a query", or asks you to use the hotdata CLI.
 version: 0.1.4
 ---
 
-# HotData CLI Skill
+# Hotdata CLI Skill
 
-Use the `hotdata` CLI to interact with the HotData service. In this project, run it as:
+Use the `hotdata` CLI to interact with the Hotdata service. In this project, run it as:
 
 ```
 hotdata <command> [args]
@@ -16,13 +16,18 @@ Or if installed on PATH: `hotdata <command> [args]`
 
 ## Authentication
 
-Config is stored in `~/.hotdata/config.yml` keyed by profile (default: `default`).
-API key can also be set via `HOTDATA_API_KEY` env var.
+Run `hotdata auth` to authenticate via browser login. Config is stored in `~/.hotdata/config.yml`.
+
+API key resolution (lowest to highest priority):
+1. Config file (saved by `hotdata auth`)
+2. `HOTDATA_API_KEY` environment variable (or `.env` file)
+3. `--api-key <key>` flag (works on any command)
+
 API URL defaults to `https://api.hotdata.dev/v1` or overridden via `HOTDATA_API_URL`.
 
 ## Workspace ID
 
-All commands that accept `--workspace-id` are optional. If omitted, the first workspace saved during `hotdata auth login` is used as the default. **Omit `--workspace-id` unless you need to target a specific workspace.**
+All commands that accept `--workspace-id` are optional. If omitted, the active workspace is used. Use `hotdata workspaces set` to switch the active workspace interactively, or pass a workspace ID directly: `hotdata workspaces set <workspace_id>`. The active workspace is shown with a `*` marker in `hotdata workspaces list`. **Omit `--workspace-id` unless you need to target a specific workspace.**
 
 ## Available Commands
 
@@ -111,7 +116,7 @@ hotdata tables list [--workspace-id <workspace_id>] [--connection-id <connection
 
 ### Datasets
 
-Datasets are managed files uploaded to HotData and queryable as tables.
+Datasets are managed files uploaded to Hotdata and queryable as tables.
 
 #### List datasets
 ```
@@ -173,15 +178,10 @@ hotdata results <result_id> [--workspace-id <workspace_id>] [--format table|json
 
 ### Auth
 ```
-hotdata auth login          # Browser-based login
+hotdata auth                # Browser-based login
 hotdata auth status         # Check current auth status
 ```
 
-### Init
-```
-hotdata init                # Create ~/.hotdata/config.yml
-```
-
 ## Workflow: Running a Query
 
 1. List connections:
diff --git a/src/auth.rs b/src/auth.rs
index 3c672af..8004272 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -8,6 +8,14 @@ use sha2::{Digest, Sha256};
 use std::collections::HashMap;
 use std::io::stdout;
 
+pub fn logout(profile: &str) {
+    if let Err(e) = config::remove_api_key(profile) {
+        eprintln!("error: {e}");
+        std::process::exit(1);
+    }
+    println!("{}", "Logged out.".green());
+}
+
 pub fn status(profile: &str) {
     let profile_config = match config::load(profile) {
         Ok(c) => c,
@@ -133,7 +141,7 @@ pub fn login() {
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>HotData — Login Successful</title>
+  <title>Hotdata — Login Successful</title>
   <style>
     *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
     body {
@@ -177,7 +185,7 @@ pub fn login() {
       </svg>
     </div>
     <h1>Login successful</h1>
-    <p>You're now authenticated with HotData.<br/>You can close this tab and return to the terminal.</p>
+    <p>You're now authenticated with Hotdata.<br/>You can close this tab and return to the terminal.</p>
   </div>
 </body>
 </html>"#;
diff --git a/src/command.rs b/src/command.rs
index 07e4fb4..716d3b3 100644
--- a/src/command.rs
+++ b/src/command.rs
@@ -2,16 +2,10 @@ use clap::Subcommand;
 
 #[derive(Subcommand)]
 pub enum Commands {
-    /// Initialize HotData CLI configuration file with default settings
-    Init,
-
-    /// Show HotData service information
-    Info,
-
-    /// Manage authentication and profiles
+    /// Authenticate or manage auth settings
     Auth {
         #[command(subcommand)]
-        command: AuthCommands,
+        command: Option<AuthCommands>,
     },
 
     /// Manage datasets
@@ -49,12 +43,6 @@ pub enum Commands {
         format: String,
     },
 
-    /// Manage configuration profiles
-    Profile {
-        #[command(subcommand)]
-        command: ProfileCommands,
-    },
-
     /// Manage workspaces
     Workspaces {
         #[command(subcommand)]
@@ -78,7 +66,7 @@ pub enum Commands {
     },
 
     /// Manage the hotdata-cli agent skill
-    Skill {
+    Skills {
         #[command(subcommand)]
         command: SkillCommands,
     },
@@ -103,70 +91,11 @@ pub enum Commands {
 
 #[derive(Subcommand)]
 pub enum AuthCommands {
-    /// Log in to HotData via browser
-    Login,
-
     /// Remove authentication for a profile
-    Logout {
-        /// Configuration profile name
-        #[arg(long, default_value = "default")]
-        profile: String,
-    },
+    Logout,
 
     /// Show authentication status
-    Status {
-        /// Configuration profile name
-        #[arg(long, default_value = "default")]
-        profile: String,
-    },
-
-    /// Update authentication configuration
-    Config {
-        /// API endpoint URL
-        #[arg(long)]
-        endpoint: Option<String>,
-
-        /// Configuration profile name
-        #[arg(long, default_value = "default")]
-        profile: String,
-    },
-
-    /// Validate the API key for the active profile
-    Validate,
-
-    /// Manage API keys
-    Keys {
-        #[command(subcommand)]
-        command: AuthKeysCommands,
-    },
-}
-
-#[derive(Subcommand)]
-pub enum AuthKeysCommands {
-    /// Create a new API key for an organization
-    Create {
-        /// Organization ID
-        #[arg(long)]
-        org_id: String,
-
-        /// API key (if not provided, a new one will be generated)
-        #[arg(long)]
-        key: Option<String>,
-
-        /// Output format
-        #[arg(long, default_value = "yaml", value_parser = ["table", "json", "yaml"])]
-        format: String,
-    },
-
-    /// Delete an API key from an organization
-    Delete {
-        /// API key to delete
-        api_key: String,
-
-        /// Organization ID
-        #[arg(long)]
-        org_id: String,
-    },
+    Status,
 }
 
 #[derive(Subcommand)]
@@ -219,27 +148,6 @@ pub enum DatasetsCommands {
 }
 
 
-#[derive(Subcommand)]
-pub enum ProfileCommands {
-    /// List available configuration profiles
-    List,
-
-    /// Show the current active configuration profile
-    Current,
-
-    /// Set the active configuration profile for all future commands
-    Set {
-        /// Profile name to activate
-        profile: String,
-    },
-
-    /// Remove a configuration profile
-    Remove {
-        /// Profile name to remove
-        profile: String,
-    },
-}
-
 #[derive(Subcommand)]
 pub enum WorkspaceCommands {
     /// List all workspaces
diff --git a/src/config.rs b/src/config.rs
index f7bcba7..650df5e 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -49,6 +49,7 @@ pub enum ApiKeySource {
     #[default]
     Config,
     Env,
+    Flag,
 }
 
 #[derive(Debug, Clone, Serialize)]
@@ -124,6 +125,29 @@ pub fn save_api_key(profile: &str, api_key: &str) -> Result<(), String> {
     fs::write(&config_path, content).map_err(|e| format!("error writing config file: {e}"))
 }
 
+pub fn remove_api_key(profile: &str) -> Result<(), String> {
+    let user_dirs = UserDirs::new().ok_or("could not determine home directory")?;
+    let config_path = user_dirs.home_dir().join(".hotdata").join("config.yml");
+
+    if !config_path.exists() {
+        return Ok(());
+    }
+
+    let content = fs::read_to_string(&config_path)
+        .map_err(|e| format!("error reading config file: {e}"))?;
+    let mut config_file: ConfigFile =
+        serde_yaml::from_str(&content).map_err(|e| format!("error parsing config file: {e}"))?;
+
+    if let Some(entry) = config_file.profiles.get_mut(profile) {
+        entry.api_key = None;
+        entry.workspaces.clear();
+    }
+
+    let content = serde_yaml::to_string(&config_file)
+        .map_err(|e| format!("error serializing config: {e}"))?;
+    fs::write(&config_path, content).map_err(|e| format!("error writing config file: {e}"))
+}
+
 pub fn save_workspaces(profile: &str, workspaces: Vec<WorkspaceEntry>) -> Result<(), String> {
     let user_dirs = UserDirs::new().ok_or("could not determine home directory")?;
     let config_path = user_dirs.home_dir().join(".hotdata").join("config.yml");
@@ -179,40 +203,45 @@ pub fn resolve_workspace_id(provided: Option<String>, profile_config: &ProfileCo
         .workspaces
         .first()
         .map(|w| w.public_id.clone())
-        .ok_or_else(|| "no workspace-id provided and no default workspace found. Run 'hotdata auth login' or specify --workspace-id.".to_string())
+        .ok_or_else(|| "no workspace-id provided and no default workspace found. Run 'hotdata auth' or specify --workspace-id.".to_string())
+}
+
+/// Global API key override set via --api-key flag.
+/// Call `set_api_key_flag` once at startup; `load` picks it up automatically.
+static API_KEY_FLAG: std::sync::OnceLock<String> = std::sync::OnceLock::new();
+
+pub fn set_api_key_flag(key: String) {
+    let _ = API_KEY_FLAG.set(key);
 }
 
 pub fn load(profile: &str) -> Result<ProfileConfig, String> {
     let user_dirs = UserDirs::new().ok_or("could not determine home directory")?;
     let config_file = user_dirs.home_dir().join(".hotdata").join("config.yml");
 
-    if !config_file.exists() {
-        return Err(format!(
-            "config file not found at {}. Run 'hotdata init' to create one.",
-            config_file.display()
-        ));
-    }
-
-    let content =
-        fs::read_to_string(&config_file).map_err(|e| format!("error reading config file: {e}"))?;
-
-    let config_file: ConfigFile = serde_yaml::from_str(&content).unwrap_or_else(|_| {
-        eprintln!("{}", "error parsing config file.".red());
-        eprintln!("Run 'hotdata auth login' to generate a new config file.");
-        std::process::exit(1);
-    });
-
-    let mut profile_config = config_file
-        .profiles
-        .get(profile)
-        .cloned()
-        .ok_or_else(|| format!("profile '{profile}' not found in config"))?;
+    let mut profile_config = if config_file.exists() {
+        let content =
+            fs::read_to_string(&config_file).map_err(|e| format!("error reading config file: {e}"))?;
+        let config_file: ConfigFile = serde_yaml::from_str(&content).unwrap_or_else(|_| {
+            eprintln!("{}", "error parsing config file.".red());
+            eprintln!("Run 'hotdata auth' to generate a new config file.");
+            std::process::exit(1);
+        });
+        config_file.profiles.get(profile).cloned().unwrap_or_default()
+    } else {
+        ProfileConfig::default()
+    };
 
+    // Priority: config (lowest) < env var < --api-key flag (highest)
     if let Ok(val) = env::var("HOTDATA_API_KEY") {
         profile_config.api_key = Some(val);
         profile_config.api_key_source = ApiKeySource::Env;
     }
 
+    if let Some(val) = API_KEY_FLAG.get() {
+        profile_config.api_key = Some(val.clone());
+        profile_config.api_key_source = ApiKeySource::Flag;
+    }
+
     if let Ok(val) = env::var("HOTDATA_API_URL") {
         profile_config.api_url = ApiUrl(Some(val));
     }
diff --git a/src/connections.rs b/src/connections.rs
index 1e3818a..5980d6d 100644
--- a/src/connections.rs
+++ b/src/connections.rs
@@ -32,7 +32,7 @@ pub fn types_list(workspace_id: &str, format: &str) {
     let api_key = match &profile_config.api_key {
         Some(key) if key != "PLACEHOLDER" => key.clone(),
         _ => {
-            eprintln!("error: not authenticated. Run 'hotdata auth login' to log in.");
+            eprintln!("error: not authenticated. Run 'hotdata auth' to log in.");
             std::process::exit(1);
         }
     };
@@ -97,7 +97,7 @@ pub fn types_get(workspace_id: &str, name: &str, format: &str) {
     let api_key = match &profile_config.api_key {
         Some(key) if key != "PLACEHOLDER" => key.clone(),
         _ => {
-            eprintln!("error: not authenticated. Run 'hotdata auth login' to log in.");
+            eprintln!("error: not authenticated. Run 'hotdata auth' to log in.");
             std::process::exit(1);
         }
     };
@@ -179,7 +179,7 @@ pub fn create(
     let api_key = match &profile_config.api_key {
         Some(key) if key != "PLACEHOLDER" => key.clone(),
         _ => {
-            eprintln!("error: not authenticated. Run 'hotdata auth login' to log in.");
+            eprintln!("error: not authenticated. Run 'hotdata auth' to log in.");
             std::process::exit(1);
         }
     };
@@ -272,7 +272,7 @@ pub fn list(workspace_id: &str, format: &str) {
     let api_key = match &profile_config.api_key {
         Some(key) if key != "PLACEHOLDER" => key.clone(),
         _ => {
-            eprintln!("error: not authenticated. Run 'hotdata auth login' to log in.");
+            eprintln!("error: not authenticated. Run 'hotdata auth' to log in.");
             std::process::exit(1);
         }
     };
diff --git a/src/connections_new.rs b/src/connections_new.rs
index ed3b064..91a8034 100644
--- a/src/connections_new.rs
+++ b/src/connections_new.rs
@@ -25,7 +25,7 @@ fn load_client() -> (reqwest::blocking::Client, String, String) {
     let api_key = match &profile.api_key {
         Some(k) if k != "PLACEHOLDER" => k.clone(),
         _ => {
-            eprintln!("error: not authenticated. Run 'hotdata auth login' to log in.");
+            eprintln!("error: not authenticated. Run 'hotdata auth' to log in.");
             std::process::exit(1);
         }
     };
diff --git a/src/datasets.rs b/src/datasets.rs
index 326670c..205e893 100644
--- a/src/datasets.rs
+++ b/src/datasets.rs
@@ -245,7 +245,7 @@ fn create_dataset(
     let api_key = match &profile_config.api_key {
         Some(key) if key != "PLACEHOLDER" => key.clone(),
         _ => {
-            eprintln!("error: not authenticated. Run 'hotdata auth login' to log in.");
+            eprintln!("error: not authenticated. Run 'hotdata auth' to log in.");
             std::process::exit(1);
         }
     };
@@ -315,7 +315,7 @@ pub fn create_from_upload(
     let api_key = match &profile_config.api_key {
         Some(key) if key != "PLACEHOLDER" => key.clone(),
         _ => {
-            eprintln!("error: not authenticated. Run 'hotdata auth login' to log in.");
+            eprintln!("error: not authenticated. Run 'hotdata auth' to log in.");
             std::process::exit(1);
         }
     };
@@ -432,7 +432,7 @@ pub fn list(workspace_id: &str, limit: Option<u32>, offset: Option<u32>, format:
     let api_key = match &profile_config.api_key {
         Some(key) if key != "PLACEHOLDER" => key.clone(),
         _ => {
-            eprintln!("error: not authenticated. Run 'hotdata auth login' to log in.");
+            eprintln!("error: not authenticated. Run 'hotdata auth' to log in.");
             std::process::exit(1);
         }
     };
@@ -509,7 +509,7 @@ pub fn get(dataset_id: &str, workspace_id: &str, format: &str) {
     let api_key = match &profile_config.api_key {
         Some(key) if key != "PLACEHOLDER" => key.clone(),
         _ => {
-            eprintln!("error: not authenticated. Run 'hotdata auth login' to log in.");
+            eprintln!("error: not authenticated. Run 'hotdata auth' to log in.");
             std::process::exit(1);
         }
     };
diff --git a/src/main.rs b/src/main.rs
index 7499bda..c3cc672 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -4,7 +4,6 @@ mod config;
 mod connections;
 mod connections_new;
 mod datasets;
-mod init;
 mod query;
 mod results;
 mod skill;
@@ -18,13 +17,17 @@ use clap::{Parser, builder::Styles};
 use command::{AuthCommands, Commands, ConnectionsCommands, ConnectionsCreateCommands, DatasetsCommands, ResultsCommands, SkillCommands, TablesCommands, WorkspaceCommands};
 
 #[derive(Parser)]
-#[command(name = "hotdata", version, about = concat!("HotData CLI - Command line interface for HotData (v", env!("CARGO_PKG_VERSION"), ")"), long_about = None, disable_version_flag = true)]
+#[command(name = "hotdata", version, about = concat!("Hotdata CLI - Command line interface for Hotdata (v", env!("CARGO_PKG_VERSION"), ")"), long_about = None, disable_version_flag = true)]
 #[command(styles=get_styles())]
 struct Cli {
     /// Print version
     #[arg(short = 'v', short_aliases = ['V'], long, action = clap::ArgAction::Version)]
     version: Option<bool>,
 
+    /// API key (overrides env var and config file)
+    #[arg(long, global = true)]
+    api_key: Option<String>,
+
     #[command(subcommand)]
     command: Option<Commands>,
 }
@@ -49,6 +52,10 @@ fn main() {
     dotenvy::dotenv().ok();
     let cli = Cli::parse();
 
+    if let Some(key) = cli.api_key {
+        config::set_api_key_flag(key);
+    }
+
     match cli.command {
         None => {
             use clap::CommandFactory;
@@ -56,12 +63,10 @@ fn main() {
             println!();
         }
         Some(cmd) => match cmd {
-            Commands::Init => init::run(),
-            Commands::Info => eprintln!("not yet implemented"),
             Commands::Auth { command } => match command {
-                AuthCommands::Login => auth::login(),
-                AuthCommands::Status { profile } => auth::status(&profile),
-                _ => eprintln!("not yet implemented"),
+                None => auth::login(),
+                Some(AuthCommands::Status) => auth::status("default"),
+                Some(AuthCommands::Logout) => auth::logout("default"),
             },
             Commands::Datasets { id, workspace_id, format, command } => {
                 let workspace_id = resolve_workspace(workspace_id);
@@ -83,8 +88,9 @@ fn main() {
                         }
                         None => {
                             use clap::CommandFactory;
-                            Cli::command().find_subcommand_mut("datasets").unwrap().print_help().unwrap();
-                            println!();
+                            let mut cmd = Cli::command();
+                            cmd.build();
+                            cmd.find_subcommand_mut("datasets").unwrap().print_help().unwrap();
                         }
                     }
                 }
@@ -93,7 +99,6 @@ fn main() {
                 let workspace_id = resolve_workspace(workspace_id);
                 query::execute(&sql, &workspace_id, connection.as_deref(), &format)
             }
-            Commands::Profile { .. } => eprintln!("not yet implemented"),
             Commands::Workspaces { command } => match command {
                 WorkspaceCommands::List { format } => workspace::list(&format),
                 WorkspaceCommands::Set { workspace_id } => workspace::set(workspace_id.as_deref()),
@@ -143,7 +148,7 @@ fn main() {
                     tables::list(&workspace_id, connection_id.as_deref(), schema.as_deref(), table.as_deref(), limit, cursor.as_deref(), &format)
                 }
             },
-            Commands::Skill { command } => match command {
+            Commands::Skills { command } => match command {
                 SkillCommands::Install { project } => {
                     if project { skill::install_project() } else { skill::install() }
                 }
@@ -159,8 +164,10 @@ fn main() {
                         match result_id {
                             Some(id) => results::get(&id, &workspace_id, &format),
                             None => {
-                                eprintln!("error: provide a result ID or use 'results list'");
-                                std::process::exit(1);
+                                use clap::CommandFactory;
+                                let mut cmd = Cli::command();
+                                cmd.build();
+                                cmd.find_subcommand_mut("results").unwrap().print_help().unwrap();
                             }
                         }
                     }
diff --git a/src/query.rs b/src/query.rs
index e4ece56..7f63c05 100644
--- a/src/query.rs
+++ b/src/query.rs
@@ -34,7 +34,7 @@ pub fn execute(sql: &str, workspace_id: &str, connection: Option<&str>, format:
     let api_key = match &profile_config.api_key {
         Some(key) if key != "PLACEHOLDER" => key.clone(),
         _ => {
-            eprintln!("error: not authenticated. Run 'hotdata auth login' to log in.");
+            eprintln!("error: not authenticated. Run 'hotdata auth' to log in.");
             std::process::exit(1);
         }
     };
diff --git a/src/results.rs b/src/results.rs
index 91c81fb..cbf9c68 100644
--- a/src/results.rs
+++ b/src/results.rs
@@ -52,7 +52,7 @@ pub fn list(workspace_id: &str, limit: Option<u32>, offset: Option<u32>, format:
     let api_key = match &profile_config.api_key {
         Some(key) if key != "PLACEHOLDER" => key.clone(),
         _ => {
-            eprintln!("error: not authenticated. Run 'hotdata auth login' to log in.");
+            eprintln!("error: not authenticated. Run 'hotdata auth' to log in.");
             std::process::exit(1);
         }
     };
@@ -128,7 +128,7 @@ pub fn get(result_id: &str, workspace_id: &str, format: &str) {
     let api_key = match &profile_config.api_key {
         Some(key) if key != "PLACEHOLDER" => key.clone(),
         _ => {
-            eprintln!("error: not authenticated. Run 'hotdata auth login' to log in.");
+            eprintln!("error: not authenticated. Run 'hotdata auth' to log in.");
             std::process::exit(1);
         }
     };
diff --git a/src/skill.rs b/src/skill.rs
index 76fc2b2..cf34d91 100644
--- a/src/skill.rs
+++ b/src/skill.rs
@@ -275,11 +275,11 @@ pub fn install_project() {
 pub fn install() {
     let current = Version::parse(CURRENT_VERSION).expect("invalid package version");
 
-    if is_managed_by_skills_agent() {
+    let needs_download = if is_managed_by_skills_agent() {
         match read_installed_version() {
             Some(ref v) if *v >= current => {
                 println!("Managed by skills agent — already up to date (v{v}).");
-                return;
+                false
             }
             Some(ref v) => {
                 println!(
@@ -287,26 +287,35 @@ pub fn install() {
                     format!("Managed by skills agent — updating from v{v} to v{current}...")
                         .yellow()
                 );
+                true
             }
             None => {
-                println!("Managed by skills agent — skipping.");
-                return;
+                println!("Installing hotdata-cli skill v{current}...");
+                true
             }
         }
     } else {
         match read_installed_version() {
             Some(ref v) if *v >= current => {
                 println!("Already up to date (v{v}).");
-                return;
+                false
+            }
+            Some(ref v) => {
+                println!("Updating from v{v} to v{current}...");
+                true
+            }
+            None => {
+                println!("Installing hotdata-cli skill v{current}...");
+                true
             }
-            Some(ref v) => println!("Updating from v{v} to v{current}..."),
-            None => println!("Installing hotdata-cli skill v{current}..."),
         }
-    }
+    };
 
-    if let Err(e) = download_and_extract() {
-        eprintln!("{}", e.red());
-        std::process::exit(1);
+    if needs_download {
+        if let Err(e) = download_and_extract() {
+            eprintln!("{}", e.red());
+            std::process::exit(1);
+        }
     }
 
     let symlinks = ensure_symlinks();
@@ -340,7 +349,7 @@ pub fn status() {
 
     if !exists {
         row("Installed", &"No".red().to_string());
-        println!("\nRun 'hotdata skill install' to install.");
+        println!("\nRun 'hotdata skills install' to install.");
         return;
     }
 
@@ -386,6 +395,6 @@ pub fn status() {
     }
 
     if installed_version.map_or(false, |v| v < current) {
-        println!("\nRun 'hotdata skill install' to update.");
+        println!("\nRun 'hotdata skills install' to update.");
     }
 }
diff --git a/src/tables.rs b/src/tables.rs
index bf6cf9d..f22088b 100644
--- a/src/tables.rs
+++ b/src/tables.rs
@@ -66,7 +66,7 @@ pub fn list(
     let api_key = match &profile_config.api_key {
         Some(key) if key != "PLACEHOLDER" => key.clone(),
         _ => {
-            eprintln!("error: not authenticated. Run 'hotdata auth login' to log in.");
+            eprintln!("error: not authenticated. Run 'hotdata auth' to log in.");
             std::process::exit(1);
         }
     };
diff --git a/src/workspace.rs b/src/workspace.rs
index 9d68ed9..da2c29b 100644
--- a/src/workspace.rs
+++ b/src/workspace.rs
@@ -26,7 +26,7 @@ fn load_client() -> (reqwest::blocking::Client, String, String) {
     let api_key = match &profile_config.api_key {
         Some(key) if key != "PLACEHOLDER" => key.clone(),
         _ => {
-            eprintln!("error: not authenticated. Run 'hotdata auth login' to log in.");
+            eprintln!("error: not authenticated. Run 'hotdata auth' to log in.");
             std::process::exit(1);
         }
     };
@@ -115,7 +115,7 @@ pub fn list(format: &str) {
     let api_key = match &profile_config.api_key {
         Some(key) if key != "PLACEHOLDER" => key.clone(),
         _ => {
-            eprintln!("error: not authenticated. Run 'hotdata auth login' to log in.");
+            eprintln!("error: not authenticated. Run 'hotdata auth' to log in.");
             std::process::exit(1);
         }
     };