diff --git a/lib/cli-common.js b/lib/cli-common.js
index 43194d6..edc726b 100644
--- a/lib/cli-common.js
+++ b/lib/cli-common.js
@@ -63,37 +63,12 @@ common.api.directory = function (state, next) {
 };
 common.api.token = function (state, handlers) {
   common.api.directory(state, function (err, dir) {
-    // directory, requested, connect, tunnelUrl, granted, authorized
+    // directory, requested, connect, tunnelUrl, offer, granted, end
     function afterDir() {
       //console.log('[debug] after dir');
-      var otp = state.otp || state._otp || common.otp();
-      var authReq = state.authRequest || state._auth || {
-        subject: state.config.email
-      , subject_scheme: 'mailto'
-        // TODO create domains list earlier
-      , scope: Object.keys(state.config.servernames || {})
-          .concat(Object.keys(state.config.ports || {})).join(',')
-      , otp: otp
-      , hostname: os.hostname()
-        // Used for User-Agent
-      , os_type: os.type()
-      , os_platform: os.platform()
-      , os_release: os.release()
-      , os_arch: os.arch()
-      };
-
-      // backwards compat (TODO remove)
-      if (err || !dir || !dir.pair_request) {
-        //console.log('[debug] no dir, connect');
-        handlers.connect(authReq, function () {
-          /*ignore*/
-          handlers.end(null, function () {});
-        });
-        return;
-      }
-
       state.relayHostname = common.parseHostname(state.relay);
       state.wss = dir.tunnel.method + '://' + dir.api_host.replace(/:hostname/g, state.relayHostname) + dir.tunnel.pathname;
+
       handlers.tunnelUrl(state.wss, function () {
         //console.log('[debug] after tunnelUrl');
         if (!state.config.token && state.config.secret) {
@@ -120,11 +95,31 @@ common.api.token = function (state, handlers) {
           });
           return;
         }
+
+        // backwards compat (TODO remove)
+        if (err || !dir || !dir.pair_request) {
+          //console.log('[debug] no dir, connect');
+          handlers.error(new Error("No token found or generated, and no pair_request api found."));
+          return;
+        }
         
         // TODO sign token with own private key, including public key and thumbprint
         //      (much like ACME JOSE account)
-
-        // TODO do auth stuff
+        var otp = state.otp || state._otp || common.otp();
+        var authReq = state.authRequest || state._auth || {
+          subject: state.config.email
+        , subject_scheme: 'mailto'
+          // TODO create domains list earlier
+        , scope: Object.keys(state.config.servernames || {})
+            .concat(Object.keys(state.config.ports || {})).join(',')
+        , otp: otp
+        , hostname: os.hostname()
+          // Used for User-Agent
+        , os_type: os.type()
+        , os_platform: os.platform()
+        , os_release: os.release()
+        , os_arch: os.arch()
+        };
         var pairRequestUrl = url.resolve('https://' + dir.api_host.replace(/:hostname/g, state.relayHostname), dir.pair_request.pathname);
         var req = {
           url: pairRequestUrl
@@ -207,6 +202,8 @@ common.api.token = function (state, handlers) {
     if (dir) {
       handlers.directory(dir, afterDir);
     } else {
+      // backwards compat
+      dir = { api_host: ':hostname', tunnel: { method: "wss", pathname: "" } };
       afterDir();
     }
   });