diff --git a/go.sum b/go.sum
index f319300378eeddce82981d7cb06b459877c59a4a..258bd16bf7489c5e2a48b72a7dc2972d6294a401 100644
--- a/go.sum
+++ b/go.sum
@@ -85,6 +85,7 @@ github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dR
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/bradfitz/gomemcache v0.0.0-20220106215444-fb4bf637b56d/go.mod h1:H0wQNHz2YrLsuXOZozoeDmnHXkNCRmMW0gwFWDfEZDA=
 github.com/casbin/casbin/v2 v2.1.2/go.mod h1:YcPU1XXisHhLzuxH9coDNf2FbKpjGlbCg3n9yuLkIJQ=
+github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
 github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
 github.com/cenkalti/backoff/v4 v4.0.2/go.mod h1:eEew/i+1Q6OrCDZh3WiXYv3+nJwBASZ8Bog/87DQnVg=
 github.com/cenkalti/backoff/v4 v4.1.0/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
diff --git a/main.go b/main.go
index a9ec0b26dfbf5ff5f52131fd675fab7654d2ddaf..2eb16360d75eda76ee41c4f31768bbc79cf41b36 100644
--- a/main.go
+++ b/main.go
@@ -11,21 +11,18 @@ import (
 	"git.autistici.org/id/auth/client"
 )
 
-const defaultPort = 4041
+var (
+	port    = flag.Int("port", 4041, "A port to bind to on the specified addresses")
+	service = flag.String("service", "xmpp", "Service to use for authentication")
+)
 
 func main() {
-	var port = flag.Int("port", defaultPort, "A port to bind to on the specified addresses")
 	flag.Parse()
 
-	if flag.NArg() != 1 {
-		log.Fatal("Expected exactly one service name")
-	}
-
-	service := flag.Args()[0]
-
+	http.HandleFunc("/", authHandlerFunc)
 	log.Fatal(http.ListenAndServe(
 		fmt.Sprintf("127.0.0.1:%d", *port),
-		http.HandlerFunc(authHandlerFunc(service))))
+		nil))
 }
 
 type authPayload struct {
@@ -33,37 +30,35 @@ type authPayload struct {
 	Pass string `json:"password"`
 }
 
-func authHandlerFunc(service string) func(w http.ResponseWriter, r *http.Request) {
-	return func(w http.ResponseWriter, r *http.Request) {
-		var p authPayload
-		err := json.NewDecoder(r.Body).Decode(&p)
-		if err != nil {
-			log.Printf("malformed request: %s", err)
-			http.Error(w, "malformed request", http.StatusBadRequest)
-			return
-		}
+func authHandlerFunc(w http.ResponseWriter, r *http.Request) {
+	var p authPayload
+	err := json.NewDecoder(r.Body).Decode(&p)
+	if err != nil {
+		log.Printf("malformed request: %s", err)
+		http.Error(w, "malformed request", http.StatusBadRequest)
+		return
+	}
 
-		c := client.New(client.DefaultSocketPath)
-		resp, err := c.Authenticate(r.Context(), &auth.Request{
-			Service:  service,
-			Username: p.User,
-			Password: []byte(p.Pass),
-		})
-		if err != nil {
-			log.Printf("auth error: %s", err)
-			http.Error(w, "internal server error", http.StatusInternalServerError)
-			return
-		}
-		switch resp.Status {
-		case auth.StatusOK:
-			w.WriteHeader(http.StatusOK)
-			return
-		case auth.StatusInsufficientCredentials:
-			http.Error(w, "wrong credentials", http.StatusForbidden)
-			return
-		case auth.StatusError:
-			http.Error(w, "internal server error", http.StatusInternalServerError)
-			return
-		}
+	c := client.New(client.DefaultSocketPath)
+	resp, err := c.Authenticate(r.Context(), &auth.Request{
+		Service:  *service,
+		Username: p.User,
+		Password: []byte(p.Pass),
+	})
+	if err != nil {
+		log.Printf("auth error: %s", err)
+		http.Error(w, "internal server error", http.StatusInternalServerError)
+		return
+	}
+	switch resp.Status {
+	case auth.StatusOK:
+		w.WriteHeader(http.StatusOK)
+		return
+	case auth.StatusInsufficientCredentials:
+		http.Error(w, "wrong credentials", http.StatusForbidden)
+		return
+	case auth.StatusError:
+		http.Error(w, "internal server error", http.StatusInternalServerError)
+		return
 	}
 }