diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index eb3cbbb2e..7f83dfa02 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -22,3 +22,16 @@ jobs:
 
     - name: ci
       run: PATH=$(go env GOPATH)/bin:$PATH make ci
+
+    - name: integration
+      # skip running this action if the PR is coming from a fork:
+      if: github.event.pull_request.head.repo.full_name == github.repository
+      shell: bash
+      run: PATH=$(go env GOPATH)/bin:$PATH make integration
+      env:
+          AUTH0_CLI_CLIENT_NAME: ${{ secrets.AUTH0_CLI_CLIENT_NAME }}
+          AUTH0_CLI_CLIENT_DOMAIN: ${{ secrets.AUTH0_CLI_CLIENT_DOMAIN }}
+          AUTH0_CLI_CLIENT_ID: ${{ secrets.AUTH0_CLI_CLIENT_ID }}
+          AUTH0_CLI_CLIENT_SECRET: ${{ secrets.AUTH0_CLI_CLIENT_SECRET }}
+          AUTH0_CLI_REUSE_CONFIG: ${{ secrets.AUTH0_CLI_REUSE_CONFIG }}
+          AUTH0_CLI_OVERWRITE: ${{ secrets.AUTH0_CLI_OVERWRITE }}
diff --git a/Makefile b/Makefile
index d65c8b1c5..a70e37b1d 100644
--- a/Makefile
+++ b/Makefile
@@ -38,11 +38,7 @@ lint:
 
 # Build for the native platform
 build:
-	go build -ldflags "$(CTIMEVAR)" -o auth0 cmd/auth0/main.go
-.PHONY: build
-
-# Build for the native platform
-build:
+	go build -ldflags "$(CTIMEVAR)" -o $(GOBIN)/auth0 cmd/auth0/main.go
 .PHONY: build
 
 # Build a beta version of auth0-cli for all supported platforms
@@ -78,5 +74,9 @@ integration-cleanup:
 	./integration/test-cleanup.sh
 .PHONY: integration-cleanup
 
-integration: $(GOBIN)/auth0-cli-config-generator $(GOBIN)/commander run-integration integration-cleanup
+integration: build $(GOBIN)/auth0-cli-config-generator $(GOBIN)/commander 
+	$(MAKE) run-integration; \
+	ret=$$?; \
+	$(MAKE) integration-cleanup; \
+	exit $$ret
 .PHONY: integration
diff --git a/integration/test-cleanup.sh b/integration/test-cleanup.sh
index df36daf1d..691f62829 100755
--- a/integration/test-cleanup.sh
+++ b/integration/test-cleanup.sh
@@ -9,7 +9,8 @@ for app in $( echo "${apps}" | jq -r '.[] | @base64' ); do
 
     clientid=$(_jq '.ClientID')
     name=$(_jq '.Name')
-
+		# TODO(jfatta): should remove only those 
+		# created during the same test session
     if [[ $name = integration-test-* ]]
     then
         echo deleting "$name"
diff --git a/internal/cli/apps.go b/internal/cli/apps.go
index bce1b9c50..c3ba11412 100644
--- a/internal/cli/apps.go
+++ b/internal/cli/apps.go
@@ -416,7 +416,7 @@ auth0 apps create -n myapp -t [native|spa|regular|m2m] --description <descriptio
 			if err := ansi.Waiting(func() error {
 				return cli.api.Client.Create(a)
 			}); err != nil {
-				return fmt.Errorf("Unable to create application: %w", err)
+				return fmt.Errorf("Unable to create application: %v", err)
 			}
 
 			if err := cli.setDefaultAppID(a.GetClientID()); err != nil {
diff --git a/pkg/auth0-cli-config-generator/main.go b/pkg/auth0-cli-config-generator/main.go
index 8abcec083..955837529 100644
--- a/pkg/auth0-cli-config-generator/main.go
+++ b/pkg/auth0-cli-config-generator/main.go
@@ -11,6 +11,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"strings"
 	"time"
 
 	"github.com/lestrrat-go/jwx/jwt"
@@ -21,17 +22,23 @@ import (
 
 type params struct {
 	filePath     string
-	clientName   string
 	clientDomain string
 	clientID     string
 	clientSecret string
 }
 
-func (p params) validate() error {
-	if p.clientName == "" {
-		return fmt.Errorf("Missing client name")
-	}
+var requiredScopes = []string{
+	//	"openid",
+	//	"offline_access", // <-- to get a refresh token.
+	"create:clients", "delete:clients", "read:clients", "update:clients",
+	"create:resource_servers", "delete:resource_servers", "read:resource_servers", "update:resource_servers",
+	"create:rules", "delete:rules", "read:rules", "update:rules",
+	"read:users", "update:users",
+	"read:branding", "update:branding",
+	"read:client_keys", "read:logs", "read:tenant_settings", "read:custom_domains",
+}
 
+func (p params) validate() error {
 	if p.clientDomain == "" {
 		return fmt.Errorf("Missing client domain")
 	}
@@ -65,6 +72,7 @@ type tenant struct {
 	Domain      string    `json:"domain"`
 	AccessToken string    `json:"access_token,omitempty"`
 	ExpiresAt   time.Time `json:"expires_at"`
+	Scopes      []string  `json:"scopes,omitempty"`
 }
 
 func isLoggedIn(filePath string) bool {
@@ -133,7 +141,6 @@ func main() {
 			reuseConfig := viper.GetBool("REUSE_CONFIG")
 			overwrite := viper.GetBool("OVERWRITE")
 			filePath := viper.GetString("FILEPATH")
-			clientName := viper.GetString("CLIENT_NAME")
 			clientDomain := viper.GetString("CLIENT_DOMAIN")
 			clientID := viper.GetString("CLIENT_ID")
 			clientSecret := viper.GetString("CLIENT_SECRET")
@@ -146,7 +153,7 @@ func main() {
 				return nil
 			}
 
-			p := params{filePath, clientName, clientDomain, clientID, clientSecret}
+			p := params{filePath, clientDomain, clientID, clientSecret}
 			if err := p.validate(); err != nil {
 				return err
 			}
@@ -157,10 +164,14 @@ func main() {
 			}
 
 			c := &clientcredentials.Config{
-				ClientID:       p.clientID,
-				ClientSecret:   p.clientSecret,
-				TokenURL:       u.String() + "/oauth/token",
-				EndpointParams: url.Values{"audience": {u.String() + "/api/v2/"}},
+				ClientID:     p.clientID,
+				ClientSecret: p.clientSecret,
+				TokenURL:     u.String() + "/oauth/token",
+				EndpointParams: url.Values{
+					"client_id": {p.clientID},
+					"scope":     {strings.Join(requiredScopes, " ")},
+					"audience":  {u.String() + "/api/v2/"},
+				},
 			}
 
 			token, err := c.Token(context.Background())
@@ -168,9 +179,18 @@ func main() {
 				return err
 			}
 
-			t := tenant{p.clientName, p.clientDomain, token.AccessToken, token.Expiry}
+			t := tenant{
+				Name:        p.clientDomain,
+				Domain:      p.clientDomain,
+				AccessToken: token.AccessToken,
+				ExpiresAt:   token.Expiry,
+				Scopes:      append([]string{"openid", "offline_access"}, requiredScopes...),
+			}
 
-			cfg := config{p.clientName, map[string]tenant{p.clientName: t}}
+			cfg := config{
+				DefaultTenant: p.clientDomain,
+				Tenants:       map[string]tenant{p.clientDomain: t},
+			}
 			if err := persistConfig(p.filePath, cfg, overwrite); err != nil {
 				return err
 			}
@@ -185,8 +205,6 @@ func main() {
 	flags := cmd.Flags()
 	flags.String("filepath", path.Join(os.Getenv("HOME"), ".config", "auth0", "config.json"), "Filepath for the auth0 cli config")
 	_ = viper.BindPFlag("FILEPATH", flags.Lookup("filepath"))
-	flags.String("client-name", "", "Client name to set within config")
-	_ = viper.BindPFlag("CLIENT_NAME", flags.Lookup("client-name"))
 	flags.String("client-id", "", "Client ID to set within config")
 	_ = viper.BindPFlag("CLIENT_ID", flags.Lookup("client-id"))
 	flags.String("client-secret", "", "Client secret to use to generate token which is set within config")