diff --git a/zign/cli.py b/zign/cli.py
index 2fabfb2..b6cd3e0 100644
--- a/zign/cli.py
+++ b/zign/cli.py
@@ -87,7 +87,8 @@ def token(name, authorize_url, client_id, business_partner_id, refresh):
     '''Create a new Platform IAM token or use an existing one.'''
 
     try:
-        token = get_token_implicit_flow(name, authorize_url, client_id, business_partner_id, refresh)
+        token = get_token_implicit_flow(name, authorize_url=authorize_url, client_id=client_id,
+                                        business_partner_id=business_partner_id, refresh=refresh)
     except AuthenticationFailed as e:
         raise click.UsageError(e)
     access_token = token.get('access_token')

diff --git a/tests/test_cli.py b/tests/test_cli.py
new file mode 100644
index 0000000..8b23802
--- /dev/null
+++ b/tests/test_cli.py
@@ -0,0 +1,19 @@
+from click.testing import CliRunner
+from unittest.mock import MagicMock
+from zign.cli import cli
+
+
+def test_token(monkeypatch):
+    token = 'abc-123'
+
+    get_token_implicit_flow = MagicMock()
+    get_token_implicit_flow.return_value = {'access_token': token, 'expires_in': 1, 'token_type': 'test'}
+    monkeypatch.setattr('zign.cli.get_token_implicit_flow', get_token_implicit_flow)
+
+    runner = CliRunner()
+
+    with runner.isolated_filesystem():
+        result = runner.invoke(cli, ['token', '-n', 'mytok', '--refresh'], catch_exceptions=False)
+
+        assert token == result.output.rstrip().split('\n')[-1]
+        get_token_implicit_flow.assert_called_with('mytok', authorize_url=None, business_partner_id=None, client_id=None, refresh=True)

--refresh doesn't do anything useful
The `--refresh` flag doesn't do anything for named tokens.

```
$ ztoken token --refresh -n postman | md5sum
34e6b2a7a14439271f077690eba31fa3  -
$ ztoken token --refresh -n postman | md5sum
34e6b2a7a14439271f077690eba31fa3  -
```

I expected this to request a new token using the existing refresh token.

Interestingly it also does weird things when requesting an unnamed token (`ztoken token --refresh`). Then a browser window is always opened and after successful authentication you get

```
{
"error": "invalid_client",
"error_description": "invalid client"
}
```

The reason for that seems to be wrong creation of the URL. It points to `.../oauth2/authorize?business_partner_id=True&client_id=ztoken&redirect_uri=http://localhost:8081&response_type=token` (True as business_partner_id).

---

There is also the general weirdness of different behavior of when new tokens are created. Creating an unnamed token just records the refresh token but not the token and no lifetime. This way every run of `ztoken` has to create a new token and so `--refresh` would be pointless there. Creating a named token records the lifetime and seems to return the same token every time as long as it is valid. Even if the `--refresh` thing were fixed, this dichotomy would not go away.
tests/test_cli.py::test_token