diff --git a/ais/earlystart.go b/ais/earlystart.go
index 468673309b7..cc95d442a4a 100644
--- a/ais/earlystart.go
+++ b/ais/earlystart.go
@@ -1,6 +1,6 @@
 // Package ais provides core functionality for the AIStore object storage.
 /*
- * Copyright (c) 2018-2021, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
 package ais
 
@@ -11,6 +11,7 @@ import (
 
 	"github.com/NVIDIA/aistore/3rdparty/glog"
 	"github.com/NVIDIA/aistore/api/apc"
+	"github.com/NVIDIA/aistore/api/env"
 	"github.com/NVIDIA/aistore/cluster"
 	"github.com/NVIDIA/aistore/cmn"
 	"github.com/NVIDIA/aistore/cmn/cos"
@@ -115,14 +116,14 @@ func (p *proxy) determineRole(loadedSmap *smapX) (pid string, primary bool) {
 		pid     string
 		primary bool
 	}{
-		pid:     os.Getenv(cmn.EnvVars.PrimaryID),
-		primary: cos.IsParseBool(os.Getenv(cmn.EnvVars.IsPrimary)),
+		pid:     os.Getenv(env.AIS.PrimaryID),
+		primary: cos.IsParseBool(os.Getenv(env.AIS.IsPrimary)),
 	}
 
 	if envP.pid != "" && envP.primary && p.si.ID() != envP.pid {
 		cos.ExitLogf(
 			"FATAL: %s: invalid combination of %s=true & %s=%s",
-			p.si, cmn.EnvVars.IsPrimary, cmn.EnvVars.PrimaryID, envP.pid,
+			p.si, env.AIS.IsPrimary, env.AIS.PrimaryID, envP.pid,
 		)
 	}
 	glog.Infof("%s: %sprimary-env=%+v", p.si.StringEx(), tag, envP)
@@ -132,13 +133,13 @@ func (p *proxy) determineRole(loadedSmap *smapX) (pid string, primary bool) {
 		if primary == nil {
 			glog.Errorf(
 				"%s: ignoring %s=%s - not found in the loaded %s",
-				p.si, cmn.EnvVars.IsPrimary, envP.pid, loadedSmap,
+				p.si, env.AIS.IsPrimary, envP.pid, loadedSmap,
 			)
 			envP.pid = ""
 		} else if loadedSmap.Primary.ID() != envP.pid {
 			glog.Warningf(
 				"%s: new %s=%s, previous %s",
-				p.si, cmn.EnvVars.PrimaryID, envP.pid, loadedSmap.Primary,
+				p.si, env.AIS.PrimaryID, envP.pid, loadedSmap.Primary,
 			)
 			loadedSmap.Primary = primary
 		}
diff --git a/ais/proxy.go b/ais/proxy.go
index 474e1161f7b..929b31dcab9 100644
--- a/ais/proxy.go
+++ b/ais/proxy.go
@@ -23,6 +23,7 @@ import (
 
 	"github.com/NVIDIA/aistore/3rdparty/glog"
 	"github.com/NVIDIA/aistore/api/apc"
+	"github.com/NVIDIA/aistore/api/env"
 	"github.com/NVIDIA/aistore/cluster"
 	"github.com/NVIDIA/aistore/cmn"
 	"github.com/NVIDIA/aistore/cmn/cos"
@@ -2341,7 +2342,7 @@ func (p *proxy) httpdaeget(w http.ResponseWriter, r *http.Request) {
 			DeploymentType: deploymentType(),
 			Version:        daemon.version,
 			BuildTime:      daemon.buildTime,
-			K8sPodName:     os.Getenv(cmn.EnvVars.K8sPod),
+			K8sPodName:     os.Getenv(env.AIS.K8sPod),
 		}
 
 		p.writeJSON(w, r, msg, what)
diff --git a/ais/tests/main_test.go b/ais/tests/main_test.go
index 34c2997b58e..a346c0d7736 100644
--- a/ais/tests/main_test.go
+++ b/ais/tests/main_test.go
@@ -1,6 +1,6 @@
 // Package integration contains AIS integration tests.
 /*
- * Copyright (c) 2018-2021, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
 package integration
 
@@ -15,6 +15,7 @@ import (
 
 	"github.com/NVIDIA/aistore/api"
 	"github.com/NVIDIA/aistore/api/apc"
+	"github.com/NVIDIA/aistore/api/env"
 	"github.com/NVIDIA/aistore/cmn"
 	"github.com/NVIDIA/aistore/cmn/cos"
 	"github.com/NVIDIA/aistore/devtools/tlog"
@@ -50,16 +51,16 @@ func waitForCluster() error {
 		err                        error
 		proxyCnt, targetCnt, retry int
 	)
-	pc := os.Getenv(cmn.EnvVars.NumProxy)
-	tc := os.Getenv(cmn.EnvVars.NumTarget)
+	pc := os.Getenv(env.AIS.NumProxy)
+	tc := os.Getenv(env.AIS.NumTarget)
 	if pc != "" || tc != "" {
 		proxyCnt, err = strconv.Atoi(pc)
 		if err != nil {
-			return fmt.Errorf("error EnvVars: %s. err: %v", cmn.EnvVars.NumProxy, err)
+			return fmt.Errorf("error EnvVars: %s. err: %v", env.AIS.NumProxy, err)
 		}
 		targetCnt, err = strconv.Atoi(tc)
 		if err != nil {
-			return fmt.Errorf("error EnvVars: %s. err: %v", cmn.EnvVars.NumTarget, err)
+			return fmt.Errorf("error EnvVars: %s. err: %v", env.AIS.NumTarget, err)
 		}
 	}
 	_, err = tutils.WaitForClusterState(tutils.GetPrimaryURL(), "startup", -1, proxyCnt, targetCnt)
diff --git a/ais/tests/s3compat/e2e_s3_test.go b/ais/tests/s3compat/e2e_s3_test.go
index 3c6c2d2dd24..da2894b0d45 100644
--- a/ais/tests/s3compat/e2e_s3_test.go
+++ b/ais/tests/s3compat/e2e_s3_test.go
@@ -1,6 +1,6 @@
 // Package s3_integration provides tests of compatibility with AWS S3
 /*
- * Copyright (c) 2018-2021, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
 package integration
 
@@ -11,7 +11,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/NVIDIA/aistore/cmn"
+	"github.com/NVIDIA/aistore/api/env"
 	"github.com/NVIDIA/aistore/cmn/cos"
 	"github.com/NVIDIA/aistore/devtools/tutils"
 	. "github.com/onsi/ginkgo"
@@ -38,7 +38,7 @@ var _ = Describe("E2E AWS Compatibility Tests", func() {
 		params string
 	)
 
-	if value := os.Getenv(cmn.EnvVars.UseHTTPS); cos.IsParseBool(value) {
+	if value := os.Getenv(env.AIS.UseHTTPS); cos.IsParseBool(value) {
 		host = "https://localhost:8080/s3"
 		params = "--no-check-certificate"
 	} else {
diff --git a/ais/tgtcp.go b/ais/tgtcp.go
index 5897c956b60..1207ff17da3 100644
--- a/ais/tgtcp.go
+++ b/ais/tgtcp.go
@@ -17,6 +17,7 @@ import (
 	"github.com/NVIDIA/aistore/3rdparty/glog"
 	"github.com/NVIDIA/aistore/ais/backend"
 	"github.com/NVIDIA/aistore/api/apc"
+	"github.com/NVIDIA/aistore/api/env"
 	"github.com/NVIDIA/aistore/cluster"
 	"github.com/NVIDIA/aistore/cmn"
 	"github.com/NVIDIA/aistore/cmn/cos"
@@ -262,7 +263,7 @@ func (t *target) httpdaeget(w http.ResponseWriter, r *http.Request) {
 			DeploymentType: deploymentType(),
 			Version:        daemon.version,
 			BuildTime:      daemon.buildTime,
-			K8sPodName:     os.Getenv(cmn.EnvVars.K8sPod),
+			K8sPodName:     os.Getenv(env.AIS.K8sPod),
 		}
 		// capacity
 		tstats := t.statsT.(*stats.Trunner)
diff --git a/ais/utils.go b/ais/utils.go
index 8360b45aa55..2e19bca3133 100644
--- a/ais/utils.go
+++ b/ais/utils.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/NVIDIA/aistore/3rdparty/glog"
 	"github.com/NVIDIA/aistore/api/apc"
+	"github.com/NVIDIA/aistore/api/env"
 	"github.com/NVIDIA/aistore/cluster"
 	"github.com/NVIDIA/aistore/cmn"
 	"github.com/NVIDIA/aistore/cmn/cos"
@@ -242,7 +243,7 @@ func cleanupConfigDir(name string, keepInitialConfig bool) {
 }
 
 func writeShutdownMarker() {
-	markerDir := os.Getenv(cmn.EnvVars.ShutdownMarkerPath)
+	markerDir := os.Getenv(env.AIS.ShutdownMarkerPath)
 	if markerDir == "" {
 		if k8s.Detect() == nil {
 			glog.Warningf("marker directory not specified, skipping writing shutdown marker")
@@ -259,7 +260,7 @@ func writeShutdownMarker() {
 }
 
 func deleteShutdownMarker() {
-	markerDir := os.Getenv(cmn.EnvVars.ShutdownMarkerPath)
+	markerDir := os.Getenv(env.AIS.ShutdownMarkerPath)
 	if markerDir != "" {
 		cos.RemoveFile(filepath.Join(markerDir, cmn.ShutdownMarker))
 	}
diff --git a/api/authn/loadtoken.go b/api/authn/loadtoken.go
index 0e16f3f5ba9..06465433d85 100644
--- a/api/authn/loadtoken.go
+++ b/api/authn/loadtoken.go
@@ -8,6 +8,7 @@ import (
 	"os"
 	"path/filepath"
 
+	"github.com/NVIDIA/aistore/api/env"
 	"github.com/NVIDIA/aistore/cmn"
 	"github.com/NVIDIA/aistore/cmn/cos"
 	"github.com/NVIDIA/aistore/cmn/debug"
@@ -21,7 +22,7 @@ func LoadToken(tokenFile string) string {
 		mustLoad = true
 	)
 	if tokenFile == "" {
-		tokenFile = os.Getenv(EnvVars.TokenFile)
+		tokenFile = os.Getenv(env.AuthN.TokenFile)
 	}
 	if tokenFile == "" {
 		// default config location
diff --git a/cmn/env_const.go b/api/env/ais.go
similarity index 86%
rename from cmn/env_const.go
rename to api/env/ais.go
index 7aa8b187bc2..dfb83bb430a 100644
--- a/cmn/env_const.go
+++ b/api/env/ais.go
@@ -1,14 +1,13 @@
-// Package cmn provides common constants, types, and utilities for AIS clients
-// and AIStore.
+// Package env contains environment variables
 /*
  * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
-package cmn
+package env
 
 // ais environment variable names (see also fname_const.go)
 
 var (
-	EnvVars = struct {
+	AIS = struct {
 		Endpoint           string
 		ShutdownMarkerPath string
 		IsPrimary          string
diff --git a/api/authn/env_const.go b/api/env/authn.go
similarity index 81%
rename from api/authn/env_const.go
rename to api/env/authn.go
index a61beb5d975..eff90d92ab8 100644
--- a/api/authn/env_const.go
+++ b/api/env/authn.go
@@ -1,13 +1,13 @@
-// Package authn provides AuthN API over HTTP(S)
+// Package env contains environment variables
 /*
  * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
-package authn
+package env
 
-// authn environment variable names (see also cmn/env_const.go)
+// authn environment variables
 
 var (
-	EnvVars = struct {
+	AuthN = struct {
 		Enabled   string
 		URL       string
 		ConfFile  string
diff --git a/bench/aisloader/bootstrap.go b/bench/aisloader/bootstrap.go
index a37129c36fc..50ab44469ec 100644
--- a/bench/aisloader/bootstrap.go
+++ b/bench/aisloader/bootstrap.go
@@ -57,6 +57,7 @@ import (
 	"github.com/NVIDIA/aistore/api"
 	"github.com/NVIDIA/aistore/api/apc"
 	"github.com/NVIDIA/aistore/api/authn"
+	"github.com/NVIDIA/aistore/api/env"
 	"github.com/NVIDIA/aistore/bench/aisloader/namegetter"
 	"github.com/NVIDIA/aistore/bench/aisloader/stats"
 	"github.com/NVIDIA/aistore/cmn"
@@ -552,7 +553,7 @@ func parseCmdLine() (params, error) {
 	}
 
 	aisEndpoint = "http://" + ip + ":" + port
-	envEndpoint = os.Getenv(cmn.EnvVars.Endpoint)
+	envEndpoint = os.Getenv(env.AIS.Endpoint)
 	if envEndpoint != "" {
 		aisEndpoint = envEndpoint
 	}
diff --git a/cmd/aisfs/config.go b/cmd/aisfs/config.go
index bfa6df2df41..9c4346fac9f 100644
--- a/cmd/aisfs/config.go
+++ b/cmd/aisfs/config.go
@@ -1,6 +1,6 @@
 // Package aisfs - command-line mounting utility for aisfs.
 /*
- * Copyright (c) 2018-2021, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
 package main
 
@@ -10,8 +10,8 @@ import (
 	"path/filepath"
 	"time"
 
+	"github.com/NVIDIA/aistore/api/env"
 	"github.com/NVIDIA/aistore/cmd/aisfs/fs"
-	"github.com/NVIDIA/aistore/cmn"
 	"github.com/NVIDIA/aistore/cmn/cos"
 	"github.com/NVIDIA/aistore/cmn/jsp"
 )
@@ -51,7 +51,7 @@ type (
 var defaultConfig = Config{
 	Cluster: ClusterConfig{
 		URL:           "http://127.0.0.1:8080",
-		SkipVerifyCrt: cos.IsParseBool(os.Getenv(cmn.EnvVars.SkipVerifyCrt)),
+		SkipVerifyCrt: cos.IsParseBool(os.Getenv(env.AIS.SkipVerifyCrt)),
 	},
 	Timeout: TimeoutConfig{
 		TCPTimeoutStr:  "60s",
diff --git a/cmd/aisfs/util.go b/cmd/aisfs/util.go
index 4f9f6c1d9f5..5d4d629d285 100644
--- a/cmd/aisfs/util.go
+++ b/cmd/aisfs/util.go
@@ -17,6 +17,7 @@ import (
 	"time"
 
 	"github.com/NVIDIA/aistore/api"
+	"github.com/NVIDIA/aistore/api/env"
 	"github.com/NVIDIA/aistore/cmd/aisfs/fs"
 	"github.com/NVIDIA/aistore/cmn"
 	"github.com/NVIDIA/aistore/cmn/cos"
@@ -60,9 +61,9 @@ func discoverClusterURL(c *cli.Context) string {
 		defaultAISDockerURL = "http://172.50.0.2:8080"
 		dockerErrMsgFmt     = "Failed to discover docker proxy URL: %v.\nUsing default %q.\n"
 	)
-	setURLMsg := fmt.Sprintf("Set URL with: export %s=`url`.", cmn.EnvVars.Endpoint)
+	setURLMsg := fmt.Sprintf("Set URL with: export %s=`url`.", env.AIS.Endpoint)
 
-	if envURL := os.Getenv(cmn.EnvVars.Endpoint); envURL != "" {
+	if envURL := os.Getenv(env.AIS.Endpoint); envURL != "" {
 		return envURL
 	}
 
diff --git a/cmd/aisnode/main.go b/cmd/aisnode/main.go
index 0c7f7e0e416..570347570db 100644
--- a/cmd/aisnode/main.go
+++ b/cmd/aisnode/main.go
@@ -1,6 +1,6 @@
 // Package main for the AIS node executable.
 /*
- * Copyright (c) 2018-2021, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
 package main
 
diff --git a/cmd/authn/aisreq.go b/cmd/authn/aisreq.go
index 96d477639fe..d093c0146aa 100644
--- a/cmd/authn/aisreq.go
+++ b/cmd/authn/aisreq.go
@@ -1,4 +1,4 @@
-// Package authn provides AuthN server for AIStore.
+// Package authn is authentication server for AIStore.
 /*
  * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
diff --git a/cmd/authn/config.go b/cmd/authn/config.go
index e2cc0c6068d..55c6a33d467 100644
--- a/cmd/authn/config.go
+++ b/cmd/authn/config.go
@@ -1,4 +1,4 @@
-// Package authn provides AuthN server for AIStore.
+// Package authn is authentication server for AIStore.
 /*
  * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
diff --git a/cmd/authn/const.go b/cmd/authn/const.go
index 189002354c0..091850c4d30 100644
--- a/cmd/authn/const.go
+++ b/cmd/authn/const.go
@@ -1,4 +1,4 @@
-// Package authn provides AuthN server for AIStore.
+// Package authn is authentication server for AIStore.
 /*
  * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
diff --git a/cmd/authn/hcommon.go b/cmd/authn/hcommon.go
index 23517b386c1..47c6ce595be 100644
--- a/cmd/authn/hcommon.go
+++ b/cmd/authn/hcommon.go
@@ -1,4 +1,4 @@
-// Package authn provides AuthN server for AIStore.
+// Package authn is authentication server for AIStore.
 /*
  * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
diff --git a/cmd/authn/hserv.go b/cmd/authn/hserv.go
index 330cfda296b..e176e6834c3 100644
--- a/cmd/authn/hserv.go
+++ b/cmd/authn/hserv.go
@@ -1,4 +1,4 @@
-// Package authn provides AuthN server for AIStore.
+// Package authn is authentication server for AIStore.
 /*
  * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
diff --git a/cmd/authn/main.go b/cmd/authn/main.go
index a7f66283a72..0092e8c4453 100644
--- a/cmd/authn/main.go
+++ b/cmd/authn/main.go
@@ -1,4 +1,4 @@
-// Package authn provides AuthN server for AIStore.
+// Package authn is authentication server for AIStore.
 /*
  * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
@@ -10,28 +10,30 @@ import (
 	"os"
 	"os/signal"
 	"path/filepath"
+	"strings"
 	"syscall"
 
 	"github.com/NVIDIA/aistore/3rdparty/glog"
+	"github.com/NVIDIA/aistore/api/env"
+	"github.com/NVIDIA/aistore/cmn"
 	"github.com/NVIDIA/aistore/cmn/cos"
 	"github.com/NVIDIA/aistore/cmn/jsp"
 	"github.com/NVIDIA/aistore/dbdriver"
 )
 
-const (
-	authDB          = "authn.db"
-	secretKeyEnvVar = "SECRETKEY"
-)
+const authDB = "authn.db"
+
+const secretKeyPodEnv = "SECRETKEY" // via https://kubernetes.io/docs/concepts/configuration/secret
 
 var (
-	version    = "1.0"
-	build      string
+	build     string
+	buildtime string
+
 	configPath string
 )
 
 func init() {
-	flag.StringVar(&configPath, "config", "",
-		"config filename: local file that stores the global cluster configuration")
+	flag.StringVar(&configPath, "config", "", svcName+" configuration")
 }
 
 // Set up glog with options from configuration file
@@ -62,8 +64,20 @@ func installSignalHandler() {
 	}()
 }
 
+func printVer() {
+	fmt.Printf("version %s (build %s)\n", cmn.VersionAuthN+"."+build, buildtime)
+}
+
 func main() {
-	fmt.Printf("version: %s | build: %s\n", version, build)
+	if len(os.Args) == 2 && os.Args[1] == "version" {
+		printVer()
+		os.Exit(0)
+	}
+	if len(os.Args) == 1 || (len(os.Args) == 2 && strings.Contains(os.Args[1], "help")) {
+		printVer()
+		flag.PrintDefaults()
+		os.Exit(0)
+	}
 	installSignalHandler()
 	flag.Parse()
 
@@ -72,16 +86,20 @@ func main() {
 		configPath = confFlag.Value.String()
 	}
 	if configPath == "" {
-		cos.ExitLogf("Missing configuration file")
+		configPath = os.Getenv(env.AuthN.ConfFile)
+	}
+	if configPath == "" {
+		cos.ExitLogf("Missing %s configuration file (to specify, use '-%s' option or '%s' environment)",
+			svcName, confFlag.Name, env.AuthN.ConfFile)
 	}
 	if glog.V(4) {
-		glog.Infof("Reading configuration from %s", configPath)
+		glog.Infof("Loading configuration from %s", configPath)
 	}
 	if _, err := jsp.LoadMeta(configPath, Conf); err != nil {
 		cos.ExitLogf("Failed to load configuration from %q: %v", configPath, err)
 	}
 	Conf.Path = configPath
-	if val := os.Getenv(secretKeyEnvVar); val != "" {
+	if val := os.Getenv(secretKeyPodEnv); val != "" {
 		Conf.Server.Secret = val
 	}
 	if err := updateLogOptions(); err != nil {
@@ -96,6 +114,8 @@ func main() {
 	if err != nil {
 		cos.ExitLogf("Failed to init manager: %v", err)
 	}
+
+	printVer()
 	srv := newServer(mgr)
 	if err := srv.Run(); err != nil {
 		cos.ExitLogf("Server failed: %v", err)
diff --git a/cmd/authn/mgr.go b/cmd/authn/mgr.go
index 9734f5100fe..8f9975841ba 100644
--- a/cmd/authn/mgr.go
+++ b/cmd/authn/mgr.go
@@ -1,4 +1,4 @@
-// Package authn provides AuthN server for AIStore.
+// Package authn is authentication server for AIStore.
 /*
  * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
diff --git a/cmd/authn/unit_test.go b/cmd/authn/unit_test.go
index ade510299c9..00bbc3eeea7 100644
--- a/cmd/authn/unit_test.go
+++ b/cmd/authn/unit_test.go
@@ -1,4 +1,4 @@
-// Package authn provides AuthN server for AIStore.
+// Package authn is authentication server for AIStore.
 /*
  * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
diff --git a/cmd/authn/utils.go b/cmd/authn/utils.go
index 4302952ee4e..0e88285cfd4 100644
--- a/cmd/authn/utils.go
+++ b/cmd/authn/utils.go
@@ -1,4 +1,4 @@
-// Package authn provides AuthN server for AIStore.
+// Package authn is authentication server for AIStore.
 /*
  * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
diff --git a/cmd/cli/commands/app.go b/cmd/cli/commands/app.go
index 45cc0170ea8..89d9d8abc19 100644
--- a/cmd/cli/commands/app.go
+++ b/cmd/cli/commands/app.go
@@ -1,6 +1,6 @@
 // Package commands provides the set of CLI commands used to communicate with the AIS cluster.
 /*
- * Copyright (c) 2018-2021, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
 package commands
 
@@ -13,6 +13,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/NVIDIA/aistore/api/env"
 	"github.com/NVIDIA/aistore/cluster"
 	"github.com/NVIDIA/aistore/cmd/cli/config"
 	"github.com/NVIDIA/aistore/cmn"
@@ -151,7 +152,7 @@ func (aisCLI *AISCLI) handleCLIError(err error) error {
 		errmsg += fmt.Sprintf("Error: %s\n"+
 			"Make sure that environment variable %s points to an AIS gateway (any AIS gateway in the cluster)\n"+
 			"For default settings, see CLI config at %s (or run `ais show config cli`)",
-			detailedErr, cmn.EnvVars.Endpoint, config.Path())
+			detailedErr, env.AIS.Endpoint, config.Path())
 		return errors.New(red(errmsg))
 	}
 	switch err := err.(type) {
diff --git a/cmd/cli/commands/auth_hdlr.go b/cmd/cli/commands/auth_hdlr.go
index 89a9148af61..c54e25d3fda 100644
--- a/cmd/cli/commands/auth_hdlr.go
+++ b/cmd/cli/commands/auth_hdlr.go
@@ -1,7 +1,7 @@
 // Package commands provides the set of CLI commands used to communicate with the AIS cluster.
 // This file handles commands that create entities in the cluster.
 /*
- * Copyright (c) 2018-2021, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
 package commands
 
@@ -16,6 +16,7 @@ import (
 	"github.com/NVIDIA/aistore/api"
 	"github.com/NVIDIA/aistore/api/apc"
 	"github.com/NVIDIA/aistore/api/authn"
+	"github.com/NVIDIA/aistore/api/env"
 	"github.com/NVIDIA/aistore/cluster"
 	"github.com/NVIDIA/aistore/cmd/cli/config"
 	"github.com/NVIDIA/aistore/cmd/cli/templates"
@@ -214,13 +215,13 @@ var (
 func wrapAuthN(f cli.ActionFunc) cli.ActionFunc {
 	return func(c *cli.Context) error {
 		if authnHTTPClient == nil {
-			return errors.New(authn.EnvVars.URL + " is not set")
+			return errors.New(env.AuthN.URL + " is not set")
 		}
 		err := f(c)
 		if err != nil {
 			if msg, unreachable := isUnreachableError(err); unreachable {
 				err = fmt.Errorf(authnUnreachable, authParams.URL+" (detailed error: "+msg+")",
-					authn.EnvVars.URL)
+					env.AuthN.URL)
 			}
 		}
 		return err
@@ -237,7 +238,7 @@ func readMasked(c *cli.Context, prompt string) string {
 }
 
 func cliAuthnURL(cfg *config.Config) string {
-	authURL := os.Getenv(authn.EnvVars.URL)
+	authURL := os.Getenv(env.AuthN.URL)
 	if authURL == "" {
 		authURL = cfg.Auth.URL
 	}
diff --git a/cmd/cli/commands/utils.go b/cmd/cli/commands/utils.go
index 9d3ff2bca38..0dff16bc7aa 100644
--- a/cmd/cli/commands/utils.go
+++ b/cmd/cli/commands/utils.go
@@ -26,6 +26,7 @@ import (
 	"github.com/NVIDIA/aistore/api"
 	"github.com/NVIDIA/aistore/api/apc"
 	"github.com/NVIDIA/aistore/api/authn"
+	"github.com/NVIDIA/aistore/api/env"
 	"github.com/NVIDIA/aistore/cluster"
 	"github.com/NVIDIA/aistore/cmd/cli/config"
 	"github.com/NVIDIA/aistore/cmd/cli/templates"
@@ -711,7 +712,7 @@ func headBucket(bck cmn.Bck) (p *cmn.BucketProps, err error) {
 // 3. Docker default; if not present:
 // 4. Default as cfg.Cluster.DefaultAISHost
 func determineClusterURL(cfg *config.Config) string {
-	if envURL := os.Getenv(cmn.EnvVars.Endpoint); envURL != "" {
+	if envURL := os.Getenv(env.AIS.Endpoint); envURL != "" {
 		return envURL
 	}
 	if cfg.Cluster.URL != "" {
diff --git a/cmd/cli/config/config.go b/cmd/cli/config/config.go
index 4d155917c7e..ea4dc81cb9a 100644
--- a/cmd/cli/config/config.go
+++ b/cmd/cli/config/config.go
@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/NVIDIA/aistore/api/apc"
+	"github.com/NVIDIA/aistore/api/env"
 	"github.com/NVIDIA/aistore/cmn"
 	"github.com/NVIDIA/aistore/cmn/cos"
 	"github.com/NVIDIA/aistore/cmn/jsp"
@@ -38,7 +39,7 @@ var (
 func init() {
 	ConfigDir = jsp.DefaultAppConfigDir()
 	proto := "http"
-	if value := os.Getenv(cmn.EnvVars.UseHTTPS); cos.IsParseBool(value) {
+	if value := os.Getenv(env.AIS.UseHTTPS); cos.IsParseBool(value) {
 		proto = "https"
 	}
 	aisURL := fmt.Sprintf(urlFmt, proto, defaultAISIP, defaultAISPort)
@@ -47,7 +48,7 @@ func init() {
 			URL:               aisURL,
 			DefaultAISHost:    aisURL,
 			DefaultDockerHost: fmt.Sprintf(urlFmt, proto, defaultDockerIP, defaultAISPort),
-			SkipVerifyCrt:     cos.IsParseBool(os.Getenv(cmn.EnvVars.SkipVerifyCrt)),
+			SkipVerifyCrt:     cos.IsParseBool(os.Getenv(env.AIS.SkipVerifyCrt)),
 		},
 		Timeout: TimeoutConfig{
 			TCPTimeoutStr:  "60s",
diff --git a/cmn/fname_const.go b/cmn/fname_const.go
index 5360997ca0f..202bfb22242 100644
--- a/cmn/fname_const.go
+++ b/cmn/fname_const.go
@@ -1,12 +1,17 @@
 // Package cmn provides common constants, types, and utilities for AIS clients
 // and AIStore.
 /*
- * Copyright (c) 2021, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
 package cmn
 
-// ais metadata and marker filenames (base names)
-// see also env_const.go
+// Filename Constants:
+//    - AIS metadata
+//    - CLI and AuthN configuration files (defaults)
+//    - Authentication Token (default)
+//    - persistent markers
+
+// See also: env/* for common environment variables
 
 const (
 	GlobalConfigFname   = ".ais.conf"
@@ -20,8 +25,9 @@ const (
 	VmdFname         = ".ais.vmd"         // vmd persistent file basename
 	EmdFname         = ".ais.emd"         // emd persistent file basename
 
-	TokenFname     = "auth.token" // see jsp/app.go
-	CliConfigFname = "cli.json"   // ditto
+	CliConfigFname   = "cli.json" // see jsp/app.go
+	AuthNConfigFname = "authn.json"
+	TokenFname       = "auth.token"
 
 	ShutdownMarker      = ".ais.shutdown"
 	MarkersDirName      = ".ais.markers"
diff --git a/cmn/ver_const.go b/cmn/ver_const.go
index 7f7da387158..836eaa5547a 100644
--- a/cmn/ver_const.go
+++ b/cmn/ver_const.go
@@ -27,6 +27,7 @@ const (
 	VersionAIStore = "3.10"
 	VersionCLI     = "0.92"
 	VersionLoader  = "1.5"
+	VersionAuthN   = "1.0"
 )
 
 const (
diff --git a/deploy/dev/local/deploy.sh b/deploy/dev/local/deploy.sh
index cb4dd43d323..125f4b11e03 100755
--- a/deploy/dev/local/deploy.sh
+++ b/deploy/dev/local/deploy.sh
@@ -7,9 +7,9 @@
 # To deploy AIStore as a next tier cluster to the *already running*
 # AIStore cluster set DEPLOY_AS_NEXT_TIER=1.
 #
-# NOTE: all environment variables are enumerated in the following two sources:
-# 1) cmn/env_const.go
-# 2) api/authn/env_const.go
+# NOTE: all environment variables are listed in the `env` package.
+# Please see https://github.com/NVIDIA/aistore/blob/master/api/env
+# for the most recently updated (AIS + AuthN) environment.
 #
 ############################################
 
diff --git a/devtools/tutils/init.go b/devtools/tutils/init.go
index 7df05d153f7..c91a9719eff 100644
--- a/devtools/tutils/init.go
+++ b/devtools/tutils/init.go
@@ -1,6 +1,6 @@
 // Package tutils provides common low-level utilities for all aistore unit and integration tests
 /*
- * Copyright (c) 2018-2021, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
 package tutils
 
@@ -16,6 +16,7 @@ import (
 
 	"github.com/NVIDIA/aistore/api"
 	"github.com/NVIDIA/aistore/api/authn"
+	"github.com/NVIDIA/aistore/api/env"
 	"github.com/NVIDIA/aistore/cluster"
 	"github.com/NVIDIA/aistore/cmn"
 	"github.com/NVIDIA/aistore/cmn/cos"
@@ -81,12 +82,12 @@ var (
 )
 
 func init() {
-	envURL := os.Getenv(cmn.EnvVars.Endpoint)
+	envURL := os.Getenv(env.AIS.Endpoint)
 	// Since tests do not have access to cluster configuration, the tests
 	// detect client type by the primary proxy URL passed by a user.
 	// Certificate check is always disabled.
 	transportArgs.UseHTTPS = cos.IsHTTPS(envURL)
-	transportArgs.SkipVerify = cos.IsParseBool(os.Getenv(cmn.EnvVars.SkipVerifyCrt))
+	transportArgs.SkipVerify = cos.IsParseBool(os.Getenv(env.AIS.SkipVerifyCrt))
 	HTTPClient = cmn.NewClient(transportArgs)
 
 	gctx = &Ctx{
@@ -118,7 +119,7 @@ func InitLocalCluster() {
 
 	// This is needed for testing on Kubernetes if we want to run 'make test-XXX'
 	// Many of the other packages do not accept the 'url' flag
-	if cliAISURL := os.Getenv(cmn.EnvVars.Endpoint); cliAISURL != "" {
+	if cliAISURL := os.Getenv(env.AIS.Endpoint); cliAISURL != "" {
 		if !strings.HasPrefix(cliAISURL, "http") {
 			cliAISURL = "http://" + cliAISURL
 		}
@@ -132,10 +133,10 @@ func InitLocalCluster() {
 	}
 	fmt.Printf("Error: %s\n", strings.TrimSuffix(err.Error(), "\n"))
 	fmt.Println("Environment variables:")
-	fmt.Printf("\t%s:\t%s\n", cmn.EnvVars.Endpoint, os.Getenv(cmn.EnvVars.Endpoint))
-	fmt.Printf("\t%s:\t%s\n", cmn.EnvVars.PrimaryID, os.Getenv(cmn.EnvVars.PrimaryID))
-	fmt.Printf("\t%s:\t%s\n", cmn.EnvVars.SkipVerifyCrt, os.Getenv(cmn.EnvVars.SkipVerifyCrt))
-	fmt.Printf("\t%s:\t%s\n", cmn.EnvVars.UseHTTPS, os.Getenv(cmn.EnvVars.UseHTTPS))
+	fmt.Printf("\t%s:\t%s\n", env.AIS.Endpoint, os.Getenv(env.AIS.Endpoint))
+	fmt.Printf("\t%s:\t%s\n", env.AIS.PrimaryID, os.Getenv(env.AIS.PrimaryID))
+	fmt.Printf("\t%s:\t%s\n", env.AIS.SkipVerifyCrt, os.Getenv(env.AIS.SkipVerifyCrt))
+	fmt.Printf("\t%s:\t%s\n", env.AIS.UseHTTPS, os.Getenv(env.AIS.UseHTTPS))
 	if len(envVars) > 0 {
 		fmt.Println("Docker Environment:")
 		for k, v := range envVars {
diff --git a/devtools/tutils/node.go b/devtools/tutils/node.go
index 6cd23b9bc51..a6c3bf05448 100644
--- a/devtools/tutils/node.go
+++ b/devtools/tutils/node.go
@@ -1,6 +1,6 @@
 // Package tutils provides common low-level utilities for all aistore unit and integration tests
 /*
- * Copyright (c) 2018-2021, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.
  */
 package tutils
 
@@ -20,6 +20,7 @@ import (
 
 	"github.com/NVIDIA/aistore/api"
 	"github.com/NVIDIA/aistore/api/apc"
+	"github.com/NVIDIA/aistore/api/env"
 	"github.com/NVIDIA/aistore/cluster"
 	"github.com/NVIDIA/aistore/cmn"
 	"github.com/NVIDIA/aistore/cmn/cos"
@@ -397,9 +398,9 @@ func startNode(cmd string, args []string, asPrimary bool) (pid int, err error) {
 	}
 	if asPrimary {
 		// Sets the environment variable to start as primary proxy to true
-		env := os.Environ()
-		env = append(env, fmt.Sprintf("%s=true", cmn.EnvVars.IsPrimary))
-		ncmd.Env = env
+		environ := os.Environ()
+		environ = append(environ, fmt.Sprintf("%s=true", env.AIS.IsPrimary))
+		ncmd.Env = environ
 	}
 
 	if err = ncmd.Start(); err != nil {
diff --git a/docs/authn.md b/docs/authn.md
index a6f109e655c..aa91b3ad751 100644
--- a/docs/authn.md
+++ b/docs/authn.md
@@ -13,7 +13,7 @@ The following brief and commented sequence assumes that [AIS local playground](g
 
 Examples below use AuthN specific environment variables. Note that all of them are enumerated in
 
-* [`api/authn/env_const.go`](https://github.com/NVIDIA/aistore/blob/master/api/authn/env_const.go)
+* [`api/env/authn.go`](https://github.com/NVIDIA/aistore/blob/master/api/env/authn.go)
 
 ```console
 # 1. Login as administrator (and note that admin user and password can be only