diff --git a/README.md b/README.md
index 4740e58..5fd44fe 100644
--- a/README.md
+++ b/README.md
@@ -25,7 +25,7 @@ Available Commands:
   license          Download a license for the given order number at the given cadence name and version
 
 Flags:
-  -c, --config string      config file (default is $HOME/.viya4-orders-cli)
+  -c, --config string      config file (default is $XDG_CONFIG_HOME/viya4-orders-cli/config.yaml)
   -n, --file-name string   name of the file where you want the downloaded order asset to be stored
                            (defaults:
                                 assetHistory - assetHistory_<order number>.json
@@ -146,9 +146,9 @@ Take the following steps to start using SAS Viya Orders CLI:
 
 1. If you want to use a configuration file, create it.
 
-   The default location for the configuration file is `$HOME/.viya4-orders-cli` and the default format is [YAML](https://yaml.org/).
-   You can save the file anywhere you want and use any supported format, as long as you use the `--config` /
-   `-c` option to specify its path and name to the CLI.
+   The default location for the configuration file is `$XDG_CONFIG_HOME/viya4-orders-cli/config.yaml` and the default format is [YAML](https://yaml.org/).
+   You can save the file anywhere you want as long as you use the `--config` /
+   `-c` option to inform the CLI of any non-default location.
 
    When using the `-c` option to specify a config file, that file must have a valid extension denoting its format. Supported
    formats are [JSON](https://www.json.org/),
@@ -196,7 +196,7 @@ You have the following options for launching SAS Viya Orders CLI:
 The examples in this section correspond to typical tasks that you might perform
 using SAS Viya Orders CLI:
 
-- Using a configuration file, `/c/Users/auser/vocli/.viya4-orders-cli.yaml`, to
+- Using a configuration file, `/c/Users/auser/vocli/.config/viya4-orders-cli/config.yaml`, to
   convey your API credentials, get deployment assets for SAS Viya order `923456`
   at the latest version of the Long Term Support (`lts`) cadence. Send the
   contents to file `/c/Users/auser/vocli/sasfiles/923456_lts_depassets.tgz`:
@@ -204,13 +204,13 @@ using SAS Viya Orders CLI:
 
   ```docker
   docker run -v /c/Users/auser/vocli:/sasstuff viya4-orders-cli deploymentAssets 923456 lts \
-   --config /sasstuff/.viya4-orders-cli.yaml --file-path /sasstuff/sasfiles --file-name 923456_lts_depassets
+   --config /sasstuff/.config/viya4-orders-cli/config.yaml --file-path /sasstuff/sasfiles --file-name 923456_lts_depassets
   ```
 
   Sample output:
 
   ```text
-  2020/10/02 19:16:30 Using config file: /sasstuff/.viya4-orders-cli.yaml
+  2020/10/02 19:16:30 Using config file: /sasstuff/.config/viya4-orders-cli/config.yaml
   OrderNumber: 923456
   AssetName: deploymentAssets
   AssetReqURL: https://api.sas.com/mysas/orders/923456/cadenceNames/lts/deploymentAssets
diff --git a/cmd/root.go b/cmd/root.go
index f8870da..9b0816a 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -8,7 +8,6 @@ import (
 	"log"
 	"os"
 
-	homedir "github.com/mitchellh/go-homedir"
 	"github.com/sassoftware/viya4-orders-cli/lib/authn"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
@@ -48,7 +47,7 @@ func init() {
 
 	// Define global flags / options and set their default values.
 	rootCmd.PersistentFlags().StringVarP(&cfgFile, "config", "c", "",
-		"config file (default is $HOME/.viya4-orders-cli)")
+		"config file (default is $XDG_CONFIG_HOME/viya4-orders-cli/config.yaml)")
 	rootCmd.PersistentFlags().StringVarP(&assetFileName, "file-name", "n", "",
 		"name of the file where you want the downloaded order asset to be stored\n"+
 			"(defaults:\n\tassetHistory - assetHistory_<order number>.json\n\tcerts - SASViyaV4_<order number>_certs.zip\n\tlicense and depassets - SASViyaV4_<order number>_<renewal sequence>_<cadence information>_<asset name>_<date time stamp>."+
@@ -74,16 +73,9 @@ func initConfig() {
 		// Use config file from the flag.
 		viper.SetConfigFile(cfgFile)
 	} else {
-		// Find home directory.
-		home, err := homedir.Dir()
-		if err != nil {
-			log.Fatalln("ERROR: homedir.Dir() returned: " + err.Error())
-		}
-
-		// Search config in home directory with name ".viya4-orders-cli" (without extension).
-		viper.AddConfigPath(home)
-		viper.SetConfigName(".viya4-orders-cli")
-		// If they provide a config file with no extension if must be in yaml format.
+		viper.AddConfigPath("$XDG_CONFIG_HOME/viya4-orders-cli")
+		viper.AddConfigPath("$HOME/.config/viya4-orders-cli")
+		viper.SetConfigName("config")
 		viper.SetConfigType("yaml")
 	}
 
diff --git a/go.mod b/go.mod
index 9fc71bd..0354b7c 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,6 @@ module github.com/sassoftware/viya4-orders-cli
 go 1.22
 
 require (
-	github.com/mitchellh/go-homedir v1.1.0
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/viper v1.19.0
 	golang.org/x/oauth2 v0.26.0
diff --git a/go.sum b/go.sum
index b687b77..0e1433c 100644
--- a/go.sum
+++ b/go.sum
@@ -23,8 +23,6 @@ github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0V
 github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/magiconair/properties v1.8.9 h1:nWcCbLq1N2v/cpNsy5WvQ37Fb+YElfq20WJ/a8RkpQM=
 github.com/magiconair/properties v1.8.9/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
-github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
-github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/pelletier/go-toml/v2 v2.2.2 h1:aYUidT7k73Pcl9nb2gScu7NSrKCSHIDE89b3+6Wq+LM=
diff --git a/lib/authn/authn.go b/lib/authn/authn.go
index a35c405..6345b6f 100644
--- a/lib/authn/authn.go
+++ b/lib/authn/authn.go
@@ -7,10 +7,10 @@ package authn
 
 import (
 	"context"
-	"encoding/base64"
 	"errors"
 	"fmt"
 	"net/url"
+	"os"
 	"strings"
 
 	"github.com/spf13/viper"
@@ -26,15 +26,20 @@ const (
 
 // GetBearerToken calls the /token SAS Viya Orders API endpoint to exchange client credentials for a Bearer token.
 // The client credentials are obtained from the SAS API Portal (https://apiportal.sas.com), and should be defined in
-// Viper (https://github.com/spf13/viper) as clientCredentialsId (key) and clientCredentialsSecret (secret).
+// Viper (https://github.com/spf13/viper) as clientCredentialsIdFile (key file) and clientCredentialsSecretFile (secret file).
 func GetBearerToken() (token string, err error) {
-	id, err := base64.StdEncoding.DecodeString(viper.GetString("clientCredentialsId"))
+	idFile := viper.GetString("clientCredentialsIdFile")
+	secFile := viper.GetString("clientCredentialsSecretFile")
+
+	// read id and sec from the files
+	id, err := os.ReadFile(idFile)
 	if err != nil {
-		return token, errors.New("ERROR: attempt to decode clientCredentialsId failed: " + err.Error())
+		return token, errors.New("ERROR: attempt to read client credentials ID file failed: " + err.Error())
 	}
-	sec, err := base64.StdEncoding.DecodeString(viper.GetString("clientCredentialsSecret"))
+
+	sec, err := os.ReadFile(secFile)
 	if err != nil {
-		return token, errors.New("ERROR: attempt to decode clientCredentialsSecret failed: " + err.Error())
+		return token, errors.New("ERROR: attempt to read client credentials secret file failed: " + err.Error())
 	}
 
 	// Build the request URL.