diff --git a/internal/commands/auth_add.go b/internal/commands/auth_add.go
index 4218bfd24..9431a843f 100644
--- a/internal/commands/auth_add.go
+++ b/internal/commands/auth_add.go
@@ -19,10 +19,6 @@ var AuthAddFlags = []cli.Flag{
 		Name:  "name, n",
 		Usage: "arbitrary name to help identify the access `TOKEN`",
 	},
-	cli.StringFlag{
-		Name:  "user, u",
-		Usage: "`USERNAME` of the account the access token belongs to (leave empty for none)",
-	},
 	cli.StringFlag{
 		Name:  "scope, s",
 		Usage: "authorization `SCOPE` for the access token e.g. \"metrics\" or \"photos albums\" (\"*\" to allow all scopes)",
@@ -36,17 +32,19 @@ var AuthAddFlags = []cli.Flag{
 
 // AuthAddCommand configures the command name, flags, and action.
 var AuthAddCommand = cli.Command{
-	Name:   "add",
-	Usage:  "Creates a new client access token",
-	Flags:  AuthAddFlags,
-	Action: authAddAction,
+	Name:        "add",
+	Usage:       "Creates a new client access token",
+	Description: "Specifying a username as argument creates a personal access token for a registered user account.",
+	ArgsUsage:   "[username]",
+	Flags:       AuthAddFlags,
+	Action:      authAddAction,
 }
 
 // authAddAction shows detailed session information.
 func authAddAction(ctx *cli.Context) error {
 	return CallWithDependencies(ctx, func(conf *config.Config) error {
 		// Get username from command flag.
-		userName := ctx.String("user")
+		userName := clean.Username(ctx.Args().First())
 
 		// Find user account.
 		user := entity.FindUserByName(userName)
diff --git a/internal/commands/clients.go b/internal/commands/clients.go
index 4ac582c25..b9d82a343 100644
--- a/internal/commands/clients.go
+++ b/internal/commands/clients.go
@@ -9,7 +9,6 @@ import (
 // Usage hints for the client management subcommands.
 const (
 	ClientNameUsage        = "arbitrary name to help identify the `CLIENT` application"
-	ClientUserName         = "`USERNAME` of the account the client application belongs to (leave empty for none)"
 	ClientAuthScope        = "authorization `SCOPE` of the client e.g. \"metrics\" or \"photos albums\" (\"*\" to allow all scopes)"
 	ClientAuthMethod       = "supported authentication `METHOD` for the client application"
 	ClientAuthExpires      = "access token lifetime in `SECONDS`, after which a new token must be created by the client (-1 to disable)"
@@ -40,10 +39,6 @@ var ClientAddFlags = []cli.Flag{
 		Name:  "name, n",
 		Usage: ClientNameUsage,
 	},
-	cli.StringFlag{
-		Name:  "user, u",
-		Usage: ClientUserName,
-	},
 	cli.StringFlag{
 		Name:  "scope, s",
 		Usage: ClientAuthScope,
diff --git a/internal/commands/clients_add.go b/internal/commands/clients_add.go
index 94fa5a9a1..8d813ae8f 100644
--- a/internal/commands/clients_add.go
+++ b/internal/commands/clients_add.go
@@ -18,10 +18,12 @@ import (
 
 // ClientsAddCommand configures the command name, flags, and action.
 var ClientsAddCommand = cli.Command{
-	Name:   "add",
-	Usage:  "Registers a new client application",
-	Flags:  ClientAddFlags,
-	Action: clientsAddAction,
+	Name:        "add",
+	Usage:       "Registers a new client application",
+	Description: "Specifying a username as argument will assign the client application to a registered user account.",
+	ArgsUsage:   "[username]",
+	Flags:       ClientAddFlags,
+	Action:      clientsAddAction,
 }
 
 // clientsAddAction registers a new client application.
diff --git a/internal/form/client.go b/internal/form/client.go
index c4f945505..7133d10d0 100644
--- a/internal/form/client.go
+++ b/internal/form/client.go
@@ -46,7 +46,7 @@ func NewClientFromCli(ctx *cli.Context) Client {
 		f.AuthScope = "webdav"
 	}
 
-	if user := ctx.String("user"); rnd.IsUID(user, 'u') {
+	if user := clean.Username(ctx.Args().First()); rnd.IsUID(user, 'u') {
 		f.UserUID = user
 	} else if user != "" {
 		f.UserName = user