diff --git a/README.md b/README.md
index 95ace40..3b867fd 100644
--- a/README.md
+++ b/README.md
@@ -338,11 +338,13 @@ $ curl  -H "Content-Type: application/json" -sS http://localhost:5000/instances/
 
 Currently, there are no API docs nor params validations. For each command `src/d2_docker/commands/COMMAND.py`, check function `setup` to see the supported parameters.
 
-The API server provides a proxy to Harbor to bypass CORS issues. Configure first the harbor authentication file (`.flaskenv.secret`):
+The API server provides a proxy to Harbor to bypass CORS issues. Configure first the harbor authentication file:
 
 ```
-$ cp .flaskenv.secret.template .flaskenv.secret
-$ # edit .flaskenv.secret and restart flask server
+$ cp flaskenv.secret.template flaskenv.secret
+$ # Edit flaskenv.secret
+$ mkdir -p ~/.config/d2-docker/
+$ cp flaskenv.secret ~/.config/d2-docker/
 
 $ curl -sS 'http://localhost:5000/harbor/https://docker.eyeseetea.com/api/v2.0/quotas/1' | jq
 ```
diff --git a/.flaskenv.secret.template b/flaskenv.secret.template
similarity index 100%
rename from .flaskenv.secret.template
rename to flaskenv.secret.template
diff --git a/src/d2_docker/api/api_utils.py b/src/d2_docker/api/api_utils.py
index 2c57efd..7f49436 100644
--- a/src/d2_docker/api/api_utils.py
+++ b/src/d2_docker/api/api_utils.py
@@ -42,9 +42,27 @@ def server_error(message, status=500):
     return (body, status)
 
 
+def get_from_dotenv(name, directories):
+    output = {}
+    for directory in directories:
+        path1 = os.path.join(directory, name)
+        path2 = os.path.expanduser(path1)
+        value = dotenv_values(path2, verbose=True)
+        output.update(value)
+    return output
+
+
+config = None
+
+
 def get_config():
-    return {
-        **dotenv_values(".flaskenv"),
-        **dotenv_values(".flaskenv.secret"),
+    global config
+    if config:
+        return config
+
+    directories = ["~/.config/d2-docker"]
+    config = {
+        **get_from_dotenv("flaskenv.secret", directories),
         **os.environ,
     }
+    return config
diff --git a/src/d2_docker/api/main.py b/src/d2_docker/api/main.py
index 2b555f0..6792339 100644
--- a/src/d2_docker/api/main.py
+++ b/src/d2_docker/api/main.py
@@ -5,7 +5,7 @@
 from flask import Response, stream_with_context
 from flask_cors import CORS
 
-from werkzeug.exceptions import HTTPException
+from werkzeug.exceptions import HTTPException, BadRequest
 
 from d2_docker import utils
 from d2_docker.commands import version, list_, start, stop, logs, commit, push, pull
@@ -89,25 +89,34 @@ def rm_instance():
     return success()
 
 
+def get_request_json(request):
+    try:
+        return request.json
+    except BadRequest:
+        return None
+
+
 def proxy_request_to_url(request, url, new_headers=None):
     base_headers = utils.dict_remove(dict(request.headers), "Host")
     headers = utils.dict_merge(base_headers, new_headers or {})
     method = request.method.lower()
     http_request = getattr(requests, method)
+    request_json = get_request_json(request)
 
-    if request.json:
-        forward_request = http_request(url, json=request.json, headers=headers)
+    if request_json:
+        forward_request = http_request(url, json=request_json, headers=headers)
     elif request.form:
         forward_request = http_request(url, data=request.form.to_dict(), headers=headers)
     else:
         forward_request = http_request(url, headers=headers)
 
     response = stream_with_context(forward_request.iter_content())
-    return Response(response, content_type=request.content_type)
+    return Response(response, content_type=forward_request.headers.get("Content-Type"))
 
 
 @api.route("/harbor/<path:url>", methods=["GET", "POST", "PUT", "DELETE"])
 def proxy(url):
+    config = get_config()
     user = config.get("HARBOR_USER")
     password = config.get("HARBOR_PASSWORD")
     if not user or not password:
@@ -129,12 +138,6 @@ def internal_error(error):
     return server_error(contents, status=status)
 
 
-config = get_config()
-
-
 def run(args):
-    api.run(host=args.host or "0.0.0.0", port=args.port or 5000)
-
-
-if __name__ == "__main__":
-    run()
+    get_config()
+    api.run(host=args.host or "127.0.0.1", port=args.port or 5000)
diff --git a/src/d2_docker/commands/api.py b/src/d2_docker/commands/api.py
index 33eef81..2187603 100644
--- a/src/d2_docker/commands/api.py
+++ b/src/d2_docker/commands/api.py
@@ -6,12 +6,11 @@
 def setup(parser):
     subparsers = parser.add_subparsers(dest="api_command")
     start_parser = subparsers.add_parser("start")
-    start_parser.add_argument("--host", type=int, help="Listen host")
+    start_parser.add_argument("--host", type=str, help="Listen host")
     start_parser.add_argument("-p", "--port", type=int, help="Listen port")
 
 
 def run(args):
-    print(args)
     if args.api_command == "start":
         main.run(args)
     elif args.api_command == "stop":
diff --git a/src/d2_docker/config/dhis2-core-start.sh b/src/d2_docker/config/dhis2-core-start.sh
index 8489e65..c054579 100755
--- a/src/d2_docker/config/dhis2-core-start.sh
+++ b/src/d2_docker/config/dhis2-core-start.sh
@@ -96,7 +96,6 @@ copy_datavalues() {
     fi
 }
 
-
 copy_non_empty_files() {
     local from=$1 to=$2
     find "$from" -maxdepth 1 -type f -size +0 -exec cp -v {} "$to" \;