diff --git a/cmd/zrok/access_private.go b/cmd/zrok/access_private.go
index c9494ac1..345d5c10 100644
--- a/cmd/zrok/access_private.go
+++ b/cmd/zrok/access_private.go
@@ -1,8 +1,18 @@
 package main
 
 import (
+	"github.com/go-openapi/runtime"
+	httptransport "github.com/go-openapi/runtime/client"
+	"github.com/openziti-test-kitchen/zrok/endpoints/private_frontend"
+	"github.com/openziti-test-kitchen/zrok/rest_client_zrok"
+	"github.com/openziti-test-kitchen/zrok/rest_client_zrok/service"
+	"github.com/openziti-test-kitchen/zrok/rest_model_zrok"
 	"github.com/openziti-test-kitchen/zrok/zrokdir"
+	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	"os"
+	"os/signal"
+	"syscall"
 )
 
 type accessPrivateCommand struct {
@@ -21,6 +31,8 @@ func newAccessPrivateCommand() *accessPrivateCommand {
 }
 
 func (cmd *accessPrivateCommand) run(_ *cobra.Command, args []string) {
+	svcName := args[0]
+
 	env, err := zrokdir.LoadEnvironment()
 	if err != nil {
 		if !panicInstead {
@@ -28,16 +40,6 @@ func (cmd *accessPrivateCommand) run(_ *cobra.Command, args []string) {
 		}
 		panic(err)
 	}
-	zif, err := zrokdir.ZitiIdentityFile("backend")
-	if err != nil {
-		if !panicInstead {
-			showError("unable to load ziti identity configuration", err)
-		}
-		panic(err)
-	}
-	if zif == "" {
-		panic("never")
-	}
 	zrok, err := zrokdir.ZrokClient(env.ApiEndpoint)
 	if err != nil {
 		if !panicInstead {
@@ -45,7 +47,55 @@ func (cmd *accessPrivateCommand) run(_ *cobra.Command, args []string) {
 		}
 		panic(err)
 	}
-	if zrok == nil {
-		panic("never")
+
+	auth := httptransport.APIKeyAuth("X-TOKEN", "header", env.Token)
+	req := service.NewAccessParams()
+	req.Body = &rest_model_zrok.AccessRequest{
+		SvcName: svcName,
+		ZID:     env.ZId,
+	}
+	_, err = zrok.Service.Access(req, auth)
+	if err != nil {
+		if !panicInstead {
+			showError("unable to access", err)
+		}
+		panic(err)
+	}
+
+	cfg := private_frontend.DefaultConfig("backend")
+
+	c := make(chan os.Signal)
+	signal.Notify(c, os.Interrupt, syscall.SIGTERM)
+	go func() {
+		<-c
+		cmd.destroy(env.ZId, svcName, zrok, auth)
+		os.Exit(0)
+	}()
+
+	frontend, err := private_frontend.NewHTTP(cfg)
+	if err != nil {
+		if !panicInstead {
+			showError("unable to create private frontend", err)
+		}
+		panic(err)
+	}
+	if err := frontend.Run(); err != nil {
+		if !panicInstead {
+			showError("unable to run frontend", err)
+		}
+	}
+}
+
+func (cmd *accessPrivateCommand) destroy(envZId, svcName string, zrok *rest_client_zrok.Zrok, auth runtime.ClientAuthInfoWriter) {
+	logrus.Debugf("shutting down '%v'", svcName)
+	req := service.NewUnaccessParams()
+	req.Body = &rest_model_zrok.UnaccessRequest{
+		SvcName: svcName,
+		ZID:     envZId,
+	}
+	if _, err := zrok.Service.Unaccess(req, auth); err == nil {
+		logrus.Debugf("shutdown complete")
+	} else {
+		logrus.Errorf("error shutting down: %v", err)
 	}
 }
diff --git a/cmd/zrok/http_frontend.go b/cmd/zrok/http_frontend.go
index 51691fe2..23dccd1e 100644
--- a/cmd/zrok/http_frontend.go
+++ b/cmd/zrok/http_frontend.go
@@ -39,14 +39,14 @@ func (self *httpFrontendCommand) run(_ *cobra.Command, args []string) {
 		}
 	}
 	logrus.Infof(cf.Dump(cfg, cf.DefaultOptions()))
-	httpListener, err := public_frontend.NewHTTP(cfg)
+	frontend, err := public_frontend.NewHTTP(cfg)
 	if err != nil {
 		if !panicInstead {
 			showError("unable to create http frontend", err)
 		}
 		panic(err)
 	}
-	if err := httpListener.Run(); err != nil {
+	if err := frontend.Run(); err != nil {
 		if !panicInstead {
 			showError("unable to run http frontend", err)
 		}
diff --git a/cmd/zrok/share_private.go b/cmd/zrok/share_private.go
index 9b934f14..7c2f95b1 100644
--- a/cmd/zrok/share_private.go
+++ b/cmd/zrok/share_private.go
@@ -106,7 +106,7 @@ func (cmd *sharePrivateCommand) run(_ *cobra.Command, args []string) {
 	if err != nil {
 		ui.Close()
 		if !panicInstead {
-			showError("unable to create tunnel", err)
+			showError("unable to create share", err)
 		}
 		panic(err)
 	}
diff --git a/endpoints/private_frontend/http.go b/endpoints/private_frontend/http.go
index 9b8ec33c..ddd47175 100644
--- a/endpoints/private_frontend/http.go
+++ b/endpoints/private_frontend/http.go
@@ -54,6 +54,10 @@ func NewHTTP(cfg *Config) (*httpFrontend, error) {
 	}, nil
 }
 
+func (h *httpFrontend) Run() error {
+	return http.ListenAndServe(h.cfg.Address, h.handler)
+}
+
 type zitiDialContext struct {
 	ctx     ziti.Context
 	svcName string