diff --git a/internal/binaries/tls-keygen/storage/remote.go b/internal/binaries/tls-keygen/storage/remote.go
index 0d721e6..d3b9048 100644
--- a/internal/binaries/tls-keygen/storage/remote.go
+++ b/internal/binaries/tls-keygen/storage/remote.go
@@ -78,6 +78,7 @@ func (r *RemoteStorage) Load(domain string) (ChainPEM, Metadata, error) {
 		return nil, Metadata{}, err
 	}
 	req.Header.Set(instanceHeader, token)
+	req.Header.Set("x-client-id", "tls-keygen")
 
 	resp, err := r.httpClient().Do(req)
 	if err != nil {
@@ -150,6 +151,7 @@ func (r *RemoteStorage) Store(domain string, chain ChainPEM) error {
 	}
 	req.Header.Set(instanceHeader, token)
 	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("x-client-id", "tls-keygen")
 
 	resp, err := r.httpClient().Do(req)
 	if err != nil {
diff --git a/pkg/commands/app/info.go b/pkg/commands/app/info.go
index d14863f..bc32a26 100644
--- a/pkg/commands/app/info.go
+++ b/pkg/commands/app/info.go
@@ -102,7 +102,7 @@ func listAction(cCtx *cli.Context) error {
 
 	userApiClient, err := utils.NewUserApiClient(cCtx)
 	if err != nil {
-		return fmt.Errorf("failed to get KMS client: %w", err)
+		return fmt.Errorf("failed to get userApi client: %w", err)
 	}
 
 	// Get environment config for context
diff --git a/pkg/commands/utils/userapi_client.go b/pkg/commands/utils/userapi_client.go
index 492ac5b..0356ced 100644
--- a/pkg/commands/utils/userapi_client.go
+++ b/pkg/commands/utils/userapi_client.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/Layr-Labs/eigenx-cli/internal/version"
 	"github.com/Layr-Labs/eigenx-cli/pkg/common"
 	kmscrypto "github.com/Layr-Labs/eigenx-kms/pkg/crypto"
 	kmstypes "github.com/Layr-Labs/eigenx-kms/pkg/types"
@@ -326,6 +327,10 @@ func (cc *UserApiClient) makeAuthenticatedRequest(cCtx *cli.Context, method, url
 		return nil, fmt.Errorf("failed to create request: %w", err)
 	}
 
+	// Add x-client-id header to identify the CLI client
+	clientID := fmt.Sprintf("eigenx-cli/%s", version.GetVersion())
+	req.Header.Set("x-client-id", clientID)
+
 	// Add auth headers if permission is specified
 	if permission != nil {
 		expiry := big.NewInt(time.Now().Add(5 * time.Minute).Unix())
diff --git a/tools/tls-keygen-linux-amd64 b/tools/tls-keygen-linux-amd64
index 164901d..ad7ba66 100755
Binary files a/tools/tls-keygen-linux-amd64 and b/tools/tls-keygen-linux-amd64 differ