diff --git a/sbotc.1 b/sbotc.1
index af287e9..63133ab 100644
--- a/sbotc.1
+++ b/sbotc.1
@@ -8,6 +8,7 @@
 .Sh SYNOPSIS
 .Nm
 .Op Fl j
+.Op Fl a Ar cap
 .Op Fl s Ar host
 .Op Fl p Ar port
 .Op Fl k Ar key
@@ -21,6 +22,9 @@ standard I/O.
 .Bl -tag
 .It Fl j
 Send stdin data as JSON.
+.It Fl c Ar cap
+Capability key for secret-handshake. Default is SSB's capability key,
+.Li 1KHLiKZvAvjbY1ziZEHMXawbCEIM6qwjCDm3VYRan/s= .
 .It Fl s Ar host
 The hostname to connect to. Default is localhost.
 .It Fl p Ar port
@@ -62,11 +66,12 @@ secret-handshake protocol.
 .It Pa ~/.ssb/manifest.json
 A map of method names to method types.
 .It Pa ~/.ssb/config
-JSON file containing host and port to use if the
-.Ar -s
-or
+JSON file containing host, port, and SHS cap key to use if the
+.Ar -s ,
 .Ar -p
-options are not given.
+or
+.Ar -c
+options are not given, respectively.
 .El
 .Pp
 The base path
diff --git a/sbotc.c b/sbotc.c
index 48b1333..57bd097 100644
--- a/sbotc.c
+++ b/sbotc.c
@@ -95,7 +95,7 @@ static const unsigned char ssb_cap[] = {
 };
 
 static void usage() {
-	fputs("usage: sbotc [-j] [-s <host>] [-p <port>] [-k <key>] [-t <type>] "
+	fputs("usage: sbotc [-j] [-a <cap>] [-s <host>] [-p <port>] [-k <key>] [-t <type>] "
 	      "<method> [<argument>...]\n", stderr);
 	exit(EXIT_FAILURE);
 }
@@ -759,10 +759,12 @@ int main(int argc, char *argv[]) {
 	const char *host = NULL;
 	const char *port = "8008";
 	const char *typestr = NULL, *methodstr;
+	const char *shs_cap_key_str = NULL;
 	size_t argument_len;
 	unsigned char private_key[64];
 	unsigned char public_key[32];
 	unsigned char remote_key[32];
+	unsigned char shs_cap_key[32];
 	enum muxrpc_type type;
 	enum pkt_type ptype = pkt_type_buffer;
 	char method[256];
@@ -776,14 +778,17 @@ int main(int argc, char *argv[]) {
 	if (len > 0) {
 		ssize_t host_len = json_get_value(config_buf, "host", &host);
 		ssize_t port_len = json_get_value(config_buf, "port", &port);
+		ssize_t shs_cap_len = json_get_value(config_buf, "caps.shs", &shs_cap_key_str);
 		if (host_len >= 0) ((char *)host)[host_len] = '\0';
 		if (port_len >= 0) ((char *)port)[port_len] = '\0';
+		if (shs_cap_len >= 0) ((char *)shs_cap_key_str)[shs_cap_len] = '\0';
 	} else if (len < 0 && errno != ENOENT) {
 		 err(1, "failed to read config");
 	}
 
 	for (i = 1; i < argc && (argv[i][0] == '-'); i++) {
 		switch (argv[i][1]) {
+			case 'c': shs_cap_key_str = argv[++i]; break;
 			case 'j': ptype = pkt_type_json; break;
 			case 's': host = argv[++i]; break;
 			case 'k': key = argv[++i]; break;
@@ -794,6 +799,14 @@ int main(int argc, char *argv[]) {
 	}
 	if (i < argc) methodstr = argv[i++]; else usage();
 
+	if (shs_cap_key_str) {
+		rc = pubkey_decode(shs_cap_key_str, shs_cap_key);
+		if (rc < 0) err(1, "unable to decode cap key '%s'", shs_cap_key_str);
+	} else {
+		memcpy(shs_cap_key, ssb_cap, 32);
+	}
+
+
 	argument_len = args_to_json_length(argc-i, argv+i);
 	char argument[argument_len];
 	rc = args_to_json(argument, sizeof(argument), argc-i, argv+i);
@@ -835,7 +848,7 @@ int main(int argc, char *argv[]) {
 	if (s < 0) err(1, "tcp_connect");
 
 	struct boxs bs;
-	shs_connect(s, public_key, private_key, ssb_cap, remote_key, &bs);
+	shs_connect(s, public_key, private_key, shs_cap_key, remote_key, &bs);
 
 	muxrpc_call(&bs, method, argument, type, typestr, 1);