diff --git a/lib/storage/home.rs b/lib/storage/home.rs
index 4bc1572..f3e26ec 100644
--- a/lib/storage/home.rs
+++ b/lib/storage/home.rs
@@ -2,7 +2,9 @@ use std::env::var;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
 
+use crate::manifests::AuthManifest;
 use crate::result::{RokitError, RokitResult};
+use crate::sources::ArtifactSource;
 
 use super::{ToolCache, ToolStorage};
 
@@ -86,6 +88,22 @@ impl Home {
         &self.tool_cache
     }
 
+    /**
+        Creates a new `ArtifactSource` for this `Home`.
+
+        This will load any stored authentication from disk and use
+        it to authenticate with the artifact source and various providers.
+
+        # Errors
+
+        - If the auth manifest could not be loaded or created.
+        - If the artifact source could not be created.
+    */
+    pub async fn artifact_source(&self) -> RokitResult<ArtifactSource> {
+        let auth = AuthManifest::load_or_create(&self.path).await?;
+        ArtifactSource::new_authenticated(&auth.get_all_tokens())
+    }
+
     /**
         Saves the contents of this `Home` to disk.
 
diff --git a/src/cli/add.rs b/src/cli/add.rs
index 546a0b0..6af0117 100644
--- a/src/cli/add.rs
+++ b/src/cli/add.rs
@@ -4,8 +4,8 @@ use console::style;
 
 use rokit::{
     discovery::discover_all_manifests,
-    manifests::{AuthManifest, RokitManifest},
-    sources::{Artifact, ArtifactProvider, ArtifactSource},
+    manifests::RokitManifest,
+    sources::{Artifact, ArtifactProvider},
     storage::Home,
     tool::{ToolAlias, ToolId},
 };
@@ -40,6 +40,7 @@ impl AddSubcommand {
 
         let tool_cache = home.tool_cache();
         let tool_storage = home.tool_storage();
+        let source = home.artifact_source().await?;
 
         // 1. Check for trust, or prompt the user to trust the tool
         if !tool_cache.is_trusted(&id) {
@@ -49,10 +50,8 @@ impl AddSubcommand {
             let _ = tool_cache.add_trust(id.clone());
         }
 
-        // 2. Load tool source, manifest, and do a preflight check
-        // to make sure we don't overwrite any existing tool(s)
-        let auth = AuthManifest::load(home.path()).await?;
-        let source = ArtifactSource::new_authenticated(&auth.get_all_tokens())?;
+        // 2. Load manifest and do a preflight check to
+        // ensure we don't overwrite any existing tool(s)
         let manifest_path = if self.global {
             home.path().to_path_buf()
         } else {
diff --git a/src/cli/install.rs b/src/cli/install.rs
index 8b2e763..eddf3be 100644
--- a/src/cli/install.rs
+++ b/src/cli/install.rs
@@ -7,8 +7,7 @@ use console::style;
 use futures::{stream::FuturesUnordered, TryStreamExt};
 use rokit::{
     discovery::discover_all_manifests,
-    manifests::AuthManifest,
-    sources::{Artifact, ArtifactProvider, ArtifactSource},
+    sources::{Artifact, ArtifactProvider},
     storage::Home,
 };
 
@@ -30,8 +29,7 @@ impl InstallSubcommand {
     pub async fn run(self, home: &Home) -> Result<()> {
         let force = self.force;
 
-        let auth = AuthManifest::load(home.path()).await?;
-        let source = ArtifactSource::new_authenticated(&auth.get_all_tokens())?;
+        let source = home.artifact_source().await?;
         let manifests = discover_all_manifests(false, false).await;
 
         let tool_cache = home.tool_cache();
diff --git a/src/cli/self_update.rs b/src/cli/self_update.rs
index 33eee09..360f171 100644
--- a/src/cli/self_update.rs
+++ b/src/cli/self_update.rs
@@ -3,8 +3,7 @@ use clap::Parser;
 
 use console::style;
 use rokit::{
-    manifests::AuthManifest,
-    sources::{Artifact, ArtifactProvider, ArtifactSource},
+    sources::{Artifact, ArtifactProvider},
     storage::Home,
     tool::ToolId,
 };
@@ -34,11 +33,7 @@ impl SelfUpdateSubcommand {
         };
 
         let pb = new_progress_bar("Loading", 4, 1);
-
-        // NOTE: Auth is not really necessary here since we know Rokit is not
-        // a private repository, but it may still help against rate limiting.
-        let auth = AuthManifest::load(home.path()).await?;
-        let source = ArtifactSource::new_authenticated(&auth.get_all_tokens())?;
+        let source = home.artifact_source().await?;
 
         pb.inc(1);
         pb.set_message("Fetching");
diff --git a/src/cli/update.rs b/src/cli/update.rs
index d514a0f..813af2d 100644
--- a/src/cli/update.rs
+++ b/src/cli/update.rs
@@ -5,8 +5,8 @@ use console::style;
 use futures::{stream::FuturesUnordered, TryStreamExt};
 use rokit::{
     discovery::discover_all_manifests,
-    manifests::{AuthManifest, RokitManifest},
-    sources::{Artifact, ArtifactProvider, ArtifactSource},
+    manifests::RokitManifest,
+    sources::{Artifact, ArtifactProvider},
     storage::Home,
 };
 
@@ -26,8 +26,7 @@ pub struct UpdateSubcommand {
 impl UpdateSubcommand {
     pub async fn run(self, home: &Home) -> Result<()> {
         // 1. Load tool source and the desired manifest
-        let auth = AuthManifest::load(home.path()).await?;
-        let source = ArtifactSource::new_authenticated(&auth.get_all_tokens())?;
+        let source = home.artifact_source().await?;
         let manifest_path = if self.global {
             home.path().to_path_buf()
         } else {