diff --git a/import-export-cli/credentials/credentials.go b/import-export-cli/credentials/credentials.go
index 2306d0abf..43bba8297 100644
--- a/import-export-cli/credentials/credentials.go
+++ b/import-export-cli/credentials/credentials.go
@@ -55,10 +55,17 @@ type Credentials struct {
 	CredStore string `json:"credStore,omitempty"`
 }
 
+// DefaultAppKey stores consumer key/secret for the default CLI app
+type DefaultAppKey struct {
+	ConsumerKey    string `json:"consumerKey"`
+	ConsumerSecret string `json:"consumerSecret"`
+}
+
 // Environment containing credentials of apim and mi
 type Environment struct {
-	APIM Credential   `json:"apim"`
-	MI   MiCredential `json:"mi"`
+	APIM       Credential    `json:"apim"`
+	MI         MiCredential  `json:"mi"`
+	DefaultApp *DefaultAppKey `json:"defaultApp,omitempty"`
 }
 
 type MgAdapterEnv struct {
diff --git a/import-export-cli/credentials/jsonstore.go b/import-export-cli/credentials/jsonstore.go
index 6755256f6..de445e3f9 100644
--- a/import-export-cli/credentials/jsonstore.go
+++ b/import-export-cli/credentials/jsonstore.go
@@ -192,13 +192,46 @@ func (s *JsonStore) SetMGToken(env, accessToken string) error {
 	return nil
 }
 
+// GetDefaultAppKeys returns the consumer key and secret for the default CLI app in a given env
+func (s *JsonStore) GetDefaultAppKeys(env string) (string, string, error) {
+	if environment, ok := s.credentials.Environments[env]; ok {
+		if environment.DefaultApp != nil {
+			key, err := Base64Decode(environment.DefaultApp.ConsumerKey)
+			if err != nil {
+				return "", "", err
+			}
+			secret, err := Base64Decode(environment.DefaultApp.ConsumerSecret)
+			if err != nil {
+				return "", "", err
+			}
+			return key, secret, nil
+		}
+	}
+	return "", "", fmt.Errorf("default app keys not found for env %s", env)
+}
+
+// SetDefaultAppKeys stores the consumer key and secret for the default CLI app in a given env
+func (s *JsonStore) SetDefaultAppKeys(env, consumerKey, consumerSecret string) error {
+	environment := s.credentials.Environments[env]
+	environment.DefaultApp = &DefaultAppKey{
+		ConsumerKey:    Base64Encode(consumerKey),
+		ConsumerSecret: Base64Encode(consumerSecret),
+	}
+	s.credentials.Environments[env] = environment
+	if err := s.persist(); err != nil {
+		return err
+	}
+	fmt.Printf(PlainTextWarnMessage, s.Path)
+	return nil
+}
+
 // EraseAPIM remove apim credentials from the store
 func (s *JsonStore) EraseAPIM(env string) error {
 	environment, ok := s.credentials.Environments[env]
 	if !ok {
 		return fmt.Errorf("%s was not found", env)
 	}
-	if !miCredentialsExists(environment.MI) {
+	if !miCredentialsExists(environment.MI) && !defaultAppExists(environment.DefaultApp) {
 		// delete the environment
 		delete(s.credentials.Environments, env)
 	} else {
@@ -283,3 +316,7 @@ func apimCredentialsExists(apimCred Credential) bool {
 func mgTokenExists(mgwAdapterToken MgAdapterEnv) bool {
 	return mgwAdapterToken.AccessToken != ""
 }
+
+func defaultAppExists(app *DefaultAppKey) bool {
+	return app != nil && app.ConsumerKey != "" && app.ConsumerSecret != ""
+}
diff --git a/import-export-cli/credentials/store.go b/import-export-cli/credentials/store.go
index 3ad92f307..a899e35cb 100644
--- a/import-export-cli/credentials/store.go
+++ b/import-export-cli/credentials/store.go
@@ -43,6 +43,10 @@ type Store interface {
 	EraseMI(env string) error
 	// Erase mg token in a given microgateway Adapter env
 	EraseMG(env string) error
+	// GetDefaultAppKeys returns consumer key and secret for the default CLI app in a given env
+	GetDefaultAppKeys(env string) (string, string, error)
+	// SetDefaultAppKeys stores consumer key and secret for the default CLI app in a given env
+	SetDefaultAppKeys(env, consumerKey, consumerSecret string) error
 	// Load store
 	Load() error
 }
diff --git a/import-export-cli/impl/getKeys.go b/import-export-cli/impl/getKeys.go
index db29fa514..9dec1073f 100644
--- a/import-export-cli/impl/getKeys.go
+++ b/import-export-cli/impl/getKeys.go
@@ -103,8 +103,16 @@ func GetKeys(cred credentials.Credential, envName, name, version, provider, toke
 
 			//if keys have been already generated before, then update the consumer key and secret
 			if appKeys.Count != 0 {
+				// Use stored consumer key/secret
+				appKey := &appKeys.List[0]
+				if store, storeErr := credentials.GetDefaultCredentialStore(); storeErr == nil {
+					if storedKey, storedSecret, loadErr := store.GetDefaultAppKeys(keyGenEnv); loadErr == nil {
+						appKey.ConsumerKey = storedKey
+						appKey.ConsumerSecret = storedSecret
+					}
+				}
 				//If the keys have not been generated and the application is updated
-				token, err := getNewToken(&appKeys.List[0], scopes)
+				token, err := getNewToken(appKey, scopes)
 				//Assert token endpoint related fails and errors
 				if err != nil {
 					utils.HandleErrorAndExit("Error while generating token. ", err)
@@ -122,6 +130,9 @@ func GetKeys(cred credentials.Credential, envName, name, version, provider, toke
 				if keygenResponse == nil && err != nil {
 					utils.HandleErrorAndExit("Error occurred while generating CLI application keys.", err)
 				}
+				if store, storeErr := credentials.GetDefaultCredentialStore(); storeErr == nil {
+					store.SetDefaultAppKeys(keyGenEnv, keygenResponse.ConsumerKey, keygenResponse.ConsumerSecret)
+				}
 				// Access Token generated successfully.
 				fmt.Println(keygenResponse.Token.AccessToken)
 			}
@@ -155,6 +166,10 @@ func GetKeys(cred credentials.Credential, envName, name, version, provider, toke
 		if err != nil {
 			utils.HandleErrorAndExit("Error while generating CLI application keys", err)
 		}
+		// Save consumer key/secret so it can be reloaded as APIM masks it in GET responses
+		if store, storeErr := credentials.GetDefaultCredentialStore(); storeErr == nil {
+			store.SetDefaultAppKeys(keyGenEnv, keygenResponse.ConsumerKey, keygenResponse.ConsumerSecret)
+		}
 		appKey := &utils.ApplicationKey{}
 		appKey.ConsumerKey = keygenResponse.ConsumerKey
 		appKey.ConsumerSecret = keygenResponse.ConsumerSecret