diff --git a/gui/backend.go b/gui/backend.go
index a1dafe8c6e3a3debeabcb521866b5a81018bcfcd..7632bb4d132f73b2978f14a8b45dc4c8a96f162d 100644
--- a/gui/backend.go
+++ b/gui/backend.go
@@ -7,7 +7,6 @@ package main
 
 import (
 	"C"
-	"log"
 	"unsafe"
 
 	"0xacab.org/leap/bitmask-vpn/pkg/backend"
@@ -55,9 +54,7 @@ func SubscribeToEvent(event string, f unsafe.Pointer) {
 
 //export InitializeBitmaskContext
 func InitializeBitmaskContext(provider string, jsonPtr unsafe.Pointer, jsonLen C.int) {
-	log.Println("DEBUG: provider=", provider)
 	json := C.GoBytes(jsonPtr, jsonLen)
-	log.Println("DEBUG: json=", string(json))
 	opts := backend.InitOptsFromJSON(provider, string(json))
 	backend.InitializeBitmaskContext(opts)
 }
diff --git a/pkg/backend/api.go b/pkg/backend/api.go
index 59b386b4cf5dc2cbbfe1ac957830a308a16667ef..1985e6b01edb34c4dc60cc59b04b9a6f9bf5853f 100644
--- a/pkg/backend/api.go
+++ b/pkg/backend/api.go
@@ -63,35 +63,30 @@ func SubscribeToEvent(event string, f unsafe.Pointer) {
 }
 
 type Providers struct {
-	Default string `json:"default"`
-	Data    []InitOpts
+	Default string                 `json:"default"`
+	Data    []bitmask.ProviderOpts `json:"providers"`
 }
 
 type InitOpts struct {
-	Provider        string `json:"name"`
-	AppName         string `json:"applicationName"`
-	BinaryName      string `json:"binaryName"`
-	Auth            string `json:"auth"`
-	ProviderURL     string `json:"providerURL"`
-	TosURL          string `json:"tosURL"`
-	HelpURL         string `json:"helpURL"`
-	AskForDonations bool   `json:"askForDonations"`
+	ProviderOptions *bitmask.ProviderOpts
 	SkipLaunch      bool
 }
 
 func InitOptsFromJSON(provider, providersJSON string) *InitOpts {
-	opts := InitOpts{}
-	err := json.Unmarshal([]byte(providersJSON), &opts)
+	providers := Providers{}
+	err := json.Unmarshal([]byte(providersJSON), &providers)
 	if err != nil {
-		log.Println("ERROR: %v", err)
+		log.Println("ERROR while parsing json:", err)
 	}
-	return &opts
+	if len(providers.Data) != 1 {
+		panic("BUG: we do not support multi-provider yet")
+	}
+	providerOpts := &providers.Data[0]
+	return &InitOpts{providerOpts, false}
 }
 
 func InitializeBitmaskContext(opts *InitOpts) {
-	p := bitmask.GetConfiguredProvider()
-	opts.Provider = p.Provider
-	opts.AppName = p.AppName
+	bitmask.ConfigureProvider(opts.ProviderOptions)
 
 	initOnce.Do(func() { initializeContext(opts) })
 	if ctx.bm != nil {
diff --git a/pkg/backend/donate.go b/pkg/backend/donate.go
index 20d561300350c94571f7e50552d21286f14abf7c..f87934a9ea9c4174b4977ef42557dd4ef7716241 100644
--- a/pkg/backend/donate.go
+++ b/pkg/backend/donate.go
@@ -2,8 +2,6 @@ package backend
 
 import (
 	"time"
-
-	"0xacab.org/leap/bitmask-vpn/pkg/config"
 )
 
 // runDonationReminder checks every hour if we need to show the reminder,
@@ -19,13 +17,6 @@ func runDonationReminder() {
 	}()
 }
 
-func wantDonations() bool {
-	if config.AskForDonations == "true" {
-		return true
-	}
-	return false
-}
-
 func needsDonationReminder() bool {
 	return ctx.cfg.NeedsDonationReminder()
 }
diff --git a/pkg/backend/init.go b/pkg/backend/init.go
index be4427afc90e8505157024b0cf4eb43c25f153c6..aabc720b9d8e02bc21f91f32e29641fe571b6957 100644
--- a/pkg/backend/init.go
+++ b/pkg/backend/init.go
@@ -14,13 +14,17 @@ import (
 // api uses the sync.Once primitive to call this.
 func initializeContext(opts *InitOpts) {
 	var st status = off
+
+	// TODO - now there's really no need to dance between opts and config anymore
+	// but this was the simplest transition. We should probably keep the multi-provider config in the backend too, and just
+	// switch the "active" here in the ctx, after the user has selected one in the combobox.
 	ctx = &connectionCtx{
-		AppName:         opts.AppName,
-		Provider:        opts.Provider,
+		AppName:         opts.ProviderOptions.AppName,
+		Provider:        opts.ProviderOptions.Provider,
 		TosURL:          config.TosURL,
 		HelpURL:         config.HelpURL,
 		DonateURL:       config.DonateURL,
-		AskForDonations: wantDonations(),
+		AskForDonations: config.AskForDonations,
 		DonateDialog:    false,
 		Version:         version.VERSION,
 		Status:          st,
diff --git a/pkg/bitmask/init.go b/pkg/bitmask/init.go
index b86deb825c5384e1058378e364f954e006bc7fac..4907b2fb1a685c09a596f6c8f7ae5dc1e6268e83 100644
--- a/pkg/bitmask/init.go
+++ b/pkg/bitmask/init.go
@@ -20,6 +20,7 @@ import (
 	"log"
 	"os"
 	"path"
+	"strconv"
 
 	"github.com/jmshal/go-locale"
 	"golang.org/x/text/message"
@@ -34,12 +35,46 @@ type ProviderInfo struct {
 	AppName  string
 }
 
+type ProviderOpts struct {
+	Provider        string `json:"name"`
+	AppName         string `json:"applicationName"`
+	BinaryName      string `json:"binaryName"`
+	Auth            string `json:"auth"`
+	ProviderURL     string `json:"providerURL"`
+	DonateURL       string `json:"donateURL"`
+	ApiURL          string `json:"apiURL"`
+	TosURL          string `json:"tosURL"`
+	HelpURL         string `json:"helpURL"`
+	GeolocationURL  string `json:"geolocationAPI"`
+	AskForDonations string `json:"askForDonations"`
+	CaCert          string `json:"caCertString"`
+}
+
 func GetConfiguredProvider() *ProviderInfo {
 	provider := config.Provider
 	appName := config.ApplicationName
 	return &ProviderInfo{provider, appName}
 }
 
+func ConfigureProvider(opts *ProviderOpts) {
+	config.Provider = opts.ProviderURL
+	config.ProviderName = opts.Provider
+	config.ApplicationName = opts.AppName
+	config.BinaryName = opts.BinaryName
+	config.Auth = opts.Auth
+	config.DonateURL = opts.DonateURL
+	config.HelpURL = opts.HelpURL
+	config.TosURL = opts.TosURL
+	config.APIURL = opts.ApiURL
+	config.GeolocationAPI = opts.GeolocationURL
+	config.CaCert = []byte(opts.CaCert)
+
+	wantsDonations, err := strconv.ParseBool(opts.AskForDonations)
+	if err == nil {
+		config.AskForDonations = wantsDonations
+	}
+}
+
 func InitializeLogger() {
 	_, err := config.ConfigureLogger(path.Join(config.LogPath))
 	if err != nil {
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 908409ada16580294d413df2cdff06577ae03248..7815c96366641303fbf8bbec47e6645dde94a606 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -1,22 +1,17 @@
-// Code generated by go generate; DO NOT EDIT.
-// This file was generated by vendorize.py
-// At 2020-08-20 13:39:50
-
 package config
 
-/* All these constants are defined in the vendor.conf file
- */
-const (
-	Provider        = "vpnlib.bitmask.net"
-	ApplicationName = "DemoLib"
-	BinaryName      = "demo-lib"
-	Auth            = "sip"
+var (
+	Provider        = ""
+	ProviderName    = ""
+	ApplicationName = ""
+	BinaryName      = ""
+	Auth            = ""
 	DonateURL       = ""
-	AskForDonations = "false"
-	HelpURL         = "https://libraryvpn.org/"
-	TosURL          = "https://libraryvpn.org/"
-	APIURL          = "https://api.vpnlib.bitmask.net:4430/"
-	GeolocationAPI  = "https://getmyip.vpnlib.bitmask.net/json"
+	AskForDonations = true
+	HelpURL         = ""
+	TosURL          = ""
+	APIURL          = ""
+	GeolocationAPI  = ""
 )
 
 var Version string
@@ -28,12 +23,4 @@ CaCert : a string containing a representation of the provider CA, used to
         config/[provider]-ca.crt
 
 */
-var CaCert = []byte(`-----BEGIN CERTIFICATE-----
-MIIBQzCB6aADAgECAgEBMAoGCCqGSM49BAMCMBcxFTATBgNVBAMTDExFQVAgUm9v
-dCBDQTAeFw0yMDA4MDYxOTA3NDRaFw0yNTA4MDYxOTEyNDRaMBcxFTATBgNVBAMT
-DExFQVAgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABIG5POr4cAdK
-kTavKpSJr8nW1V7HLpr27qKaShpk1TUy5ipaAlusmavGLxKsPE+i3AMlvf/f6ch3
-1MjAtIf5rYujJjAkMA4GA1UdDwEB/wQEAwICpDASBgNVHRMBAf8ECDAGAQH/AgEB
-MAoGCCqGSM49BAMCA0kAMEYCIQDXj280LNZbSbi0Y2WvtQrJBUw4wdm8qAeOeuH7
-6XiLEwIhAPBRsmst/ujcChsG2t6LpG+p8s4rfIfh8YLo/4qrcc5p
------END CERTIFICATE-----`)
+var CaCert = []byte("")
diff --git a/pkg/vpn/bonafide/bonafide.go b/pkg/vpn/bonafide/bonafide.go
index 6630352fc73686924c347a302963bf3f28d8eb00..e65e193f70358e13b5a1e3ab901a111200f7d0f3 100644
--- a/pkg/vpn/bonafide/bonafide.go
+++ b/pkg/vpn/bonafide/bonafide.go
@@ -40,10 +40,6 @@ const (
 	certPathv1 = "1/cert"
 	certPathv3 = "3/cert"
 	authPathv3 = "3/auth"
-
-	certAPI  = config.APIURL + certPathv1
-	certAPI3 = config.APIURL + certPathv3
-	authAPI  = config.APIURL + authPathv3
 )
 
 type Bonafide struct {
@@ -185,11 +181,11 @@ func (b *Bonafide) getURL(object string) string {
 	if b.apiURL == "" {
 		switch object {
 		case "cert":
-			return certAPI
+			return config.APIURL + certPathv1
 		case "certv3":
-			return certAPI3
+			return config.APIURL + certPathv3
 		case "auth":
-			return authAPI
+			return config.APIURL + authPathv3
 		}
 	} else {
 		switch object {
diff --git a/pkg/vpn/bonafide/eip_service.go b/pkg/vpn/bonafide/eip_service.go
index 961ac403cc5ae0c2408556c6956141c474603147..21cc8e80e75991039330df1b516638b874031165 100644
--- a/pkg/vpn/bonafide/eip_service.go
+++ b/pkg/vpn/bonafide/eip_service.go
@@ -14,11 +14,6 @@ import (
 	"0xacab.org/leap/bitmask-vpn/pkg/config"
 )
 
-const (
-	eip1API = config.APIURL + "1/config/eip-service.json"
-	eip3API = config.APIURL + "3/config/eip-service.json"
-)
-
 type eipService struct {
 	Gateways             []gatewayV3
 	Locations            map[string]location
@@ -83,6 +78,7 @@ func (b *Bonafide) setupAuthentication(i interface{}) {
 }
 
 func (b *Bonafide) fetchEipJSON() error {
+	eip3API := config.APIURL + "3/config/eip-service.json"
 	resp, err := b.client.Post(eip3API, "", nil)
 	for err != nil {
 		log.Printf("Error fetching eip v3 json: %v", err)
@@ -98,6 +94,7 @@ func (b *Bonafide) fetchEipJSON() error {
 		buf := make([]byte, 128)
 		resp.Body.Read(buf)
 		log.Printf("Error fetching eip v3 json")
+		eip1API := config.APIURL + "1/config/eip-service.json"
 		resp, err = b.client.Post(eip1API, "", nil)
 		if err != nil {
 			return err
diff --git a/pkg/vpn/launcher_linux.go b/pkg/vpn/launcher_linux.go
index 1280eae8bcdbbd4403129d45b2a1a737ac81b66d..3a297893f669a6f0069153d594156baeb55998c4 100644
--- a/pkg/vpn/launcher_linux.go
+++ b/pkg/vpn/launcher_linux.go
@@ -29,7 +29,10 @@ import (
 )
 
 const (
-	systemOpenvpnPath   = "/usr/sbin/openvpn"
+	systemOpenvpnPath = "/usr/sbin/openvpn"
+)
+
+var (
 	snapOpenvpnPath     = "/snap/bin/" + config.BinaryName + ".openvpn"
 	snapBitmaskRootPath = "/snap/bin/" + config.BinaryName + ".bitmask-root"
 )