diff --git a/.github/workflows/build_source_tests.yaml b/.github/workflows/build_source_tests.yaml
index 7614bd8c..17fc20d6 100644
--- a/.github/workflows/build_source_tests.yaml
+++ b/.github/workflows/build_source_tests.yaml
@@ -16,9 +16,9 @@ jobs:
       matrix:
         include:
           - cc: "gcc"
-            cflags: "-Wall -Wextra -Werror-implicit-function-declaration"
+            cflags: "-std=c99 -Wall -Wextra -Werror-implicit-function-declaration"
           - cc: "clang"
-            cflags: "-Wall -Wextra -Werror-implicit-function-declaration"
+            cflags: "-std=c99 -Wall -Wextra -Werror-implicit-function-declaration"
     runs-on: "ubuntu-latest"
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 9664f229..9d6bbe9b 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -15,15 +15,42 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Install valgrind
+        run: |
+          sudo apt-get update
+          sudo apt-get install automake autoconf libtool libsubunit-dev valgrind
+
       - name: Build atSDK
         run: |
-          cmake -S . -B build -DATSDK_BUILD_TESTS="unit" -DCMAKE_BUILD_TYPE="Debug"
+          cmake -S . -B build \
+            -DATSDK_BUILD_TESTS="unit" \
+            -DCMAKE_BUILD_TYPE="Debug" \
+            -DCMAKE_C_FLAGS="-std=c99 -Wall -Wextra -Werror-implicit-function-declaration" \
+            -DATSDK_MEMCHECK=ON
+
           cmake --build build --target all
 
       - name: Run tests
         run: ctest --test-dir build --output-on-failure --timeout 5 -VV
 
+      # Unit tests are so fast we can run them serially and they will still
+      # finish before the functional tests.
+      # Long timeout because RSA keygen test sometimes takes a while
+      - name: Run memcheck tests
+        run: ctest -T memcheck --test-dir build --output-on-failure --timeout 60 -VV
+
   functional-tests:
+    strategy:
+      fail-fast: true
+      matrix:
+        include:
+          - type: normal
+            flags: ""
+            valgrind: false
+          - type: memcheck
+            flags: "-T memcheck"
+            valgrind: true
     runs-on: "ubuntu-latest"
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -55,11 +82,19 @@ jobs:
           cmake --build build
           for i in {1..3}; do ./build/check_docker_readiness && break || sleep 5; done
 
+      - name: Install valgrind
+        if: ${{ matrix.valgrind == true }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install automake autoconf libtool libsubunit-dev valgrind
+
       - name: Install atSDK
         run: |
           cmake -S . -B build                                       \
             -DATSDK_BUILD_TESTS="func"                              \
             -DCMAKE_BUILD_TYPE=Debug                                \
+            -DATSDK_MEMCHECK=ON                                     \
+            -DCMAKE_C_FLAGS="-std=c99 -Wall -Wextra -Werror-implicit-function-declaration" \
             -DATDIRECTORY_HOST="\"vip.ve.atsign.zone\""             \
             -DATDIRECTORY_PORT=64                                   \
             -DFIRST_ATSIGN="\"@alice🛠\""                           \
@@ -71,9 +106,9 @@ jobs:
 
           cmake --build build
 
-      - name: Run Functional Tests
+      - name: Run ${{ matrix.type }} Functional Tests
         run: |
-          ctest --test-dir build/tests/functional_tests -VV --timeout 90
+          ctest ${{ matrix.flags }} --test-dir build  --output-on-failure --timeout 90 -VV
 
   build-examples:
     runs-on: "ubuntu-latest"
diff --git a/justfile b/justfile
index 4594ff7a..e9d2397c 100644
--- a/justfile
+++ b/justfile
@@ -16,6 +16,8 @@ unit_dir := quote(justfile_directory() / "build/unit-") + postfix
 func_dir := quote(justfile_directory() / "build/func-") + postfix
 memcheck_dir := quote(justfile_directory() / "build/memcheck-") + postfix
 
+c_flags := "-std=c99 -Wall -Wextra -Werror-implicit-function-declaration"
+
 # SETUP COMMANDS
 
 setup: configure-test-all
@@ -101,7 +103,7 @@ configure-debug:
     -DCMAKE_INSTALL_PREFIX="$HOME/.local/" \
     -DCMAKE_BUILD_TYPE=Debug \
     -DCMAKE_C_COMPILER=$C_COMPILER \
-    -DCMAKE_C_FLAGS="-std=c99 -Wno-error" \
+    -DCMAKE_C_FLAGS={{ c_flags }}\
     -DATSDK_BUILD_TESTS=OFF \
     -DATSDK_MEMCHECK=OFF
 
@@ -121,7 +123,7 @@ configure-test-unit:
     -G "$GENERATOR" \
     -DCMAKE_BUILD_TYPE=Debug \
     -DCMAKE_C_COMPILER=$C_COMPILER \
-    -DCMAKE_C_FLAGS="-std=c99 -Wno-error " \
+    -DCMAKE_C_FLAGS={{ c_flags }}\
     -DATSDK_BUILD_TESTS="unit" \
     -DATSDK_MEMCHECK=OFF \
     -DFIRST_ATSIGN="\"$FIRST_ATSIGN\"" \
@@ -133,7 +135,7 @@ configure-test-func:
     -G "$GENERATOR" \
     -DCMAKE_BUILD_TYPE=Debug \
     -DCMAKE_C_COMPILER=$C_COMPILER \
-    -DCMAKE_C_FLAGS="-std=c99 -Wno-error" \
+    -DCMAKE_C_FLAGS={{ c_flags }}\
     -DATSDK_BUILD_TESTS="func" \
     -DATSDK_MEMCHECK=OFF \
     -DATDIRECTORY_HOST="\"$ATDIRECTORY_HOST\"" \
@@ -152,7 +154,7 @@ configure-test-all:
     -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
     -DCMAKE_BUILD_TYPE=Debug \
     -DCMAKE_C_COMPILER=$C_COMPILER \
-    -DCMAKE_C_FLAGS="-std=c99 -Wno-error " \
+    -DCMAKE_C_FLAGS={{ c_flags }}\
     -DATSDK_BUILD_TESTS=ON \
     -DATSDK_MEMCHECK=OFF \
     -DATDIRECTORY_HOST="\"$ATDIRECTORY_HOST\"" \
@@ -170,12 +172,16 @@ configure-test-memcheck:
     -G "$GENERATOR" \
     -DCMAKE_BUILD_TYPE=Debug \
     -DCMAKE_C_COMPILER=$C_COMPILER \
-    -DCMAKE_C_FLAGS="-std=gnu99 -Wno-error" \
+    -DCMAKE_C_FLAGS={{ c_flags }}\
     -DATSDK_BUILD_TESTS=ON \
     -DBUILD_SHARED_LIBS=ON \
     -DATSDK_MEMCHECK=ON \
     -DFIRST_ATSIGN="\"$FIRST_ATSIGN\"" \
-    -DSECOND_ATSIGN="\"$SECOND_ATSIGN\""
+    -DSECOND_ATSIGN="\"$SECOND_ATSIGN\"" \
+    -DFIRST_ATSIGN_ATSERVER_HOST="\"$FIRST_ATSIGN_ATSERVER_HOST\"" \
+    -DFIRST_ATSIGN_ATSERVER_PORT=$FIRST_ATSIGN_ATSERVER_PORT \
+    -DSECOND_ATSIGN_ATSERVER_HOST="\"$SECOND_ATSIGN_ATSERVER_HOST\"" \
+    -DSECOND_ATSIGN_ATSERVER_PORT=$SECOND_ATSIGN_ATSERVER_PORT
 
 # DIAGNOSTIC COMMANDS
 
diff --git a/packages/atauth/tests/test_enroll_namespace.c b/packages/atauth/tests/test_enroll_namespace.c
index f0bca49b..a90ebba8 100644
--- a/packages/atauth/tests/test_enroll_namespace.c
+++ b/packages/atauth/tests/test_enroll_namespace.c
@@ -63,6 +63,7 @@ static int test_1a_parse_enroll_namespace_valid() {
                  ns.permissions[1]);
     return 1;
   }
+  enroll_namespace_free(&ns);
   return 0;
 }
 
@@ -162,6 +163,7 @@ static int test_3a_to_json() {
                  expected_json_3a, json);
   }
 
+  free(json);
   free(ns.namespaces[0]);
   free(ns.namespaces[1]);
   free(ns.namespaces);
diff --git a/packages/atclient/src/atclient_get_self_key.c b/packages/atclient/src/atclient_get_self_key.c
index 214396ce..6d853b86 100755
--- a/packages/atclient/src/atclient_get_self_key.c
+++ b/packages/atclient/src/atclient_get_self_key.c
@@ -54,8 +54,6 @@ int atclient_get_self_key(atclient *atclient, atclient_atkey *atkey, char **valu
   char *value_raw = NULL;
   char *metadata_str = NULL;
 
-  atclient_atkey_metadata metadata;
-
   /*
    * 3. Build `llookup:` command
    */
@@ -115,7 +113,7 @@ int atclient_get_self_key(atclient *atclient, atclient_atkey *atkey, char **valu
 
   metadata_str = cJSON_Print(metadata_json);
 
-  if ((ret = atclient_atkey_metadata_from_json_str(&metadata, metadata_str)) != 0) {
+  if ((ret = atclient_atkey_metadata_from_json_str(&atkey->metadata, metadata_str)) != 0) {
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atclient_atkey_metadata_from_json_str: %d\n", ret);
     goto exit;
   }
@@ -123,9 +121,9 @@ int atclient_get_self_key(atclient *atclient, atclient_atkey *atkey, char **valu
   /**
    * 6. Decrypt value
    */
-  if (atclient_atkey_metadata_is_iv_nonce_initialized(&metadata)) {
-    if ((ret = atchops_base64_decode(metadata.iv_nonce, strlen(metadata.iv_nonce), iv, ATCHOPS_IV_BUFFER_SIZE, NULL)) !=
-        0) {
+  if (atclient_atkey_metadata_is_iv_nonce_initialized(&atkey->metadata)) {
+    if ((ret = atchops_base64_decode(atkey->metadata.iv_nonce, strlen(atkey->metadata.iv_nonce), iv,
+                                     ATCHOPS_IV_BUFFER_SIZE, NULL)) != 0) {
       atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atchops_base64_decode: %d\n", ret);
       goto exit;
     }
diff --git a/packages/atclient/src/atclient_get_shared_key.c b/packages/atclient/src/atclient_get_shared_key.c
index d7e5d37f..5cbd4df1 100755
--- a/packages/atclient/src/atclient_get_shared_key.c
+++ b/packages/atclient/src/atclient_get_shared_key.c
@@ -304,6 +304,7 @@ atclient_get_shared_key_shared_by_me_with_other(atclient *atclient, atclient_atk
   if ((ret = atchops_base64_decode(value_raw_encrypted_base64, value_raw_encrypted_base64_len, value_raw_encrypted,
                                    value_raw_encrypted_size, &value_raw_encrypted_len)) != 0) {
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atchops_base64_decode: %d\n", ret);
+    free(value_raw_encrypted);
     goto exit;
   }
 
@@ -311,13 +312,15 @@ atclient_get_shared_key_shared_by_me_with_other(atclient *atclient, atclient_atk
   if ((value_raw = malloc(sizeof(unsigned char) * value_raw_size)) == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to allocate memory for value_raw\n");
+    free(value_raw_encrypted);
     goto exit;
   }
   memset(value_raw, 0, sizeof(unsigned char) * value_raw_size);
   size_t value_raw_len = 0;
-
-  if ((ret = atchops_aes_ctr_decrypt(shared_encryption_key_to_use, ATCHOPS_AES_256, iv, value_raw_encrypted,
-                                     value_raw_encrypted_len, value_raw, value_raw_size, &value_raw_len)) != 0) {
+  ret = atchops_aes_ctr_decrypt(shared_encryption_key_to_use, ATCHOPS_AES_256, iv, value_raw_encrypted,
+                                value_raw_encrypted_len, value_raw, value_raw_size, &value_raw_len);
+  free(value_raw_encrypted);
+  if (ret != 0) {
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atchops_aes_ctr_decrypt: %d\n", ret);
     goto exit;
   }
diff --git a/packages/atclient/src/atkey.c b/packages/atclient/src/atkey.c
index 553bd103..695060c3 100644
--- a/packages/atclient/src/atkey.c
+++ b/packages/atclient/src/atkey.c
@@ -7,7 +7,15 @@
 #include <stddef.h>
 #include <stdio.h>
 #include <stdlib.h>
+
+// TODO remove use of strtok_r so we can conform to C99 instead of POSIX 2001
+#if _POSIX_C_SOURCE < 200112L
+#undef _POSIX_C_SOURCE
+#define _POSIX_C_SOURCE 200112L
+#endif
 #include <string.h>
+extern char *strtok_r(char *, const char *, char **);
+// END (keep string.h include after removing this temp fix)
 
 #define TAG "atkey"
 
diff --git a/packages/atclient/src/encryption_key_helpers.c b/packages/atclient/src/encryption_key_helpers.c
index 9ff608ff..418c1158 100644
--- a/packages/atclient/src/encryption_key_helpers.c
+++ b/packages/atclient/src/encryption_key_helpers.c
@@ -5,6 +5,7 @@
 #include "atclient/atkeys.h"
 #include "atclient/constants.h"
 #include "atclient/string_utils.h"
+#include "atcommons/memory_util.h"
 #include "atlogger/atlogger.h"
 #include <atchops/platform.h>
 #include <stdlib.h>
@@ -39,8 +40,6 @@ int atclient_get_public_encryption_key(atclient *ctx, const char *atsign, char *
    */
 
   char *atsign_with_at = NULL;
-  char *atsign_without_at = NULL;
-
   char *command = NULL;
 
   const size_t recv_size = 1024; // sufficient buffer size to receive the public key
@@ -56,11 +55,6 @@ int atclient_get_public_encryption_key(atclient *ctx, const char *atsign, char *
     goto exit;
   }
 
-  if ((ret = atclient_string_utils_atsign_without_at(atsign_with_at, &atsign_without_at)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atclient_string_utils_atsign_without_at: %d\n", ret);
-    goto exit;
-  }
-
   const size_t commandsize = strlen("plookup:publickey") + strlen(atsign_with_at) + strlen("\r\n") + 1;
   if ((command = (char *)malloc(sizeof(char) * commandsize)) == NULL) {
     ret = 1;
@@ -107,7 +101,15 @@ int atclient_get_public_encryption_key(atclient *ctx, const char *atsign, char *
   (*public_encryption_key)[public_encryption_key_len] = '\0';
 
   ret = 0;
-exit: { return ret; }
+exit: {
+  if (atsign_with_at != NULL) {
+    free(atsign_with_at);
+  }
+  if (command != NULL) {
+    free(command);
+  }
+  return ret;
+}
 }
 
 int atclient_get_shared_encryption_key_shared_by_me(atclient *ctx, const char *recipient_atsign,
diff --git a/packages/atclient/src/metadata.c b/packages/atclient/src/metadata.c
index a619c783..d66fbda9 100644
--- a/packages/atclient/src/metadata.c
+++ b/packages/atclient/src/metadata.c
@@ -1,6 +1,6 @@
 #include "atclient/metadata.h"
-#include "atclient/string_utils.h"
 #include "atclient/json.h"
+#include "atclient/string_utils.h"
 #include "atlogger/atlogger.h"
 #include <atchops/platform.h>
 #include <inttypes.h>
@@ -1706,11 +1706,14 @@ static int set_created_by(atclient_atkey_metadata *metadata, const char *created
   int ret = 1;
   const size_t created_by_len = strlen(created_by);
   const size_t created_by_size = created_by_len + 1;
-  if ((metadata->created_by = malloc(sizeof(char) * (created_by_size))) == NULL) {
+  char *temp = malloc(sizeof(char) * (created_by_size));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_created_by malloc failed\n");
     goto exit;
   }
+  unset_created_by(metadata);
+  metadata->created_by = temp;
   memcpy(metadata->created_by, created_by, created_by_len);
   metadata->created_by[created_by_len] = '\0';
   set_is_created_by_initialized(metadata, true);
@@ -1723,11 +1726,14 @@ static int set_updated_by(atclient_atkey_metadata *metadata, const char *updated
   int ret = 1;
   const size_t updated_by_len = strlen(updated_by);
   const size_t updated_by_size = updated_by_len + 1;
-  if ((metadata->updated_by = malloc(sizeof(char) * (updated_by_size))) == NULL) {
+  char *temp = malloc(sizeof(char) * (updated_by_size));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_updated_by malloc failed\n");
     goto exit;
   }
+  unset_updated_by(metadata);
+  metadata->updated_by = temp;
   memcpy(metadata->updated_by, updated_by, updated_by_len);
   metadata->updated_by[updated_by_len] = '\0';
   set_is_updated_by_initialized(metadata, true);
@@ -1740,11 +1746,14 @@ static int set_status(atclient_atkey_metadata *metadata, const char *status) {
   int ret = 1;
   const size_t statuslen = strlen(status);
   const size_t statussize = statuslen + 1;
-  if ((metadata->status = malloc(sizeof(char) * (statussize))) == NULL) {
+  char *temp = malloc(sizeof(char) * (statussize));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_status malloc failed\n");
     goto exit;
   }
+  unset_status(metadata);
+  metadata->status = temp;
   memcpy(metadata->status, status, statuslen);
   metadata->status[statuslen] = '\0';
   set_is_status_initialized(metadata, true);
@@ -1762,11 +1771,14 @@ static int set_expires_at(atclient_atkey_metadata *metadata, const char *expires
   int ret = 1;
   const size_t expires_at_len = strlen(expires_at);
   const size_t expires_at_size = expires_at_len + 1;
-  if ((metadata->expires_at = malloc(sizeof(char) * (expires_at_size))) == NULL) {
+  char *temp = malloc(sizeof(char) * (expires_at_size));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_expires_at malloc failed\n");
     goto exit;
   }
+  unset_expires_at(metadata);
+  metadata->expires_at = temp;
   memcpy(metadata->expires_at, expires_at, expires_at_len);
   metadata->expires_at[expires_at_len] = '\0';
   set_is_expires_at_initialized(metadata, true);
@@ -1779,11 +1791,14 @@ static int set_available_at(atclient_atkey_metadata *metadata, const char *avail
   int ret = 1;
   const size_t available_at_len = strlen(available_at);
   const size_t available_at_size = available_at_len + 1;
-  if ((metadata->available_at = malloc(sizeof(char) * (available_at_size))) == NULL) {
+  char *temp = malloc(sizeof(char) * (available_at_size));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_available_at malloc failed\n");
     goto exit;
   }
+  unset_available_at(metadata);
+  metadata->available_at = temp;
   memcpy(metadata->available_at, available_at, available_at_len);
   metadata->available_at[available_at_len] = '\0';
   set_is_available_at_initialized(metadata, true);
@@ -1796,11 +1811,14 @@ static int set_refresh_at(atclient_atkey_metadata *metadata, const char *refresh
   int ret = 1;
   const size_t refresh_at_len = strlen(refresh_at);
   const size_t refresh_at_size = refresh_at_len + 1;
-  if ((metadata->refresh_at = malloc(sizeof(char) * (refresh_at_size))) == NULL) {
+  char *temp = malloc(sizeof(char) * (refresh_at_size));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_refresh_at malloc failed\n");
     goto exit;
   }
+  unset_refresh_at(metadata);
+  metadata->refresh_at = temp;
   memcpy(metadata->refresh_at, refresh_at, refresh_at_len);
   metadata->refresh_at[refresh_at_len] = '\0';
   set_is_refresh_at_initialized(metadata, true);
@@ -1812,11 +1830,14 @@ exit: { return ret; }
 static int set_created_at(atclient_atkey_metadata *metadata, const char *created_at) {
   int ret = 1;
   const size_t created_at_len = strlen(created_at);
-  if ((metadata->created_at = malloc(sizeof(char) * (created_at_len + 1))) == NULL) {
+  char *temp = malloc(sizeof(char) * (created_at_len + 1));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_created_at malloc failed\n");
     goto exit;
   }
+  unset_created_at(metadata);
+  metadata->created_at = temp;
   memcpy(metadata->created_at, created_at, created_at_len);
   metadata->created_at[created_at_len] = '\0';
   set_is_created_at_initialized(metadata, true);
@@ -1829,11 +1850,14 @@ static int set_updated_at(atclient_atkey_metadata *metadata, const char *updated
   int ret = 1;
   const size_t updated_at_len = strlen(updated_at);
   const size_t updated_at_size = updated_at_len + 1;
-  if ((metadata->updated_at = malloc(sizeof(char) * (updated_at_size))) == NULL) {
+  char *temp = malloc(sizeof(char) * (updated_at_size));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_updated_at malloc failed\n");
     goto exit;
   }
+  unset_updated_at(metadata);
+  metadata->updated_at = temp;
   memcpy(metadata->updated_at, updated_at, updated_at_len);
   metadata->updated_at[updated_at_len] = '\0';
   set_is_updated_at_initialized(metadata, true);
@@ -1886,11 +1910,14 @@ static int set_data_signature(atclient_atkey_metadata *metadata, const char *dat
   int ret = 1;
   const size_t data_signature_len = strlen(data_signature);
   const size_t data_signature_size = data_signature_len + 1;
-  if ((metadata->data_signature = malloc(sizeof(char) * (data_signature_size))) == NULL) {
+  char *temp = malloc(sizeof(char) * (data_signature_size));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_data_signature malloc failed\n");
     goto exit;
   }
+  unset_data_signature(metadata);
+  metadata->data_signature = temp;
   memcpy(metadata->data_signature, data_signature, data_signature_len);
   metadata->data_signature[data_signature_len] = '\0';
   set_is_data_signature_initialized(metadata, true);
@@ -1903,11 +1930,14 @@ static int set_shared_key_status(atclient_atkey_metadata *metadata, const char *
   int ret = 1;
   const size_t shared_key_status_len = strlen(shared_key_status);
   const size_t shared_key_status_size = shared_key_status_len + 1;
-  if ((metadata->shared_key_status = malloc(sizeof(char) * (shared_key_status_size))) == NULL) {
+  char *temp = malloc(sizeof(char) * (shared_key_status_size));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_shared_key_status malloc failed\n");
     goto exit;
   }
+  unset_shared_key_status(metadata);
+  metadata->shared_key_status = temp;
   memcpy(metadata->shared_key_status, shared_key_status, shared_key_status_len);
   metadata->shared_key_status[shared_key_status_len] = '\0';
   set_is_shared_key_status_initialized(metadata, true);
@@ -1920,11 +1950,14 @@ static int set_shared_key_enc(atclient_atkey_metadata *metadata, const char *sha
   int ret = 1;
   const size_t shared_key_enc_len = strlen(shared_key_enc);
   const size_t shared_key_enc_size = shared_key_enc_len + 1;
-  if ((metadata->shared_key_enc = malloc(sizeof(char) * (shared_key_enc_size))) == NULL) {
+  char *temp = malloc(sizeof(char) * (shared_key_enc_size));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_shared_key_enc malloc failed\n");
     goto exit;
   }
+  unset_shared_key_enc(metadata);
+  metadata->shared_key_enc = temp;
   memcpy(metadata->shared_key_enc, shared_key_enc, shared_key_enc_len);
   metadata->shared_key_enc[shared_key_enc_len] = '\0';
   set_is_shared_key_enc_initialized(metadata, true);
@@ -1937,11 +1970,14 @@ static int set_pub_key_hash(atclient_atkey_metadata *metadata, const char *pub_k
   int ret = 1;
   const size_t pub_key_hash_len = strlen(pub_key_hash);
   const size_t pub_key_hash_size = pub_key_hash_len + 1;
-  if ((metadata->pub_key_hash = malloc(sizeof(char) * (pub_key_hash_size))) == NULL) {
+  char *temp = malloc(sizeof(char) * (pub_key_hash_size));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_pub_key_hash malloc failed\n");
     goto exit;
   }
+  unset_pub_key_hash(metadata);
+  metadata->pub_key_hash = temp;
   memcpy(metadata->pub_key_hash, pub_key_hash, pub_key_hash_len);
   metadata->pub_key_hash[pub_key_hash_len] = '\0';
   set_is_pub_key_hash_initialized(metadata, true);
@@ -1954,11 +1990,14 @@ static int set_pubkeyalgo(atclient_atkey_metadata *metadata, const char *pub_key
   int ret = 1;
   const size_t pub_key_algo_len = strlen(pub_key_algo);
   const size_t pub_key_algo_size = pub_key_algo_len + 1;
-  if ((metadata->pub_key_algo = malloc(sizeof(char) * (pub_key_algo_size))) == NULL) {
+  char *temp = malloc(sizeof(char) * (pub_key_algo_size));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_pubkeyalgo malloc failed\n");
     goto exit;
   }
+  unset_pub_key_algo(metadata);
+  metadata->pub_key_algo = temp;
   memcpy(metadata->pub_key_algo, pub_key_algo, pub_key_algo_len);
   metadata->pub_key_algo[pub_key_algo_len] = '\0';
   set_is_pub_key_algo_initialized(metadata, true);
@@ -1971,11 +2010,14 @@ static int set_encoding(atclient_atkey_metadata *metadata, const char *encoding)
   int ret = 1;
   const size_t encoding_len = strlen(encoding);
   const size_t encoding_size = encoding_len + 1;
-  if ((metadata->encoding = malloc(sizeof(char) * (encoding_size))) == NULL) {
+  char *temp = malloc(sizeof(char) * (encoding_size));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_encoding malloc failed\n");
     goto exit;
   }
+  unset_encoding(metadata);
+  metadata->encoding = temp;
   memcpy(metadata->encoding, encoding, encoding_len);
   metadata->encoding[encoding_len] = '\0';
   set_is_encoding_initialized(metadata, true);
@@ -1988,11 +2030,14 @@ static int set_enc_key_name(atclient_atkey_metadata *metadata, const char *enc_k
   int ret = 1;
   const size_t enc_key_name_len = strlen(enc_key_name);
   const size_t enc_key_name_size = enc_key_name_len + 1;
-  if ((metadata->enc_key_name = malloc(sizeof(char) * (enc_key_name_size))) == NULL) {
+  char *temp = malloc(sizeof(char) * (enc_key_name_size));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_enc_key_name malloc failed\n");
     goto exit;
   }
+  unset_enc_key_name(metadata);
+  metadata->enc_key_name = temp;
   memcpy(metadata->enc_key_name, enc_key_name, enc_key_name_len);
   metadata->enc_key_name[enc_key_name_len] = '\0';
   set_is_enc_key_name_initialized(metadata, true);
@@ -2005,11 +2050,14 @@ static int set_enc_algo(atclient_atkey_metadata *metadata, const char *enc_algo)
   int ret = 1;
   const size_t enc_algo_len = strlen(enc_algo);
   const size_t enc_algo_size = enc_algo_len + 1;
-  if ((metadata->enc_algo = malloc(sizeof(char) * (enc_algo_size))) == NULL) {
+  char *temp = malloc(sizeof(char) * (enc_algo_size));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_enc_algo malloc failed\n");
     goto exit;
   }
+  unset_enc_algo(metadata);
+  metadata->enc_algo = temp;
   memcpy(metadata->enc_algo, enc_algo, enc_algo_len);
   metadata->enc_algo[enc_algo_len] = '\0';
   set_is_enc_algo_initialized(metadata, true);
@@ -2022,11 +2070,14 @@ static int set_iv_nonce(atclient_atkey_metadata *metadata, const char *iv_nonce)
   int ret = 1;
   const size_t iv_nonce_len = strlen(iv_nonce);
   const size_t iv_nonce_size = iv_nonce_len + 1;
-  if ((metadata->iv_nonce = malloc(sizeof(char) * (iv_nonce_size))) == NULL) {
+  char *temp = malloc(sizeof(char) * (iv_nonce_size));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_iv_nonce malloc failed\n");
     goto exit;
   }
+  unset_iv_nonce(metadata);
+  metadata->iv_nonce = temp;
   memcpy(metadata->iv_nonce, iv_nonce, iv_nonce_len);
   metadata->iv_nonce[iv_nonce_len] = '\0';
   set_is_iv_nonce_initialized(metadata, true);
@@ -2039,11 +2090,14 @@ static int set_ske_enc_key_name(atclient_atkey_metadata *metadata, const char *s
   int ret = 1;
   const size_t ske_enc_key_name_len = strlen(ske_enc_key_name);
   const size_t ske_enc_key_name_size = ske_enc_key_name_len + 1;
-  if ((metadata->ske_enc_key_name = malloc(sizeof(char) * (ske_enc_key_name_size))) == NULL) {
+  char *temp = malloc(sizeof(char) * (ske_enc_key_name_size));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_ske_enc_key_name malloc failed\n");
     goto exit;
   }
+  unset_ske_enc_key_name(metadata);
+  metadata->ske_enc_key_name = temp;
   memcpy(metadata->ske_enc_key_name, ske_enc_key_name, ske_enc_key_name_len);
   metadata->ske_enc_key_name[ske_enc_key_name_len] = '\0';
   set_is_ske_enc_key_name_initialized(metadata, true);
@@ -2056,11 +2110,14 @@ static int set_ske_enc_algo(atclient_atkey_metadata *metadata, const char *ske_e
   int ret = 1;
   const size_t ske_enc_algo_len = strlen(ske_enc_algo);
   const size_t ske_enc_algo_size = ske_enc_algo_len + 1;
-  if ((metadata->ske_enc_algo = malloc(sizeof(char) * (ske_enc_algo_size))) == NULL) {
+  char *temp = malloc(sizeof(char) * (ske_enc_algo_size));
+  if (temp == NULL) {
     ret = 1;
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "set_ske_enc_algo malloc failed\n");
     goto exit;
   }
+  unset_ske_enc_algo(metadata);
+  metadata->ske_enc_algo = temp;
   memcpy(metadata->ske_enc_algo, ske_enc_algo, ske_enc_algo_len);
   metadata->ske_enc_algo[ske_enc_algo_len] = '\0';
   set_is_ske_enc_algo_initialized(metadata, true);
diff --git a/packages/atclient/src/notify.c b/packages/atclient/src/notify.c
index 3d8f292e..cb88e786 100644
--- a/packages/atclient/src/notify.c
+++ b/packages/atclient/src/notify.c
@@ -391,6 +391,7 @@ static int generate_cmd(const atclient_notify_params *params, const char *cmdval
   goto exit;
 
 exit: {
+  free(atkeystr);
   free(metadata_protocol_str);
   return res;
 }
diff --git a/packages/atcommons/tests/test_memory_util.c b/packages/atcommons/tests/test_memory_util.c
index ea29fd0c..0aefa65b 100644
--- a/packages/atcommons/tests/test_memory_util.c
+++ b/packages/atcommons/tests/test_memory_util.c
@@ -50,6 +50,11 @@ static int test1a_valid_basic() {
   }
 
   atcommons_memlist_failure_free(&memlist);
+  if (memlist.allocated != 0) {
+    atlogger_log(TAG " 1a", ATLOGGER_LOGGING_LEVEL_ERROR, "Expected memlist.allocated to be 0, actual: %d\n",
+                 memlist.allocated);
+    return 1;
+  }
   return 0;
 }
 
diff --git a/tests/functional_tests/lib/include/functional_tests/helpers.h b/tests/functional_tests/lib/include/functional_tests/helpers.h
index d335557a..012121cc 100644
--- a/tests/functional_tests/lib/include/functional_tests/helpers.h
+++ b/tests/functional_tests/lib/include/functional_tests/helpers.h
@@ -14,14 +14,14 @@ int functional_tests_publickey_exists(atclient *atclient, const char *key, const
 int functional_tests_selfkey_exists(atclient *atclient, const char *key, const char *shared_by, const char *knamespace);
 int functional_tests_sharedkey_exists(atclient *atclient, const char *key, const char *shared_by,
                                       const char *shared_with, const char *knamespace);
-int functional_tests_tear_down_sharedenckeys(atclient *atclient, const char *recipient);
-
 
 /**
  * @brief Get the atkeys absolute file path for the given atSign. It will look inside of `~/.atsign/keys/` directory.
  *
  * @param atsign the atSign string, must begin with @ (Example: "@bob"). Assumed to be null terminated string
- * @param path a null pointer that will be allocated which will hold the absolute path. Example result would be "/home/jeremy/.atsign/keys/@alice_key.atKeys". It will return a null terminated string. The variable will be malloc'd and must be freed by the caller.
+ * @param path a null pointer that will be allocated which will hold the absolute path. Example result would be
+ * "/home/jeremy/.atsign/keys/@alice_key.atKeys". It will return a null terminated string. The variable will be malloc'd
+ * and must be freed by the caller.
  * @return int, 0 on success
  */
 int functional_tests_get_atkeys_path(const char *atsign, char **path);
diff --git a/tests/functional_tests/lib/src/helpers.c b/tests/functional_tests/lib/src/helpers.c
index e2fca04b..08c6cd4e 100644
--- a/tests/functional_tests/lib/src/helpers.c
+++ b/tests/functional_tests/lib/src/helpers.c
@@ -267,97 +267,6 @@ exit: {
 }
 }
 
-int functional_tests_tear_down_sharedenckeys(atclient *atclient1, const char *recipient) {
-  int ret = 1;
-
-  if (atclient1 == NULL) {
-    ret = 1;
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atclient is NULL\n");
-    return ret;
-  }
-
-  if (recipient == NULL) {
-    ret = 1;
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "recipient is NULL\n");
-    return ret;
-  }
-
-  if (!atclient_is_atsign_initialized(atclient1)) {
-    ret = 1;
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atsign is not initialized\n");
-    return ret;
-  }
-
-  // TODO check if pkam authenticated
-
-  atclient_atkey atkeyforme;
-  atclient_atkey_init(&atkeyforme);
-
-  atclient_atkey atkeyforthem;
-  atclient_atkey_init(&atkeyforthem);
-
-  char *client_atsign_with_at = NULL;
-  char *recipient_atsign_with_at = NULL;
-
-  char atkeystrtemp[ATCLIENT_ATKEY_FULL_LEN];
-
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "tear_down Begin\n");
-
-  if ((ret = atclient_string_utils_atsign_with_at(atclient1->atsign, &client_atsign_with_at)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atclient_string_utils_atsign_with_at: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = atclient_string_utils_atsign_with_at(recipient, &recipient_atsign_with_at)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atclient_string_utils_atsign_with_at: %d\n", ret);
-    goto exit;
-  }
-
-  char *client_atsign_without_at = client_atsign_with_at + 1;
-  char *recipient_atsign_without_at = recipient_atsign_with_at + 1;
-
-  memset(atkeystrtemp, 0, sizeof(char) * ATCLIENT_ATKEY_FULL_LEN);
-  snprintf(atkeystrtemp, ATCLIENT_ATKEY_FULL_LEN, "shared_key.%s%s", recipient_atsign_without_at,
-           client_atsign_with_at);
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "atkeystrtemp: \"%s\"\n", atkeystrtemp);
-  if ((ret = atclient_atkey_from_string(&atkeyforme, atkeystrtemp)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atclient_atkey_from_string: %d\n", ret);
-    goto exit;
-  }
-
-  memset(atkeystrtemp, 0, sizeof(char) * ATCLIENT_ATKEY_FULL_LEN);
-  snprintf(atkeystrtemp, ATCLIENT_ATKEY_FULL_LEN, "%s:shared_key%s", recipient_atsign_with_at, client_atsign_with_at);
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "atkeystrtemp: \"%s\"\n", atkeystrtemp);
-  if ((ret = atclient_atkey_from_string(&atkeyforthem, atkeystrtemp)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atclient_atkey_from_string: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = atclient_delete(atclient1, &atkeyforme, NULL, NULL)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atclient_delete: %d\n", ret);
-    goto exit;
-  }
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "deleted shared enc key for me\n");
-
-  if ((ret = atclient_delete(atclient1, &atkeyforthem, NULL, NULL)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atclient_delete: %d\n", ret);
-    goto exit;
-  }
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "deleted shared enc key for them\n");
-
-  ret = 0;
-  goto exit;
-
-exit: {
-  atclient_atkey_free(&atkeyforme);
-  atclient_atkey_free(&atkeyforthem);
-  free(client_atsign_with_at);
-  free(recipient_atsign_with_at);
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "tear_down End (%d)\n", ret);
-  return ret;
-}
-}
-
 int functional_tests_get_atkeys_path(const char *atsign, char **path) {
   struct passwd *pw = getpwuid(getuid());
   const char *homedir = pw->pw_dir;
diff --git a/tests/functional_tests/tests/test_atclient_connection.c b/tests/functional_tests/tests/test_atclient_connection.c
index efe547ef..41170d86 100644
--- a/tests/functional_tests/tests/test_atclient_connection.c
+++ b/tests/functional_tests/tests/test_atclient_connection.c
@@ -124,6 +124,7 @@ int main(int argc, char *argv[]) {
   goto exit;
 exit: {
   atclient_connection_free(&root_conn);
+  mbedtls_psa_crypto_free();
   return ret;
 }
 }
diff --git a/tests/functional_tests/tests/test_atclient_get_atkeys.c b/tests/functional_tests/tests/test_atclient_get_atkeys.c
index 61432979..33a573c6 100644
--- a/tests/functional_tests/tests/test_atclient_get_atkeys.c
+++ b/tests/functional_tests/tests/test_atclient_get_atkeys.c
@@ -61,6 +61,7 @@ int main() {
 exit: {
   atclient_free(&atclient1);
   atclient_atkeys_free(&atkeys1);
+  mbedtls_psa_crypto_free();
   return ret;
 }
 }
@@ -85,14 +86,14 @@ static int test_1_atclient_get_atkeys(atclient *ctx, const char *scan_regex, con
     free(atkeystr);
   }
 
-  for (size_t i = 0; i < atkey_array_len; i++) {
-    atclient_atkey_free(&atkey_array[i]);
-  }
-
   ret = 0;
   goto exit;
 exit: {
   atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_DEBUG, "test_1_atclient_get_atkeys: %d\n", ret);
+  for (size_t i = 0; i < atkey_array_len; i++) {
+    atclient_atkey_free(atkey_array + i);
+  }
+  free(atkey_array);
   return ret;
 }
 }
@@ -161,6 +162,10 @@ static int test_4_atclient_get_atkeys_null_regex(atclient *ctx, const char *scan
   goto exit;
 exit: {
   atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_DEBUG, "test_4_atclient_get_atkeys_null_regex: %d\n", ret);
+  for (size_t i = 0; i < arrlen; i++) {
+    atclient_atkey_free(arr + i);
+  }
+  free(arr);
   return ret;
 }
 }
diff --git a/tests/functional_tests/tests/test_atclient_monitor.c b/tests/functional_tests/tests/test_atclient_monitor.c
deleted file mode 100644
index 2d29ee4d..00000000
--- a/tests/functional_tests/tests/test_atclient_monitor.c
+++ /dev/null
@@ -1,397 +0,0 @@
-#include "functional_tests/config.h"
-#include "functional_tests/helpers.h"
-#include <atchops/aes.h>
-#include <atchops/aes_ctr.h>
-#include <atchops/base64.h>
-#include <atchops/iv.h>
-#include <atclient/atclient.h>
-#include <atclient/atclient_utils.h>
-#include <atclient/encryption_key_helpers.h>
-#include <atclient/monitor.h>
-#include <atclient/notify.h>
-#include <atclient/string_utils.h>
-#include <atlogger/atlogger.h>
-#include <stdbool.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define TAG "test_atclient_monitor"
-
-#define ATKEY_KEY "test_atclient_monitor"
-#define ATKEY_NAMESPACE "functional_tests"
-#define ATKEY_SHAREDBY FIRST_ATSIGN
-#define ATKEY_SHAREDWITH SECOND_ATSIGN
-#define ATKEY_VALUE "Test Value 12345 Meow"
-
-#define MONITOR_REGEX ".*"
-
-static int monitor_pkam_auth(atclient *monitor_conn, const atclient_atkeys *atkeys, const char *atsign);
-static int send_notification(atclient *atclient);
-static int monitor_for_notification(atclient *monitor_conn, atclient *atclient2);
-
-static int test_1_start_monitor(atclient *monitor_conn);
-static int test_2_send_notification(atclient *atclient);
-static int test_3_monitor_for_notification(atclient *monitor_conn, atclient *atclient2);
-static int test_4_re_pkam_auth_and_start_monitor(atclient *monitor_conn);
-static int test_5_send_notification(atclient *atclient);
-static int test_6_monitor_for_notification(atclient *monitor_conn, atclient *atclient2);
-
-int main() {
-  int ret = 1;
-
-  atlogger_set_logging_level(ATLOGGER_LOGGING_LEVEL_DEBUG);
-
-  atclient atclient1;
-  atclient_init(&atclient1);
-
-  atclient_atkeys atkeys_sharedby;
-  atclient_atkeys_init(&atkeys_sharedby);
-
-  atclient monitor_conn;
-  atclient_monitor_init(&monitor_conn);
-
-  atclient atclient2;
-  atclient_init(&atclient2);
-
-  atclient_atkeys atkeys_sharedwith;
-  atclient_atkeys_init(&atkeys_sharedwith);
-
-  if ((ret = functional_tests_set_up_atkeys(&atkeys_sharedby, ATKEY_SHAREDBY)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to set up atkeys_sharedby: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = functional_tests_pkam_auth(&atclient1, &atkeys_sharedby, ATKEY_SHAREDBY)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to authenticate with PKAM: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = functional_tests_set_up_atkeys(&atkeys_sharedwith, ATKEY_SHAREDWITH)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to set up atkeys_sharedby: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = monitor_pkam_auth(&monitor_conn, &atkeys_sharedwith, ATKEY_SHAREDWITH)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to authenticate with PKAM: %d\n", ret);
-    goto exit;
-  }
-
-  atclient_monitor_set_read_timeout(&monitor_conn, 5 * 1000);
-
-  if ((ret = functional_tests_pkam_auth(&atclient2, &atkeys_sharedwith, ATKEY_SHAREDWITH)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to authenticate with PKAM: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = test_1_start_monitor(&monitor_conn)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "test_1_start_monitor: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = test_2_send_notification(&atclient1)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "test_3_send_notification: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = test_3_monitor_for_notification(&monitor_conn, &atclient2)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "test_4_read_notification: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = test_4_re_pkam_auth_and_start_monitor(&monitor_conn)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "test_4_re_pkam_auth_and_start_monitor: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = test_5_send_notification(&atclient1)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "test_5_send_notification: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = test_6_monitor_for_notification(&monitor_conn, &atclient2)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "test_6_monitor_for_notification: %d\n", ret);
-    goto exit;
-  }
-
-  goto exit;
-exit: {
-  if ((functional_tests_tear_down_sharedenckeys(&atclient1, ATKEY_SHAREDWITH)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to tear down sharedenckeys: %d\n", ret);
-  }
-  atclient_atkeys_free(&atkeys_sharedby);
-  atclient_atkeys_free(&atkeys_sharedwith);
-  atclient_free(&atclient1);
-  atclient_free(&atclient2);
-  atclient_free(&monitor_conn);
-  return ret;
-}
-}
-
-static int monitor_pkam_auth(atclient *monitor_conn, const atclient_atkeys *atkeys, const char *atsign) {
-  int ret = 1;
-
-  atclient_authenticate_options authenticate_options;
-  atclient_authenticate_options_init(&authenticate_options);
-
-  if ((ret = atclient_authenticate_options_set_atdirectory_host(&authenticate_options, ATDIRECTORY_HOST)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atclient_authenticate_options_set_atdirectory_host: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = atclient_authenticate_options_set_atdirectory_port(&authenticate_options, ATDIRECTORY_PORT)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atclient_authenticate_options_set_atdirectory_port: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = atclient_monitor_pkam_authenticate(monitor_conn, atsign, atkeys, &authenticate_options)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atclient_monitor_pkam_authenticate: %d\n", ret);
-    goto exit;
-  }
-
-  ret = 0;
-  goto exit;
-exit: {
-  atclient_authenticate_options_free(&authenticate_options);
-  return ret;
-}
-}
-
-static int send_notification(atclient *atclient) {
-  int ret = 1;
-
-  atclient_notify_params params;
-  atclient_notify_params_init(&params);
-
-  atclient_atkey atkey;
-  atclient_atkey_init(&atkey);
-
-  if ((ret = atclient_atkey_create_shared_key(&atkey, ATKEY_KEY, ATKEY_SHAREDBY, ATKEY_SHAREDWITH, ATKEY_NAMESPACE)) !=
-      0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to create atkey: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = atclient_notify_params_set_operation(&params, ATCLIENT_NOTIFY_OPERATION_UPDATE)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to set operation: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = atclient_notify_params_set_atkey(&params, &atkey)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to set atkey: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = atclient_notify_params_set_value(&params, ATKEY_VALUE)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to set value: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = atclient_notify_params_set_should_encrypt(&params, true)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to set should_encrypt: %d\n", ret);
-    goto exit;
-  }
-
-  params.notification_expiry = 1000;
-
-  if ((ret = atclient_notify(atclient, &params, NULL)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to notify: %d\n", ret);
-    goto exit;
-  }
-exit: {
-  atclient_atkey_free(&atkey);
-  atclient_notify_params_free(&params);
-  return ret;
-}
-}
-
-static int monitor_for_notification(atclient *monitor_conn, atclient *atclient2) {
-  int ret = 1;
-
-  atclient_monitor_response message;
-  atclient_monitor_response_init(&message);
-
-  const int max_tries = 10;
-  int tries = 1;
-
-  while (tries <= max_tries) {
-    if ((ret = atclient_monitor_read(monitor_conn, atclient2, &message, NULL)) != 0) {
-      atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to read monitor message: %d\n", ret);
-      tries++;
-      continue;
-    }
-
-    if (!atclient_atnotification_is_decrypted_value_initialized(&(message.notification))) {
-      atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "Decrypted value is not initialized\n");
-      tries++;
-      continue;
-    }
-
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "Decrypted Value: %s\n", message.notification.decrypted_value);
-
-    // compare the decrypted value with the expected value
-    if (strcmp(message.notification.decrypted_value, ATKEY_VALUE) != 0) {
-      atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Decrypted value does not match expected value\n");
-      tries++;
-      continue;
-    }
-
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "Tries: %d\n", tries);
-
-    usleep(1000);
-
-    ret = 0;
-    goto exit;
-  }
-
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to read monitor message after %d tries\n", max_tries);
-
-  ret = 1;
-  goto exit;
-exit: {
-  atclient_monitor_response_free(&message);
-  return ret;
-}
-}
-
-static int test_1_start_monitor(atclient *monitor_conn) {
-  int ret = 1;
-
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "test_1_start_monitor Start\n");
-
-  ret = atclient_monitor_start(monitor_conn, MONITOR_REGEX);
-  if (ret != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to start monitor: %d\n", ret);
-    goto exit;
-  }
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "Started monitor\n");
-
-  goto exit;
-
-exit: {
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "test_1_start_monitor End: %d\n", ret);
-  return ret;
-}
-}
-
-static int test_2_send_notification(atclient *atclient) {
-  int ret = 1;
-
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "test_2_send_notification Start\n");
-
-  if ((ret = send_notification(atclient)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to send notification: %d\n", ret);
-    goto exit;
-  }
-
-  ret = 0;
-  goto exit;
-exit: {
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "test_2_send_notification End: %d\n", ret);
-  return ret;
-}
-}
-
-static int test_3_monitor_for_notification(atclient *monitor_conn, atclient *atclient2) {
-  int ret = 1;
-
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "test_3_monitor_for_notification Start\n");
-
-  if ((ret = monitor_for_notification(monitor_conn, atclient2)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to monitor for notification: %d\n", ret);
-    goto exit;
-  }
-
-  ret = 0;
-  goto exit;
-exit: {
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "test_3_monitor_for_notification End: %d\n", ret);
-  return ret;
-}
-}
-
-static int test_4_re_pkam_auth_and_start_monitor(atclient *monitor_conn) {
-  int ret = 1;
-
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "test_4_re_pkam_auth_and_start_monitor Start\n");
-
-  atclient_authenticate_options authenticate_options;
-  atclient_authenticate_options_init(&authenticate_options);
-
-  size_t atserver_host_len = strlen(monitor_conn->atserver_connection.host) + 1;
-  char *atserver_host = malloc(sizeof(char) * atserver_host_len);
-  if (atserver_host == NULL) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to allocate atserver_host\n");
-    return 1;
-  }
-  memset(atserver_host, 0, atserver_host_len);
-  memcpy(atserver_host, monitor_conn->atserver_connection.host, atserver_host_len - 1);
-  int atserver_port = monitor_conn->atserver_connection.port;
-
-  if ((ret = atclient_authenticate_options_set_atserver_host(&authenticate_options, atserver_host)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atclient_authenticate_options_set_atserver_host: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = atclient_authenticate_options_set_atserver_port(&authenticate_options, atserver_port)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atclient_authenticate_options_set_atserver_port: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = atclient_monitor_pkam_authenticate(monitor_conn, monitor_conn->atsign, &(monitor_conn->atkeys),
-                                                &authenticate_options)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to authenticate with PKAM: %d\n", ret);
-    goto exit;
-  }
-
-  if ((ret = atclient_monitor_start(monitor_conn, MONITOR_REGEX)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to start monitor: %d\n", ret);
-    goto exit;
-  }
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "Started monitor\n");
-
-  ret = 0;
-  goto exit;
-exit: {
-  free(atserver_host);
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "test_4_re_pkam_auth_and_start_monitor End: %d\n", ret);
-  return ret;
-}
-}
-
-static int test_5_send_notification(atclient *atclient) {
-  int ret = 1;
-
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "test_5_send_notification Start\n");
-
-  if ((ret = send_notification(atclient)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to send notification: %d\n", ret);
-    goto exit;
-  }
-
-  ret = 0;
-  goto exit;
-exit: {
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "test_5_send_notification End: %d\n", ret);
-  return ret;
-}
-}
-
-static int test_6_monitor_for_notification(atclient *monitor_conn, atclient *atclient2) {
-  int ret = 1;
-
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "test_6_monitor_for_notification Start\n");
-
-  if ((ret = monitor_for_notification(monitor_conn, atclient2)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to monitor for notification: %d\n", ret);
-    goto exit;
-  }
-
-  ret = 0;
-  goto exit;
-exit: {
-  atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "test_6_monitor_for_notification End: %d\n", ret);
-  return ret;
-}
-}
diff --git a/tests/functional_tests/tests/test_atclient_notify.c b/tests/functional_tests/tests/test_atclient_notify.c
index 6b1a04cc..b98bf02a 100644
--- a/tests/functional_tests/tests/test_atclient_notify.c
+++ b/tests/functional_tests/tests/test_atclient_notify.c
@@ -143,6 +143,7 @@ exit: {
   atclient_free(&atclient1);
   atclient_atkeys_free(&atkeys);
   atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "End (%d)\n", ret);
+  mbedtls_psa_crypto_free();
   return ret;
 }
 }
@@ -192,9 +193,6 @@ static int test_1_notify(atclient *atclient, char *notification_id) {
   goto exit;
 
 exit: {
-  if (functional_tests_tear_down_sharedenckeys(atclient, ATKEY_SHAREDWITH) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed to tear down sharedenckeys: %d\n", ret);
-  }
   atclient_notify_params_free(&params);
   atclient_atkey_free(&atkey);
   atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "test_1_notify End (%d)\n", ret);
diff --git a/tests/functional_tests/tests/test_atclient_pkam_authenticate.c b/tests/functional_tests/tests/test_atclient_pkam_authenticate.c
index 7eb22add..bda62cda 100644
--- a/tests/functional_tests/tests/test_atclient_pkam_authenticate.c
+++ b/tests/functional_tests/tests/test_atclient_pkam_authenticate.c
@@ -34,6 +34,7 @@ int main() {
 
   free(path);
 
+  mbedtls_psa_crypto_free();
   return ret;
 }
 
@@ -81,6 +82,9 @@ static int test1_pkam_no_options(const char *path) {
 
 exit: {
   atclient_authenticate_options_free(&authenticate_options);
+  atclient_free(&atclient);
+  atclient_atkeys_free(&atkeys);
+  atclient_atkeys_file_free(&atkeys_file);
   return ret;
 }
 }
diff --git a/tests/functional_tests/tests/test_atclient_publickey.c b/tests/functional_tests/tests/test_atclient_publickey.c
index b5600355..8bb7830d 100644
--- a/tests/functional_tests/tests/test_atclient_publickey.c
+++ b/tests/functional_tests/tests/test_atclient_publickey.c
@@ -99,6 +99,7 @@ exit: {
   atclient_atkeys_free(&atkeys);
   atclient_free(&atclient);
   atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "End (%d)\n", ret);
+  mbedtls_psa_crypto_free();
   return ret;
 }
 }
@@ -161,6 +162,9 @@ static int test_2_get(atclient *atclient) {
 
   goto exit;
 exit: {
+  if (value != NULL) {
+    free(value);
+  }
   atclient_atkey_free(&atkey);
   atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "test_2_get End (%d)\n", ret);
   return ret;
@@ -306,7 +310,8 @@ static int test_6_get_with_metadata(atclient *atclient) {
   }
   atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "atkey.metadata.is_encrypted: %d\n", atkey.metadata.is_encrypted);
 
-  if (atclient_atkey_metadata_is_is_binary_initialized(&(atkey.metadata)) && atkey.metadata.is_binary != ATKEY_ISBINARY) {
+  if (atclient_atkey_metadata_is_is_binary_initialized(&(atkey.metadata)) &&
+      atkey.metadata.is_binary != ATKEY_ISBINARY) {
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "Failed is_binary comparison, got %d and expected %d\n",
                  atkey.metadata.is_binary, ATKEY_ISBINARY);
     goto exit;
@@ -424,4 +429,4 @@ exit: {
   atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "teardown End (%d)\n", ret);
   return ret;
 }
-}
\ No newline at end of file
+}
diff --git a/tests/functional_tests/tests/test_atclient_selfkey.c b/tests/functional_tests/tests/test_atclient_selfkey.c
index 6e1753c5..f5508a37 100644
--- a/tests/functional_tests/tests/test_atclient_selfkey.c
+++ b/tests/functional_tests/tests/test_atclient_selfkey.c
@@ -1,5 +1,6 @@
 #include "functional_tests/config.h"
 #include "functional_tests/helpers.h"
+#include "psa/crypto_extra.h"
 #include <atclient/atclient.h>
 #include <atclient/string_utils.h>
 #include <atlogger/atlogger.h>
@@ -102,6 +103,7 @@ exit: {
   atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "tear_down: %d\n", tear_down(&atclient));
   atclient_atkeys_free(&atkeys);
   atclient_free(&atclient);
+  mbedtls_psa_crypto_free();
   return ret;
 }
 }
@@ -185,6 +187,9 @@ static int test_3_get(atclient *atclient) {
   ret = 0;
   goto exit;
 exit: {
+  if (value != NULL) {
+    free(value);
+  }
   atclient_atkey_free(&atkey);
   atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "test_3_get End (%d)\n", ret);
   return ret;
@@ -288,8 +293,9 @@ static int test_7_get_with_metadata(atclient *atclient) {
     goto exit;
   }
 
-  if((ret = atclient_get_self_key_request_options_set_store_atkey_metadata(&request_options, true)) != 0) {
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atclient_get_self_key_request_options_set_store_atkey_metadata: %d\n", ret);
+  if ((ret = atclient_get_self_key_request_options_set_store_atkey_metadata(&request_options, true)) != 0) {
+    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR,
+                 "atclient_get_self_key_request_options_set_store_atkey_metadata: %d\n", ret);
     goto exit;
   }
 
@@ -313,7 +319,8 @@ static int test_7_get_with_metadata(atclient *atclient) {
   }
   atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "atkey.metadata.ttl: %d\n", atkey.metadata.ttl);
 
-  if (atclient_atkey_metadata_is_is_encrypted_initialized(&atkey.metadata) && atkey.metadata.is_encrypted != ATKEY_ISENCRYPTED) {
+  if (atclient_atkey_metadata_is_is_encrypted_initialized(&atkey.metadata) &&
+      atkey.metadata.is_encrypted != ATKEY_ISENCRYPTED) {
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "atkey.metadata.is_encrypted: %d != %d\n",
                  atkey.metadata.is_encrypted, true);
     ret = 1;
@@ -332,6 +339,7 @@ static int test_7_get_with_metadata(atclient *atclient) {
   ret = 0;
   goto exit;
 exit: {
+  free(value);
   atclient_atkey_free(&atkey);
   atclient_get_self_key_request_options_free(&request_options);
   atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_INFO, "test_7_get_with_metadata End (%d)\n", ret);
@@ -432,4 +440,4 @@ static int tear_down(atclient *atclient) {
   ret = 0;
   goto exit;
 exit: { return ret; }
-}
\ No newline at end of file
+}
diff --git a/tests/functional_tests/tests/test_atclient_sharedkey.c b/tests/functional_tests/tests/test_atclient_sharedkey.c
index 29c173f2..6a0bbd67 100644
--- a/tests/functional_tests/tests/test_atclient_sharedkey.c
+++ b/tests/functional_tests/tests/test_atclient_sharedkey.c
@@ -23,7 +23,7 @@ static int test_3_get_as_sharedwith(atclient *atclient);
 static int test_4_delete(atclient *atclient);
 static int test_5_should_not_exist_as_sharedby(atclient *atclient);
 
-int main(int argc, char *argv[]) {
+int main() {
   int ret = 1;
 
   atlogger_set_logging_level(ATLOGGER_LOGGING_LEVEL_DEBUG);
@@ -88,18 +88,11 @@ int main(int argc, char *argv[]) {
   goto exit;
 
 exit: {
-  if (functional_tests_tear_down_sharedenckeys(&atclient1, SECOND_ATSIGN) != 0) {
-    ret = 1;
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "tear_down: %d\n", ret);
-  }
-  if (functional_tests_tear_down_sharedenckeys(&atclient2, FIRST_ATSIGN) != 0) {
-    ret = 1;
-    atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "tear_down: %d\n", ret);
-  }
   atclient_free(&atclient1);
   atclient_atkeys_free(&atkeys1);
   atclient_free(&atclient2);
   atclient_atkeys_free(&atkeys2);
+  mbedtls_psa_crypto_free();
   return ret;
 }
 }
diff --git a/tests/functional_tests/tests/test_atclient_utils_find_atserver_address.c b/tests/functional_tests/tests/test_atclient_utils_find_atserver_address.c
index 84af379d..5f26662b 100644
--- a/tests/functional_tests/tests/test_atclient_utils_find_atserver_address.c
+++ b/tests/functional_tests/tests/test_atclient_utils_find_atserver_address.c
@@ -1,6 +1,7 @@
 #include <atclient/atclient_utils.h>
 #include <atlogger/atlogger.h>
 #include <functional_tests/config.h>
+#include <mbedtls/psa_util.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ -29,7 +30,10 @@ int main() {
   ret = 0;
   goto exit;
 
-exit: { return ret; }
+exit: {
+  mbedtls_psa_crypto_free();
+  return ret;
+}
 }
 
 static int test_1_find_atserver_address_should_pass() {
diff --git a/tests/functional_tests/tests/test_atkeys_write.c b/tests/functional_tests/tests/test_atkeys_write.c
index 7d7fa8a2..6ae9c70e 100644
--- a/tests/functional_tests/tests/test_atkeys_write.c
+++ b/tests/functional_tests/tests/test_atkeys_write.c
@@ -2,15 +2,15 @@
 #include <atclient/atkeys.h>
 #include <atclient/atkeys_file.h>
 #include <atlogger/atlogger.h>
-#include <string.h>
 #include <functional_tests/config.h>
 #include <functional_tests/helpers.h>
+#include <string.h>
 
 #define TAG "test_atkeys_write"
 
 #define ATKEYS_FILE_PATH_COPY "temp_key.atKeys"
 
-int main(int argc, char *argv[]) {
+int main() {
   int ret = 1;
 
   atlogger_set_logging_level(ATLOGGER_LOGGING_LEVEL_DEBUG);
@@ -27,7 +27,8 @@ int main(int argc, char *argv[]) {
   atclient_authenticate_options authenticate_options;
   atclient_authenticate_options_init(&authenticate_options);
 
-  if ((ret = functional_tests_set_up_atkeys(&atkeys, FIRST_ATSIGN)) != 0) { // populate `atkeys` from `~/.atsign/keys/@atsign_key.atKeys`
+  if ((ret = functional_tests_set_up_atkeys(&atkeys, FIRST_ATSIGN)) !=
+      0) { // populate `atkeys` from `~/.atsign/keys/@atsign_key.atKeys`
     atlogger_log(TAG, ATLOGGER_LOGGING_LEVEL_ERROR, "failed to populate atkeys from string\n");
     goto exit;
   }
@@ -116,9 +117,11 @@ int main(int argc, char *argv[]) {
   }
 
 exit: {
+  atclient_authenticate_options_free(&authenticate_options);
   atclient_atkeys_free(&atkeys);
   atclient_atkeys_free(&atkeys1);
   atclient_free(&atclient1);
+  mbedtls_psa_crypto_free();
   return ret;
 }
 }