diff --git a/src/grib_api_internal.h b/src/grib_api_internal.h
index cf8bc3be2..c103badb4 100644
--- a/src/grib_api_internal.h
+++ b/src/grib_api_internal.h
@@ -23,36 +23,36 @@ extern "C" {
 
 /* cmake config header */
 #ifdef HAVE_ECCODES_CONFIG_H
-#include "eccodes_config.h"
+ #include "eccodes_config.h"
 #endif
 
 /* autoconf config header */
 #ifdef HAVE_CONFIG_H
-#include "config.h"
-#ifdef _LARGE_FILES
-#undef _LARGE_FILE_API
-#endif
+ #include "config.h"
+ #ifdef _LARGE_FILES
+  #undef _LARGE_FILE_API
+ #endif
 #endif
 
 #ifndef GRIB_INLINE
-#define GRIB_INLINE
+ #define GRIB_INLINE
 #endif
 
 /* See ECC-670 */
 #if IS_BIG_ENDIAN
-#if GRIB_MEM_ALIGN
-#define FAST_BIG_ENDIAN 1
-#else
-#define FAST_BIG_ENDIAN 0
-#endif
+ #if GRIB_MEM_ALIGN
+  #define FAST_BIG_ENDIAN 1
+ #else
+  #define FAST_BIG_ENDIAN 0
+ #endif
 #endif
 
 #if IEEE_BE
-#define IEEE
+ #define IEEE
 #else
-#if IEEE_LE
-#define IEEE
-#endif
+ #if IEEE_LE
+  #define IEEE
+ #endif
 #endif
 
 #include <stdio.h>
@@ -62,48 +62,49 @@ extern "C" {
 #include "eccodes_windef.h"
 
 #ifndef ECCODES_ON_WINDOWS
-#include <dirent.h>
-#include <unistd.h>
-#include <inttypes.h>
-#define ecc_snprintf snprintf
+ #include <dirent.h>
+ #include <unistd.h>
+ #include <inttypes.h>
+ #define ecc_snprintf snprintf
 #else
-#include <direct.h>
-#include <io.h>
+ #define strtok_r strtok_s
+ #include <direct.h>
+ #include <io.h>
 
-/* Replace C99/Unix rint() for Windows Visual C++ (only before VC++ 2013 versions) */
-#if defined _MSC_VER && _MSC_VER < 1800
-double rint(double x);
-#endif
+ /* Replace C99/Unix rint() for Windows Visual C++ (only before VC++ 2013 versions) */
+ #if defined _MSC_VER && _MSC_VER < 1800
+  double rint(double x);
+ #endif
 
-#ifndef S_ISREG
-#define S_ISREG(mode) (mode & S_IFREG)
-#endif
+ #ifndef S_ISREG
+  #define S_ISREG(mode) (mode & S_IFREG)
+ #endif
 
-#ifndef S_ISDIR
-#define S_ISDIR(mode) (mode & S_IFDIR)
-#endif
+ #ifndef S_ISDIR
+  #define S_ISDIR(mode) (mode & S_IFDIR)
+ #endif
 
-#ifndef M_PI
-#define M_PI 3.14159265358979323846
-#endif
+ #ifndef M_PI
+  #define M_PI 3.14159265358979323846
+ #endif
 
-#define R_OK 04 /* Needed for Windows */
+ #define R_OK 04 /* Needed for Windows */
 
-#ifndef F_OK
-#define F_OK 0
-#endif
+ #ifndef F_OK
+  #define F_OK 0
+ #endif
 
-#define mkdir(dirname, mode) _mkdir(dirname)
+ #define mkdir(dirname, mode) _mkdir(dirname)
 
-#ifdef _MSC_VER
-#define access(path, mode) _access(path, mode)
-#define chmod(path, mode) _chmod(path, mode)
-#define strdup(str) _strdup(str)
-#endif
+ #ifdef _MSC_VER
+  #define access(path, mode) _access(path, mode)
+  #define chmod(path, mode) _chmod(path, mode)
+  #define strdup(str) _strdup(str)
+ #endif
 
-#define ecc_snprintf _snprintf
+ #define ecc_snprintf _snprintf
 
-#endif
+#endif /* ifndef ECCODES_ON_WINDOWS */
 
 
 #include <limits.h>
@@ -113,9 +114,9 @@ double rint(double x);
 
 
 #ifdef HAVE_STRING_H
-#include <string.h>
+ #include <string.h>
 #else
-#include <strings.h>
+ #include <strings.h>
 #endif
 
 /*
diff --git a/src/grib_context.c b/src/grib_context.c
index 5d3d92ac8..cf87e2994 100644
--- a/src/grib_context.c
+++ b/src/grib_context.c
@@ -16,7 +16,6 @@
 #include <unistd.h>
 #else
 #include <fcntl.h> /* Windows: for _O_BINARY */
-#define strtok_r strtok_s
 #endif
 
 #ifdef ENABLE_FLOATING_POINT_EXCEPTIONS
diff --git a/src/grib_db.c b/src/grib_db.c
index 6ecf1f2f8..c55be2f3c 100644
--- a/src/grib_db.c
+++ b/src/grib_db.c
@@ -607,6 +607,7 @@ static grib_order_by* grib_db_new_order_by(grib_context* c, char* obstr)
     char *t1 = 0, *t2 = 0, *p = 0;
     int id  = 0;
     char *z = 0, *zs       = 0;
+    char* lasts = NULL;
     int mode, mode_default = GRIB_ORDER_BY_ASC;
     grib_order_by *ob, *sob;
 
@@ -628,7 +629,7 @@ static grib_order_by* grib_db_new_order_by(grib_context* c, char* obstr)
     ob->mode  = 0;
     ob->next  = 0;
 
-    t1 = strtok(z, ",");
+    t1 = strtok_r(z, ",", &lasts);
 
     while (t1) {
         grib_trim(&t1);
@@ -651,7 +652,7 @@ static grib_order_by* grib_db_new_order_by(grib_context* c, char* obstr)
         }
         grib_trim(&t2);
         id = -1;
-        t1 = strtok(NULL, ",");
+        t1 = strtok_r(NULL, ",", &lasts);
 
         if (ob->key) {
             ob->next = (grib_order_by*)grib_context_malloc(c, sizeof(grib_order_by));
diff --git a/src/grib_dumper_class_bufr_encode_fortran.c b/src/grib_dumper_class_bufr_encode_fortran.c
index 31205ea85..5de032183 100644
--- a/src/grib_dumper_class_bufr_encode_fortran.c
+++ b/src/grib_dumper_class_bufr_encode_fortran.c
@@ -11,10 +11,6 @@
 #include "grib_api_internal.h"
 #include <ctype.h>
 
-#if defined(ECCODES_ON_WINDOWS)
-#define strtok_r strtok_s
-#endif
-
 /*
    This is used by make_class.pl
 
diff --git a/src/grib_fieldset.c b/src/grib_fieldset.c
index 794993b55..5c104405e 100644
--- a/src/grib_fieldset.c
+++ b/src/grib_fieldset.c
@@ -25,10 +25,6 @@
 #define GRIB_ORDER_BY_ASC 1
 #define GRIB_ORDER_BY_DESC -1
 
-#if defined(ECCODES_ON_WINDOWS)
-#define strtok_r strtok_s
-#endif
-
 /* Note: A fast cut-down version of strcmp which does NOT return -1 */
 /* 0 means input strings are equal and 1 means not equal */
 GRIB_INLINE static int grib_inline_strcmp(const char* a, const char* b)
diff --git a/src/grib_util.c b/src/grib_util.c
index 6112468c4..af1c950a4 100644
--- a/src/grib_util.c
+++ b/src/grib_util.c
@@ -13,10 +13,6 @@
 
 #define STR_EQUAL(s1, s2) (strcmp((s1), (s2)) == 0)
 
-#if defined(ECCODES_ON_WINDOWS)
-#define strtok_r strtok_s
-#endif
-
 typedef enum
 {
     eROUND_ANGLE_UP,
@@ -1944,11 +1940,11 @@ static void set_value(grib_values* value, char* str, int equal)
 
 /*
  'grib_tool'        Optional tool name which is printed on error. Can be NULL
- 'arg'              The string to be parsed e.g. key1=value1,key2!=value2 etc
+ 'arg'              The string to be parsed e.g. key1=value1,key2!=value2 etc (cannot be const)
  'values_required'  If true then each key must have a value after it
  'default_type'     The default type e.g. GRIB_TYPE_UNDEFINED or GRIB_TYPE_DOUBLE
  'values'           The array we populate and return (output)
- 'count'            The number of elements (output)
+ 'count'            Number of elements (output). Must be initialised to the size of the values array
  */
 int parse_keyval_string(const char* grib_tool,
                         char* arg, int values_required, int default_type,
@@ -1961,6 +1957,9 @@ int parse_keyval_string(const char* grib_tool,
         *count = 0;
         return GRIB_SUCCESS;
     }
+    /* Note: strtok modifies its input argument 'arg'
+     * so it cannot be 'const'
+     */
     p = strtok_r(arg, ",", &lasts);
     while (p != NULL) {
         values[i].name = (char*)calloc(1, strlen(p) + 1);
diff --git a/src/string_util.c b/src/string_util.c
index d9223fa74..9ba818b97 100644
--- a/src/string_util.c
+++ b/src/string_util.c
@@ -10,10 +10,6 @@
 
 #include "grib_api_internal.h"
 
-#if defined(ECCODES_ON_WINDOWS)
-#define strtok_r strtok_s
-#endif
-
 /* Compare two strings ignoring case.
  * strcasecmp is not in the C standard. However, it's defined by
  * 4.4BSD, POSIX.1-2001. So we use our own