September 2026
Connecting to Qlik Cloud with an OAuth client
A profile can authenticate with an OAuth client instead of a per-tenant API key. Set -SenseAuthMode QlikCloudOrg and give the profile the client id and secret; QOps exchanges them for an access token against the tenant and renews it before it expires, holding it in memory for the length of the run and never writing it to disk.
Create the client under OAuth in the Qlik Cloud management console and give it the trusted consent method — without it the tenant refuses to issue a token. Any client type that issues a secret will do. The client is a subject of its own, so it lists the applications it has been granted access to and nothing else.
Where a token cannot be issued, QOps now reports what the tenant answered rather than listing what might be wrong.
A Qlik Cloud profile in the Portal's environment editor now chooses between ApiKey and QlikCloudOrg, the same two names QOps-Configure offers. Choosing QlikCloudOrg asks for the OAuth client id and secret instead of an API key; the secret is write-only, as the other credentials are, so the editor shows only whether one is stored.
Saving a command with its flags
The same command is often run two or three settled ways. A bookmark is one of those ways, saved: a command, the flags you had set on it, and a name you choose. Set the flags under Flags / Options, open Bookmarks beside that heading and name them; the bookmark then pins to the panel like any other button and runs that command with those flags. Pinning and unpinning a bookmark happens in that same Bookmarks dialog; All commands lists commands, and says how many of your pins are bookmarks so the count there adds up.
A flag the command does not take is refused when you save it, and the message says which — a saved entry is run later and often by somebody who did not make it, so that is the moment to say so. Bookmarks are kept beside your pinned commands, outside the Portal directory, so they survive an update.
The Portal has one health endpoint
GET /api/v2/health is now the only health route. The unversioned GET /health and GET /api/v2/health/detailed were removed on 2026-09-17, the date they had been announcing in their Sunset header since the deprecation. Both returned the same body as the surviving route, so a caller that switches reads exactly what it read before.
If something still calls one of them it now gets a 404. The replacement is a straight substitution of the path. One thing to check if you are moving off /api/v2/health/detailed: its dependency keys were pwsh and qops, and on /api/v2/health they are powershell and qops-module.
Fixes
- The order of keys in a file does not depend on the machine. Sorting no longer follows the machine's language settings, so a repository written on any Windows language — and from either edition of PowerShell — serializes the same way.
- A command that writes to its output and its error stream at the same instant is collected safely, and the run it belongs to carries on.
- Each operation runs with the flags you set for it. Every run, preview and confirmation reads the flags belonging to the operation you pressed.
- Sheets keep their published state when you build to Qlik Cloud. A sheet the repository holds as published is published in the application the build writes to, rather than arriving private — see Sheet visibility on Qlik Cloud.
- Request and response detail in the log is now behind
-VerboseLog. A default run logs the summary lines only, so a log is shorter than you may be used to; add the flag to get the detail back.