Setting up Qlik Data Gateway - Direct Access

Last updated: 9/18/2026

You can set up Qlik Data Gateway - Direct Access either on a Windows server or in a containerized environment. For successful setup, ensure you are familiar with the prerequisites, installation instructions, limitations, and considerations for your specific setup workflow.

Setup workflows

Choose one of the following workflows:

System prerequisites

Software requirements

Refer to one of the following depending on your setup method:

Windows server: Software prerequisites
Containerized: Software requirements

Common requirements

These requirements are applicable to both Windows server and containerized installations.

Required ports and protocols

The following section lists the required ports.

Outbound ports

HTTPS/TCP-443 should be opened for outbound communication to <tenant-id>.<region>.qlikcloud.com.

Internal ports

Below is a list of ports used for communication by internal data gateway processes. If any of these ports is being used by another application, reconfigure the other application or uninstall it.

General ports

5050 (Connector Agent REST API)
9027 (DCAAS REST API)

ODBC ports

3005 (ODBC Connector REST API)
50260 (ODBC Connector gRPC)

SAP ports

3015 (SAP BW Connector REST API)
50270 (SAP BW Connector gRPC)
3025 (SAP SQL Connector REST API)
50280 (SAP SQL Connector gRPC)
3035 (SAP ODP Connector REST API)
50290 (SAP ODP Connector gRPC)
3035 (SAP Package Connector REST API)
50290 (SAP Package Connector gRPC)

REST ports

3055 (REST Connector REST API)
50310 (REST Connector gRPC)

File ports

3045 (File Connector REST API)
50300 (File Connector gRPC)

WSS protocol

In addition to HTTPS, Direct Access gateway also uses WSS (WebSocket Secure) protocol. Therefore, make sure that your firewall and proxy server (if you intend to use one) are set up to allow outbound WSS connections.

Recommended hardware

Refer to one of the following depending on your setup method:

Windows server: Recommended hardware
Containerized: Recommended hardware

System crytography (Windows server installation only)

See System cryptography.

Installing Qlik Data Gateway - Direct Access

Stage one: Download Qlik Data Gateway - Direct Access

Refer to one of the following depending on your setup method:

Windows server: Stage one: Download Qlik Data Gateway - Direct Access
Containerized: Stage one: Download Qlik Data Gateway - Direct Access

Stage two: Install or deploy Direct Access gateway

Refer to one of the following depending on your setup method:

Windows server: Stage two: Install Direct Access gateway on a server behind the firewall protecting your data sources
Containerized: Stage two: Start the deployment by running the Docker Compose file

Stage three: Set up Direct Access gateway

This stage includes setting your Qlik Cloud tenant URL, optionally setting a proxy server, and generating a registration key. You will need to copy the key to the data gateway settings in the Administration activity center (in stage three below). The key is used to establish an authenticated connection between the Direct Access gateway and the Qlik Cloud tenant.

Connecting to a Qlik Anonymous tenant (Sweden region) is not supported.

Starting from Direct Access gateway 1.7.16, Canada region is now supported. Select the Canada region during deployment in the Administration activity center when deploying the gateway setup file.

On the Direct Access gateway machine, do one of the following depending on your installation workflow:

Windows server: Open a Command Prompt as an administrator and change the working directory to the ConnectorAgent subfolder (C:\Program Files\Qlik\ConnectorAgent\ConnectorAgent with a default installation).
Containerized: Open a console inside the direct-access-agent container.

Then, continue as described below.

Setting the Qlik Cloud tenant

Set which Qlik Cloud tenant to connect to. To connect to the tenant via a proxy server, add the relevant parameters to the command as shown below.

Commands for setting the Qlik Cloud tenant without a proxy server:

Windows server installation
- Syntax: connectoragent qcs set_config --tenant_url your-qlik-cloud-tenant-url
- Example: connectoragent qcs set_config --tenant_url mytenant.us.qlikcloud.com
Containerized installation
- Syntax: dotnet ConnectorAgent.dll qcs set_config --tenant_url your-qlik-cloud-tenant-url
- Example: dotnet ConnectorAgent.dll qcs set_config --tenant_url mytenant.us.qlikcloud.com

Commands for setting the Qlik Cloud tenant with a proxy server:

Windows server installation
- Syntax: connectoragent qcs set_config --tenant_url your-qlik-cloud-tenant-url --proxy_url http://host:port --proxy_username username --proxy_password password
- Example: connectoragent qcs set_config --tenant_url mytenant.us.qlikcloud.com --proxy_url http://myproxy:1212 --proxy_username admin --proxy_password f56weqs@
Containerized installation
- Syntax: dotnet ConnectorAgent.dll qcs set_config --tenant_url your-qlik-cloud-tenant-url --proxy_url http://host:port --proxy_username username --proxy_password password
- Example: dotnet ConnectorAgent.dll qcs set_config --tenant_url mytenant.us.qlikcloud.com --proxy_url http://myproxy:1212 --proxy_username admin --proxy_password f56weqs@

For information on proxy limitations, see Connecting to Qlik Cloud via a proxy server.

Setting the CA bundle

The CA bundle authenticates the identity of the Qlik Cloud tenant, thereby ensuring a trusted connection.

Who needs to set the CA bundle?

The CA bundle only needs to be set if you are:

A Qlik Cloud Government customer
A Qlik Cloud commercial customer using a security appliance that acts as a proxy and replaces the certificate information received from the Internet with its own CA root certificates

Which bundle should I use?

Customers should either use the Qlik CA bundle or bring their own CA bundle, as follows:

Qlik provides the CA bundle: Should be used by Qlik Cloud Government customers with a standard environment. A standard environment is an environment that does not have a security appliance that acts as a proxy and replaces the certificate information received from the Internet with its own CA root certificates.

In a default Direct Access gateway installation, the CA bundle file can be found in the following location:
- Windows server installation: C:\Program Files\Qlik\ConnectorAgent\caBundle\qcg_ca_bundle.pem
- Containerized installation: /usr/share/Qlik/Gateway/ssl/qcg_ca_bundle.pem
Information noteYou can rename the CA bundle file, but make sure that it has a .pem extension (for example, qlikcerts.pem). Then, run the command(s) described below.
Customers bring their own CA bundle: Should be used if the customer's environment is using a security appliance that acts as a proxy and replaces the certificate information received from the Internet with its own CA root certificates. If those certificates are self-signed, then in addition to the command for setting the CA bundle, you also need to run the command for allowing the CA bundle. Both of these commands are described below. This applies to both Qlik Cloud Government customers and Qlik Cloud commercial customers alike.

Command for setting the CA bundle

Run the following command to set the CA certificate bundle:

Syntax (Windows server installation):

connectoragent qcs set_config --ca_bundle_path path-to-ca-bundle-file

Syntax (containerized installation):

dotnet ConnectorAgent.dll qcs set_config --ca_bundle_path path-to-ca-bundle-file

Example (Windows server installation):

connectoragent qcs qcs set_config --ca_bundle_path c:\ca\cacerts.pem

Example (containerized installation):

dotnet ConnectorAgent.dll qcs set_config --ca_bundle_path c:\ca\cacerts.pem

Command for allowing the CA bundle

Some environments use a security appliance that acts as a proxy and replaces the certificate information received from the Internet with its own CA root certificates. This command only needs to be run if the security appliance itself uses a self-signed certificate. In such a case, the CA bundle might not be trusted unless you run the following command:

Windows server installation:

connectoragent qcs set_config --ca_bundle_allow_invalid_certs true
Containerized installation:

dotnet ConnectorAgent.dll qcs set_config --ca_bundle_allow_invalid_certs true

If you are not sure whether your environment is using such a security appliance, please contact your IT administrator.

Generating and showing the registration key

The key is used to establish an authenticated connection between the Direct Access gateway and the Qlik Cloud tenant.

Commands for generating the registration key

Windows server installation:

connectoragent qcs generate_keys
Containerized installation:

dotnet ConnectorAgent.dll qcs generate_keys

Commands for showing the registration key

dotnet ConnectorAgent.dll qcs get_registration

Windows server installation:

connectoragent qcs get_registration
Containerized installation:

dotnet ConnectorAgent.dll qcs get_registration

The key is shown.

Copy the entire key as shown in the example above. You will need to paste it into the Administration activity center in the next stage.

Stage four: Register the data gateway

The next step is to register the data gateway. This can be done either through the Administration activity center or on the command line.

Option 1: Via the Administration activity center

Registering a Direct Access gateway automatically creates an Identify provider (Multi-cloud) entry in the Administration activity center, for secure gateway-to-tenant communication. The Identity provider description includes the gateway ID (issuer gateway_id), which allows you easily locate the associated gateway in the Data gateways section (of the Administration activity center). Deleting the gateway Identity provider will disconnect the gateway so you should only do this if you are absolutely sure the gateway is no longer required. If you accidentally deleted the Identity provider, restarting the Direct Access gateway will restore the entry and reconnect the gateway.

In the Administration activity center, select Data gateways.

Any existing data gateways will be listed in a table showing basic information about each gateway.
Click the Create toolbar button.

The Create data gateway dialog opens.
Specify a name for the data gateway.
Optionally, provide a description for the data gateway.
From the data gateway type drop-down list, select Direct Access.
From the Associated space drop-down list, select a space.

When associating the Direct Access gateway with a space, you should be aware of the following:
- Data gateways can be created in shared or managed spaces only
- To create a data connection in one space that uses a data gateway from another space, you must have the Can consume data role in the data gateway space.
- To create a data gateway, you must be a space owner or have the Can manage role. For user-based subscriptions, you also need a Professional entitlement. For more information, see Managing user entitlements.
- Data gateways can be associated with a single space only.
Paste the registration key you generated earlier into the Key field.
Click Create.

The data gateway is added enabled to the Data gateways list.

Option 2: Automatic registration using the command line

You can also register Direct Access gateway automatically from the command line, without using the Administration activity center.

For instructions, see one of the following depending on your installation workflow:

Windows server installation: Option 2: Automatic registration using the command line
Containerized installation: Option 2: Automatic registration using the command line

Stage five: Start the Qlik Data Gateway - Direct Access service on the Direct Access gateway server

Next, you need to start the Qlik Data Gateway - Direct Access service.

Refer to one of the following depending on your setup method:

Windows server installation: Stage five: Start the Qlik Data Gateway - Direct Access service on the Direct Access gateway server
Containerized installation: Stage five: Start the Qlik Data Gateway - Direct Access service on the Direct Access gateway server

Stage six: Add a connection to your data source

Locate your gateway in the Data gateways list and verify that its State is “Connected” (you might need to refresh your browser to see the current status). You can then proceed to add a connection to your data source.

There are several ways you can load data from data sources:

The list of available data sources will contain duplicate entries for those data sources that support gateway connectivity. Gateway-compliant data sources can be identified by the words "via Direct Access gateway”, which appear in parenthesis after the source type.

Gateway-compliant source connection example

The Add data connection dialog for Gateway-compliant data sources has an extra Direct Access gateway field that allows you to select which gateway to use.

General limitations and considerations

Direct Access gateway can connect to a single tenant only.
If, for any reason, the Direct Access gateway server is rebooted during a Qlik application reload, the reload will fail. Restart the Qlik application reload to refresh the data.
Reload script queries cannot exceed 500,000 characters.

For information on reloading scripts, see Running scripts.

Did this page help you?

If you find any issues with this page or its content – a typo, a missing step, or a technical error – please let us know!

Leave your feedback here