Hey Team,

This release ships API Policy Tokens, which let you define exactly what a token can do, action by action, instead of handing it a bundle of permissions and trusting it to only use the ones it needs. We are also extending the CLI with more agent-facing commands and adding a wave of new blueprints to the catalog.

🔐 API Policy Tokens: permissions down to the capability

Roles group permissions together, so a token scoped to modify an environment can often also delete it. A human can judge in the moment whether that extra reach is safe to use. A token held by an AI agent or a Terraform runner cannot, so teams were stuck accepting broader access than the job needed or building their own guardrails on top of our API.

API Policy Tokens fix this by moving authorization from a role to a policy. The policy is written in Rego and evaluated by Open Policy Agent (OPA) on every request, so you decide exactly which actions, resources, and methods a token can touch. This fits Qovery because it is the difference between granting a workload a role and granting it only the specific capability it was built for, whether that workload is an agent, a script, or a CI pipeline. Actions taken with the token are also attributed separately in the audit log.

Read the full story on why roles alone are not enough for agent-held tokens.

🖥️ More CLI commands for agents

Agents driving the CLI need to check their own access before acting, not just run commands blind. We added:

  • qovery auth status: check the status of the current authentication
  • qovery organization list: see which organizations the current token can reach
  • qovery api spec: fetch the API spec, then use qovery api ENDPOINT_NAME to hit any endpoint the CLI does not wrap yet

More agent-facing commands are coming.

📦 More Qovery blueprints

Teams building on Qovery keep reaching for the same handful of third-party services, so we expanded the blueprint catalog with Datadog, Cloudflare DNS Zone, Cloudflare Workers, MongoDB Atlas, and more. Blueprints exist to save you from wiring these up by hand, so growing the catalog means more of a complete infrastructure is ready out of the box, on any cloud provider.

More Qovery blueprints
More Qovery blueprints

🛠️ Minor updates

  • Fixed a Copilot UI issue that made it impossible to expand or close the Copilot panel.
  • Fixed the deployment behavior for a single service marked as "to skip," which was not being skipped correctly.
  • Added support for PostgreSQL 18.
  • Karpenter now supports configuring spot instances per node pool, giving finer control over which workloads run on spot capacity.

As always, let us know what you think and what you would like to see next.

Talk soon, The Qovery Team 🚀