These must be run on one of the nodes directly logged in as the service account (or an account that has access to the QlikClient certificate and its private key).
The X-Qlik-User header value must be updated by a user name that is a RootAdmin in Qlik Sense.