API Key missing?

[DRO34]

Hello, not sure if i am just not seeing it or its not added to proxcenter.. Under the datacenter section, I do not see the ability to create an API key? Can you please tell me where it is? if its not there, add to a future release? Thanks.

on the host its located under datacenter > permissions.

[krotname]

I checked the current code and it looks like ProxCenter does not create a Proxmox-side API token from Datacenter -> Permissions.

The PVE connection flow expects an existing token: apiToken is required for PVE/PBS connections and stored as apiTokenEnc. The connection dialog also has a setup guide that tells you to create it outside ProxCenter, for example with pveum user token add proxcenter@pve proxcenter-token --privsep=0, then add ACLs with pveum aclmod.

So the current flow is:

1. Create the token in native Proxmox UI under Datacenter -> Permissions -> API Tokens, or run pveum user token add ....
2. Grant the needed ACL/role in Proxmox.
3. Paste user@realm!tokenid=secret into ProxCenter's connection settings.

If you mean creating the Proxmox token directly from ProxCenter's Datacenter page, that appears to be missing right now and would need a new feature.

[DRO34]

Right, I understand the Initial setup obviously has to be done in proxmox. But once that is done there are needs for API keys for other things after the initial connection. So it would be nice to have that in Proxcenter so I don’t need to go to Proxmox to create other api keys. It should be available in the UI.

[adminsyspro]

Thanks for the follow-up, that clarifies things.

This is actually a deliberate design decision rather than a missing feature: ProxCenter intentionally does not create or manage Proxmox API tokens, users, or ACLs, and we plan to keep it that way.

The main reason is least privilege. To mint tokens and assign ACLs on your behalf, ProxCenter's own service token would need identity and permission management rights on the cluster (think User.Modify, Permissions.Modify, realm management) on top of what it uses today. That is a large increase in what a single stored credential could do if it were ever compromised, it would go from "manage the infrastructure" to "create permanent access and change who is allowed to do what". We would rather keep that capability out of ProxCenter entirely.

There are two related reasons:

• Audit and attribution. When tokens are created in Proxmox, the Proxmox audit log stays the single source of truth for who minted which access. Routing it through ProxCenter's service token would make everything show up under one identity.
• Secrets handling. A token secret is only shown once at creation, so an in-app minter would turn ProxCenter into a place that has to display and broker secrets, which is a security posture we deliberately avoid.

For the one-time connection setup, the Connection dialog already includes a setup guide with the exact pveum user token add ... and pveum aclmod ... commands so it is quick to copy and paste. For any additional tokens you need for other tools, the native Datacenter > Permissions > API Tokens view (or pveum) remains the right place to create them, and that keeps everything in one auditable spot.

Appreciate the suggestion, and thanks for taking the time to explain the use case.

[DRO34]

Thanks for extra detail. I guess it makes sense since you can expose the proxcenter UI to the public, if someone doesn't know how to properly harden it, you can easily expose that..