Documented steps

POST /access/ticket with form params username (e.g. root@pam), password, and optionally realm and otp. URL-encode the password.
Read the response data object: {ticket, CSRFPreventionToken, username, clustername?}.
Send the ticket on every subsequent request as a cookie named exactly PVEAuthCookie, value = the ticket string.
For any write request (POST, PUT, DELETE), ALSO send the header CSRFPreventionToken: <value from login>. GET requests do not need it.
Renew before expiry by POSTing to /access/ticket again with the still-valid ticket as the 'password' value and the same username — this issues a fresh ticket without re-sending the password.
If the realm enforces two-factor auth, the initial call returns a challenge; respond by POSTing /access/ticket again with tfa-challenge set to the returned challenge string plus otp for a TOTP code.

Known gotchas

Tickets expire after 2 hours. Long-running agents must renew or they will start getting 401s mid-job. The cluster-wide signing key also rotates once per day.
Forgetting the CSRFPreventionToken header on writes produces a 401 even though the cookie is valid — the symptom looks like an auth failure, not a CSRF failure.
The cookie name is case-sensitive and must be PVEAuthCookie. Sending the ticket as a Bearer token does not work.
Prefer API tokens for automation. Tickets exist mainly for interactive sessions and for the console endpoints (vncproxy/termproxy/spiceproxy) that tokens are barred from.
Too many failed second-factor attempts locks the factor out: 8 failed TOTP attempts disables the user's TOTP (recoverable only via a recovery key); WebAuthn/recovery-key limits are higher (100).
Self-signed certificate by default — see the API token route for handling.
Source: https://pve.proxmox.com/wiki/Proxmox_VE_API (Ticket Cookie), https://pve.proxmox.com/pve-docs/chapter-pveum.html (Two-Factor Authentication).

developer.stockx.com · 5 steps · unrated

Authenticate to the AMCS Platform REST API with a Personal Access Token and pin a component version before making calls

amcsplatform.github.io · 5 steps · unrated

Authenticate and pull reality capture site data from NavVis IVION via its REST API

knowledge.navvis.com · 5 steps · unrated

Give your agent this knowledge — and 16,400+ more routes

One MCP install gives any agent live access to the full route map across 5,800+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Authenticate to the Proxmox VE REST API with a login ticket and CSRF token when API tokens are not usable (e.g. console access)

Documented steps

Known gotchas

Related routes

Give your agent this knowledge — and 16,400+ more routes

Need this verified for your stack — or a route we don't have yet?