Connect Your Infrastructure

ProxCenter connects to both Proxmox VE (PVE) hypervisors and Proxmox Backup Server (PBS) instances. You can add as many connections as you need -- ProxCenter supports multi-cluster environments out of the box.

Prerequisites

Before adding a connection, ensure:

Your Proxmox VE instance is version 7.0 or later
Your Proxmox Backup Server instance is version 3.0 or later
The ProxCenter server has network access to your Proxmox hosts
You have API credentials (API token recommended) or a valid username and password

Adding a Proxmox VE Connection

Log in to your ProxCenter dashboard
Navigate to Settings > Connections in the sidebar
Click Add Connection and select Proxmox VE
Fill in the connection details:

Field	Description	Example
Name	A friendly display name for this connection	`Production Cluster`
Hostname / IP	The address of your Proxmox VE host	`pve1.example.com` or `192.168.1.10`
Port	The Proxmox API port	`8006` (default)
Authentication	API token (recommended) or username/password	See below

Click Test Connection to verify connectivity
Click Save to add the connection

info

When you connect to a single node in a Proxmox cluster, ProxCenter automatically discovers all other nodes in that cluster. You only need to add one connection per cluster.

Adding a Proxmox Backup Server Connection

Navigate to Settings > Connections in the sidebar
Click Add Connection and select Proxmox Backup Server
Fill in the connection details:

Field	Description	Example
Name	A friendly display name	`Backup Server DC1`
Hostname / IP	The address of your PBS instance	`pbs1.example.com` or `192.168.1.20`
Port	The PBS API port	`8007` (default)
Authentication	API token (recommended) or username/password	See below

Click Test Connection to verify connectivity
Click Save to add the connection

Authentication Methods

API Token (Recommended)

API tokens are the preferred authentication method. They provide scoped access without exposing your main credentials, and they do not expire unless you configure them to.

Creating an API token on Proxmox VE:

# Create a token for the root user (full access)
pveum user token add root@pam proxcenter --privsep 0

The command outputs a Token ID and Secret. Save the secret immediately -- it is only shown once.

┌──────────────┬──────────────────────────────────────┐
│ key          │ value                                │
╞══════════════╪══════════════════════════════════════╡
│ full-tokenid │ root@pam!proxcenter                  │
│ info         │ {"privsep":"0"}                      │
│ value        │ xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx │
└──────────────┴──────────────────────────────────────┘

In ProxCenter, enter:

Token ID: root@pam!proxcenter
Token Secret: the value from the output above

tip

For production environments, consider creating a dedicated user with only the permissions ProxCenter needs instead of using root@pam. See the Proxmox documentation for details on creating users and roles.

Creating an API token on Proxmox Backup Server:

# Create a dedicated user
proxmox-backup-manager user create proxcenter@pbs --comment "ProxCenter service account"

# Generate an API token
proxmox-backup-manager user generate-token proxcenter@pbs proxcenter

# Grant permissions to the user AND to the token
proxmox-backup-manager acl update / Admin --auth-id proxcenter@pbs
proxmox-backup-manager acl update / Admin --auth-id 'proxcenter@pbs!proxcenter'

Save the token secret from the generate-token output, then enter the Token ID (proxcenter@pbs!proxcenter) and the Secret in ProxCenter.

PBS tokens inherit nothing

Unlike Proxmox VE, PBS has no privilege separation toggle: an API token never inherits ACLs from its user, and even a root@pam token starts with zero privileges. Always add an ACL entry for the token itself (the --auth-id containing the !tokenid part), not only for the user. The user's own permissions act as a ceiling, never as a source.

Proxmox Permissions

Using root@pam is the fastest way to test a lab environment. For production, create a dedicated Proxmox user and grant only the permissions required by the features you plan to use.

Feature	Required Permissions
View VMs/CTs	VM.Audit
Start/Stop/Restart	VM.PowerMgmt
Configure VMs	VM.Config.*
Snapshots	VM.Snapshot, VM.Snapshot.Rollback
Migration	VM.Migrate
Backups	VM.Backup
Storage	Datastore.Audit, Datastore.AllocateSpace
Node Info	Sys.Audit
Package updates	Sys.Modify (refresh package list; upgrade/reboot via SSH)
Node reboot/shutdown	Sys.PowerMgmt (node Reboot/Shutdown buttons, via API)
Console (VNC/SSH)	VM.Console + SSH access (PAM user)
Ceph	Sys.Audit on /

Dedicated production tokens

If you use a dedicated Proxmox user, keep Privilege Separation enabled on the token and assign permissions explicitly to that user or token. If you want the token to inherit all permissions from its user, disable privilege separation when creating the token.

PVEAdmin, Sys.Modify and Sys.PowerMgmt

The built-in PVEAdmin role grants almost everything except Sys.Modify and Sys.PowerMgmt. If you assign PVEAdmin to your service account, add both so Rolling Update can refresh the package list and the node Reboot/Shutdown buttons can power-cycle the host:

pveum role add ProxCenter -privs "Sys.Modify,Sys.PowerMgmt"
pveum aclmod / -user proxcenter@pve -role ProxCenter

If the ProxCenter role already exists, use pveum role modify ProxCenter -privs "Sys.Modify,Sys.PowerMgmt" instead of role add.

Rolling Update runs the package upgrade and its post-upgrade reboot over SSH. The standalone node Reboot/Shutdown actions use the Proxmox API instead, so they require Sys.PowerMgmt on the node path (this is why node reboots can fail with a permissions error even when the token has PVEAdmin).

SSH Access

Some ProxCenter features require SSH access to Proxmox nodes in addition to API access:

VM migration disk import and conversion
Rolling updates and maintenance workflows
CVE scanning and host-level diagnostics
Network flow collection and selected SDN operations

Configure SSH credentials only for trusted ProxCenter administrators. Use a dedicated key and restrict sudoers rules to the commands required by your operational policy.

PBS Permissions

Grant one of the following on /, always to both the user and the token (PBS tokens inherit nothing, see the warning above):

Scope	Role(s) on `/`	What works
Full integration	`Admin`	Everything, including vDC backup auto-binding and job management
Read-only monitoring	`DatastoreReader` + `Audit`	Datastores, backups, jobs and server status, without any write action

DatastoreReader alone is not enough: it carries the datastore privileges but not Sys.Audit, so backups would show up while server status, services, disks and update information stay empty. Adding the Audit role fills that gap:

proxmox-backup-manager acl update / DatastoreReader --auth-id proxcenter@pbs
proxmox-backup-manager acl update / DatastoreReader --auth-id 'proxcenter@pbs!proxcenter'
proxmox-backup-manager acl update / Audit --auth-id proxcenter@pbs
proxmox-backup-manager acl update / Audit --auth-id 'proxcenter@pbs!proxcenter'

In MSP deployments, per-vDC PBS namespaces are provisioned automatically with scoped sub-tokens and ACLs so tenant backups remain isolated. This automation is what requires the Admin role: creating namespaces needs Datastore.Modify and setting ACLs needs Permissions.Modify, which no other built-in role carries.

Username and Password

You can also authenticate with a Proxmox username and password. This is simpler to set up but less secure than API tokens:

Passwords may be subject to rotation policies
No way to scope permissions specifically for ProxCenter
Multi-factor authentication on the Proxmox account may interfere

warning

If your Proxmox account uses two-factor authentication (2FA), you must use an API token instead. Username/password authentication does not support 2FA.

Connection Verification

After adding a connection, ProxCenter immediately performs a verification:

Connectivity check -- Confirms the host is reachable on the specified port
Authentication check -- Validates the provided credentials
Discovery -- Enumerates nodes, VMs, containers, and storage on the connected host

Once verified, your infrastructure appears in the dashboard within seconds. ProxCenter continuously syncs data from your connected hosts at regular intervals.

Multi-Cluster Support

ProxCenter is built for multi-cluster environments. You can connect:

Multiple independent Proxmox VE clusters
Multiple Proxmox Backup Server instances
A mix of PVE and PBS connections

All connected infrastructure is accessible from the unified dashboard. You can filter views by cluster, node, or connection to focus on specific parts of your environment.

Next Steps

Now that your Proxmox infrastructure is connected, explore the dashboard and start managing your environment.

Prerequisites​

Adding a Proxmox VE Connection​

Adding a Proxmox Backup Server Connection​

Authentication Methods​

API Token (Recommended)​

Proxmox Permissions​

SSH Access​

PBS Permissions​

Username and Password​

Connection Verification​

Multi-Cluster Support​

Next Steps​