Aprox signs in to Proxmox with either a password or an API token, in any realm your server offers. Which method you choose decides whether you can open consoles and whether background features such as alerts and widgets can reach the server. This article explains both methods, two-factor authentication and how Aprox shows the sign-in state of each server.

Where to find it

  • Choose the method when you add a server: Add Server › Authentication › Method.
  • Change it later: long-press or right-click the server in the sidebar › Edit (Android: Edit Server).
  • Sign in: tap the server in the sidebar, then its Sign in row.

Choose a method

Password API Token
How you sign in Your Proxmox password A token name and its secret
Session Proxmox issues a ticket valid for two hours; Aprox renews it automatically Tokens do not expire unless you set an expiry in Proxmox
Console (Aprox Pro) Yes No. Proxmox does not accept API tokens for console access. The Console tab shows "Console needs a password login".
Rights The user's rights The user's rights, or a separate, smaller set if the token is privilege-separated
Background features (alerts, widgets that control guests, Siri and Shortcuts, watch) Only with a saved password Yes; the secret is always saved on the device
Two-factor Asked after the password, if the account uses it Not asked

Use a password if you need the console. Use an API token if you want a sign-in that never prompts and can be limited to exactly the rights Aprox needs. See Create an API token.

Sign in with a password

  1. Tap the server in the sidebar, then tap Sign in.
  2. Enter the Password.
  3. Optional: turn on Save password to Keychain.
  4. Tap Login.

With Save password to Keychain on, Aprox stores the password on this device after the server has accepted it. A password the server rejected is never stored. If you turn the switch off, the saved password is deleted right away.

On Android the option has the same name; the password is kept in encrypted storage on the device.

Sign in with an API token

  1. Edit the server and set Method to API Token.
  2. Enter the Username (without realm), choose the Realm, and enter the Token name and Token secret. The read-only Token ID shows the full ID, user@realm!tokenname, for example root@pam!aprox.
  3. Tap Save, then tap the server in the sidebar. Aprox connects with the stored secret.

If no secret is stored yet, the sign-in screen shows the token ID and a Token secret field. Enter the secret and tap Connect.

When you edit a server that already has a token, the field reads Token secret (unchanged). Leave it empty to keep the stored secret, or enter a new one to replace it.

Pick a realm

The realm tells Proxmox which authentication source to check: for example pam (Linux users on the node), pve (Proxmox VE's own users), pbs (Backup Server's own users), or an LDAP, Active Directory or OpenID realm you set up.

  1. In the server editor, tap Refresh realms from server.
  2. Choose the realm from the Realm list.

Before you load the list, it offers pam plus pve for Proxmox VE or pbs for a Backup Server. Loading the realms is also the first time Aprox contacts the server, so the certificate prompt can appear here. See Self-signed certificates.

Enter a two-factor code

If your Proxmox account uses two-factor authentication (TFA), Aprox asks for a code after the password.

  1. Sign in with your password. The screen shows Two-factor authentication required.
  2. Choose the Method:
    • TOTP: the six-digit code from your authenticator app;
    • Recovery: one of your Proxmox recovery keys;
    • Yubico OTP: the one-time password from your YubiKey.
  3. Enter the Code.
  4. Tap Verify.

Tap Cancel to stop signing in. If the sidebar shows Enter TFA code ("Open to verify") under a server, tap that row to get back to the code screen.

Important

Aprox cannot answer a two-factor prompt in the background. Alerts, widgets, Siri and Shortcuts and the watch app cannot sign in to a server that requires a code. Sign in in the app first, or use an API token for these features.

Automatic sign-in

  • At launch, Aprox signs in by itself to every server with a saved password.
  • A server that uses an API token signs in without asking as soon as you open it.
  • A password ticket lasts two hours; Aprox renews it while you use the app.
  • Without a saved password, you enter the password each time Aprox starts.

Check the sign-in state

Each server row in the sidebar shows its state on the right:

Indicator Meaning
Green dot Connected
Spinner Connecting
Orange key Two-factor code required
Orange lock Certificate not trusted
Red triangle Connection failed
Gray dot Not connected

While a server is not signed in, its expanded section shows one row that tells you what to do next:

  • Sign in — "Tap to log in";
  • Enter TFA code — "Open to verify";
  • Certificate not trusted — "Open to review the fingerprint";
  • Sign-in failed — with the reason, for example "Proxmox rejected the credentials for this server."

Good to know

  • To sign out, long-press or right-click the server and choose Logout (Android: Log Out). See Edit, sign out or remove a server.
  • "Proxmox rejected the credentials for this server." means a wrong password, a deleted or expired token, or the wrong realm.
  • Passwords and token secrets stay on this device. They are not synced to your other devices or included in device backups. See Privacy and security.