How to fix Error 401 Permission denied for invalid PVE ticket

In this article, we shall discuss how to fix Error 401 Permission denied for invalid PVE ticket. The “Error 401: Permission denied – invalid PVE ticket” in Proxmox VE (PVE) often occurs during large uploads like your 13 GB file, due to session timeouts, ticket expiration, or incomplete uploads invalidating authentication tokens. Please, see how to Fix Authentication failed: Invalid credential after installing VSA, and how to Update Veeam Backup for Proxmox Plugin to support PVE 9.0.

FYI, as you can see below, we downloaded Veeam Software Appliance ISO and this is 12.3 GB which is approximately 13 GB.

Veeam requires users to log in to their account to download the Veeam Software Appliance (VSA) ISO file. There is no direct, public download link available without authentication. To access the download link (image) shared in the image above.

Also, see Create an NFS Storage on Synology NAS and Present it to XCP-ng, and how to run Mendeley Reference Manager and Cite for Word on Windows. Here is, how to resolve VSS Errors: Veeam AD Backups failing with SentinelOne.

How to Download Veeam VSA

Proceed to the  Veeam products download section. You will need to sign in to your Veeam account (My Veeam portal) using your credentials.

1. Find the VSA Download: Once logged in, go to the Product Downloads section and select the appropriate product. The VSA (Veeam Software Appliance) is an installation option within the main product ISO.
2. Download: Select the ISO file and start the download. 

But upon upload despite the number of tries, you will be prompted with the error message below. This is due to session timeouts leading to incomplete uploads invalidating authentication tokens.

Now that you have the image also downloaded and have a Proxmox environment, you can also reproduce this error.

Please, see Resolve Invalid Key ID when requesting BitLocker Recovery Key, How to configure Kerberos for Ansible Authentication, and A-Z on Veeam Data Cloud: Workload Enrollment and Onboarding.

Error 401 Permission denied – invalid PVE ticket Prompted

Reproducing the error after downloading the ISO, proceed to upload as shown below, The upload is in progress but we already know it will fail.

As you can see below, “Failed Reading Ticket: Connection closed before authentication”. Therefore, uploads via the web UI, the browser may stop sending keep‑alive requests. Once the session cookie expires, Proxmox rejects the upload.

As mentioned above, Veeam requires users to log in to their account to download the Veeam Software Appliance (VSA) ISO file. There is no direct, public download link available without authentication. As such, this download from URL will also fail.

Below is the output of the URL download and it failed despite task showing OK.

The below step is similar to the one above.

Please, see how to fix Error 1707: Network address invalid when trying to connect remotely, A real case of Internal Sabotage and Recovery, and Veeam Enterprise Manager setup and User Role management.

Quick Fix

Here is an alternative way to solve his issue “permission denied – invalid PVE ticket (401)” as discussed in the “Proxmox Forum“.

Restart key services on the PVE node (via SSH or console as root) using any of the commands below. This refreshes tickets and resolves most session issues without rebooting.

systemctl restart pvedaemon pveproxy

systemctl restart pvedaemon pveproxy

systemctl restart pvedaemon pveproxy pvestatd

systemctl restart pvedaemon pveproxy pvestatd

Note: Even when you login via the console to continue with the upload, this will not work as well.

If you wish to increase the timeout, edit the below. Ensure you create a backup first. Find ticket_timeout or csrf_timeout, and raise values (e.g., to 7200 seconds). Restart services after.

/etc/pve/pve-www.js

Please, see Building VIHR: Ransomware-Proof Repository with Veeam JeOS, how to fix Failed to connect to Deployer Service Error, and Upgrade legacy VHR to Veeam Infrastructure Hardened Repository.

Upload large files via SCP or rsync

Using SCP bypasses browser timeouts for large uploads like your 13 GB ISO. Connect securely from your local machine to the Proxmox server’s ISO storage path. Please, feel free to change the storage path just like I have done. I am currently using the NFS Share integrated with Proxmox. Please, see Add Synology NFS Storage to Proxmox VE for VMs and Backups, and how to Create an NFS Storage on Synology NAS and Present it to XCP-ng.

scp /path/to/your/largefile.iso root@your-pve-ip:/var/lib/vz/template/iso/

scp /path/to/your/largefile.iso root@your-pve-ip:/var/lib/vz/template/iso/

Enter password when prompted (or use SSH keys for automation). Progress shows transfer speed/ETA without no timeouts.

As you can see, the upload has completed successfully.

You cann also use rsync as shown below

rsync -avP bigfile.iso root@yourpve:/var/lib/vz/template/iso/

rsync -avP bigfile.iso root@yourpve:/var/lib/vz/template/iso/

Please, see Unable to Remove Orphaned VHR Repository v2 from VBR v13, What Ransomware Recovery looks like when the clock is ticking, and how to set up Devolusion Remote Desktop Manager on Windows.

Verify and Use in PVE GUI

To determine if the ISO is correctly uploaded. Please, refresh PVE web UI and navigate to Datacenter > NFS Storage > ISO Images and the ISO should be available as shown below.

Now, you can proceed with the installation of VSA v13. Please, see How to setup Veeam Software Appliance v13, and Upgrade legacy VHR to Veeam Infrastructure Hardened Repository.

FAQs

I hope you found this article on how to fix Error 401 Permission denied for invalid PVE ticket very useful. Please, feel free to leave a comment below.