From 5b0c81a1a873c448534fa53fe40175f15730cd56 Mon Sep 17 00:00:00 2001
From: Clint Branham <goodolclint@gmail.com>
Date: Tue, 17 Mar 2026 19:14:03 -0500
Subject: [PATCH] fix(auth): use TryAddWithoutValidation for Authorization
 header

.NET's HttpHeaders.Add() validates the Authorization header value
against the HTTP spec, rejecting PVE's custom PVEAPIToken scheme
that contains @, !, and = in the token string.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/PSProxmoxVE.Core/Client/PveHttpClient.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/PSProxmoxVE.Core/Client/PveHttpClient.cs b/src/PSProxmoxVE.Core/Client/PveHttpClient.cs
index 8672c2a..992ece9 100644
--- a/src/PSProxmoxVE.Core/Client/PveHttpClient.cs
+++ b/src/PSProxmoxVE.Core/Client/PveHttpClient.cs
@@ -280,7 +280,7 @@ namespace PSProxmoxVE.Core.Client
 
             if (_session.AuthMode == PveAuthMode.ApiToken)
             {
-                request.Headers.Add("Authorization", $"PVEAPIToken={_session.ApiToken}");
+                request.Headers.TryAddWithoutValidation("Authorization", $"PVEAPIToken={_session.ApiToken}");
             }
             else
             {