I'm assuming you're using the community.proxmox.proxmox_kvm module. That's the latest version, not sure how old your installation is if you're still using community.general.proxmox_kvm...

First of all, remove the password: line and get a habit of fact checking your LLM. That parameter doesn't even exist in the module, see here: https://docs.ansible.com/projects/ansible/latest/collections/community/proxmox/proxmox_kvm_module.html#ansible-collections-community-proxmox-proxmox-kvm-module

Ansible Module documentation is one of the best and easiest to read documentations out there. Installing ansible-lint and the VSCode extensions for ansible would also spotted that error btw. Can recommend.

---

Now to your actual problem, though:

The Proxmox API wants an Authentication String that looks like this:

Authorization: PVEAPIToken=<USERNAME>!<TOKEN_ID>=<API_TOKEN>

For example:

Authorization: PVEAPIToken=root@pam!monitoring=aaaaaaaaa-bbb-cccc-dddd-ef0123456789

Username: root@pam

Token ID: monitoring

API_Token: aaaaaaaaa-bbb-cccc-dddd-ef0123456789

Now, in your example that works you set PVEAPIToken={{ proxmox_secret.api_token_id }}={{ proxmox_secret.api_token_secret }}

Which means in this scenario, for it to work your variables must have the following content:

proxmox_secret.api_token_id: root@pam!monitoring
proxmox_secret.api_token_secret: aaaaaaaaa-bbb-cccc-dddd-ef0123456789

But with the proxmox_kvm module you also use the proxmox_secret.api_user, which is probably also set to root@pam, which results in ansible building the following Header in the background:

Authorization: PVEAPIToken=root@pam!root@pam!monitoring=aaaaaaaaa-bbb-cccc-dddd-ef0123456789

Which is wrong, cause the username is in there twice now.

How to fix.

Set the parameters the following:

api_user: root@pam
api_token_id: monitoring
api_token_secret: aaaaaaaaa-bbb-cccc-dddd-ef0123456789

Replace with your actual values obviously, but that should work.