VoIP.info Guide

PBX credentials and extension secrets

Keep administrator, handset, trunk and backup identities separate and retire them deliberately.

Reviewed 2026-10-30Foundational

Different secrets grant different authority

A handset secret permits an endpoint relationship. A trunk credential can permit chargeable service. Administrative access can change the entire platform. Backup credentials can expose configuration and other stored data. Reusing one secret across these roles increases the consequence of a single compromise.

Provision without broad disclosure

Use unique strong secrets and a controlled provisioning process. Do not store them in screenshots, public issue reports or ordinary call-flow diagrams. Restrict configuration exports and remove temporary copies after their authorized purpose ends.

Track ownership

Maintain an inventory of account owner, device or service, permission scope and rotation/revocation procedure. Shared-area phones need an accountable owner even when no employee is named on the device.

Revoke completely

When staff or contractors leave, review forwarding, voicemail, remote access and management permissions as well as the visible extension name. Rotate relevant credentials and verify that retired devices cannot re-register. A factory reset of one handset does not invalidate copies of its secret elsewhere.

Handle FreePBX API secrets as distinct credentials

A FreePBX API client secret, access token and refresh token are different records from an administrator password or SIP authentication secret. The API applications guide uses fingerprints and application IDs for diagnostics without copying raw credentials into logs.

Rotate AMI secrets through the true configuration owner

The AMI login diagnostic preserves the exact authentication mode while keeping secret, key and challenge material out of records.

Keep TelVox API keys and SIP passwords in separate controls

TelVox API keys are unscoped server credentials, while each trunk has a separate SIP password and WSS seats expose a long-lived password to the browser. The provider record sets distinct storage, delivery, logging and rotation boundaries.

Correlate authentication events without exposing secrets

The security-event guide preserves account, service, session and address evidence while keeping credentials and challenge material out of routine reports.

Keep CURL credentials out of URLs and logs

The Asterisk CURL guide records option names and redacted outcomes without exposing cookies, authorization headers, user-password strings or key passphrases.

Classify validation evidence without logging secrets

The input-parsing diagnostic records lengths and redacted result classes instead of raw credentials or headers.

Treat AMI auth rows as secret-bearing records

The AMI auth-evidence guide requires field-level redaction, restricted access and bounded retention.

Treat Linphone provisioning tokens as revocable credentials

The Linphone provisioning guide separates token or OAuth authorization, downloaded XML, local account state and SIP credentials so one exposure is not “fixed” at the wrong layer.

Match Linphone AuthInfo without exposing secrets

The Linphone registration guide separates username or user ID, realm or domain, password or HA1 and algorithm while preserving a redacted challenge sequence.

Separate Allstream portal and SIP credentials

The Allstream guide keeps portal access, U.S. digest credentials, IP-match addresses and PBX administration as distinct secrets and identities.

Keep Cloudli user and authentication identities separate

The Cloudli guide separates User ID, Authentication ID, SIP password, portal access and PBX administration, with secrets excluded from evidence.

Keep Vodafone portal, SIP and PBX identities separate

The Vodafone Evolved Voice guide keeps account access, signaling trust, Teams administration and PBX credentials independently attributable.

Separate Swisscom portal, SBC and PBX identities

The Swisscom Enterprise SIP guide keeps My Swisscom Business access, SBC trust and PBX administration independently attributable.

Separate Sunrise portal, peer and PBX identities

The Sunrise Business Voice SIP guide does not turn a dated no-credential peer example into a universal credential policy.

Separate Proximus portal, CPE, SBC and PBX identities

The Proximus Business Trunking guide avoids inventing one shared credential or authentication model.

Do not expose voicemail data with manager credentials

The AMI voicemail message operations guide uses a dedicated least-privilege manager identity and redacts personal message evidence.

Protect Crazytel passwords and QR codes

The Crazytel SIP trunk diagnostic records field meaning and exchange results without exposing SIP secrets.

Protect MaxoTel portal and SIP identities separately

The MaxoTel SIP Trunking guide records field meaning, retrieval time and transaction outcome without exposing either password.

Keep secrets out of exec command lines and logs

The include diagnostic preserves command and output evidence without publishing credentials.

Separate MyAussie, supplier and SIP identities

The Aussie Broadband SIP Trunks guide records credential purpose and ownership without copying secrets from adjacent VoIP products.

Do not interchange Wave portal, SIP and identity-provider secrets

The Grandstream Wave diagnostic identifies credential purpose and owner before any reset or QR reissue.

Preserve RingCentral organization and authentication ownership

The RingCentral diagnostic distinguishes identity, organization selection, entitlement, extension and session before any password reset.

Separate Symbio portal, API and SIP identities

The Symbio Enterprise SIP Trunking guide records credential purpose and owner without transferring secrets between products or customers.

Separate Telstra admin, CPE and SIP identities

The Telstra SIP Connect diagnostic records each credential purpose and owner without transferring values between products or sites.

Separate Optus identities and control passwords

The Optus Evolve Voice diagnostic records PBX identity, administrative access and diversion control without inventing a universal authentication model.

Separate One NZ portal and SIP identities

The One NZ SIP diagnostic records portal users, PBX identity and administrative access without inventing a universal authentication model.

Do not invent a 2degrees authentication model

The 2degrees SIP diagnostic retrieves the implementation pack before assigning credentials, source trust or certificates.

Do not invent one Vocus authentication model

The Vocus SIP Voice diagnostic retrieves the implementation pack before assigning registration, source trust, passwords or certificates.

Do not invent one Superloop authentication model

The Superloop diagnostic retrieves the implementation record before assigning credentials or source trust.

Separate Zoom sign-in from Phone entitlement and extension assignment

The Zoom Workplace diagnostic proves account, SSO or other sign-in path, active user, license and extension before any password reset.

Preserve Enreach portal and SIP identities separately

The Enreach diagnostic compares user ID, authentication name, password owner, profile and loaded state.

Confirm Nextiva product and tenant before credential changes

The NextivaONE diagnostic preserves NextivaONE versus NEXT, tenant, user, voice assignment and failing response before reset.

Confirm Teams tenant and account before identity changes

The Teams Phone diagnostic preserves tenant, cloud, user, license, voice enablement and failing state before reset.

Confirm Dialpad company, office and user before reset

The Dialpad app diagnostic freezes company, office, user, product, line and failing state before sign-out or reinstall.

Keep MetTel portal and trunk secrets separate

The MetTel SIP trunk diagnostic retrieves account-specific values through the authorized order and support path without exposing credentials.

Keep NUSO portal, partner and trunk authority separate

The NUSO diagnostic retrieves account-specific values through authorized records without exposing credentials.

Keep Telesystem portal and SIP credentials scoped

The Telesystem diagnostic uses authorized read-only evidence without publishing passwords.

Keep TPx portal and trunk secrets scoped

The TPx diagnostic uses authorized account records without publishing credentials or treating portal access as SIP proof.

Keep Lingo account and trunk secrets scoped

The Lingo diagnostic uses authorized implementation records without publishing secrets or treating portal access as SIP proof.

Keep Voyant portal and trunk secrets scoped

The Voyant diagnostic uses authorized order and account records without publishing secrets.

Confirm the 8x8 tenant and user before reset

The 8x8 Work diagnostic freezes tenant, user, extension, license, client and failing state before sign-out or reinstall.

Confirm the VBC user and selected extension before reset

The VBC diagnostic freezes account, user, extension, client and failing state before sign-out or reinstall.

Keep Windstream portal and trunk identities scoped

The Windstream diagnostic uses authorized order and implementation records without publishing reusable values.

Confirm Aircall company, user and line assignment before reset

The Aircall diagnostic freezes identity, role, assigned number and client state before credential or assignment changes.

Keep Granite portal and trunk identities scoped

The Granite diagnostic uses authorized agreement and implementation records without publishing reusable values.

Scope FirstLight PBX and portal identities

The FirstLight guide keeps customer PBX security, provider records and reusable credentials separated.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.