A challenge is part of the protocol
A SIP server can challenge a request before accepting it. The client responds using its configured identity and secret under the requested authentication scheme. A challenge followed by success is expected behavior; repeated challenges need closer inspection.
401 challenges concern the receiving server, while 407 is associated with proxy authentication. The relevant authorization header and realm must match the challenge. Do not assume the public extension number is always the carrier's authentication username.
A first 401 challenge can be normal. Read the response to the authenticated retry before changing credentials.
Check algorithm compatibility
RFC 8760 updates SIP digest authentication to support stronger algorithms including SHA-256 and SHA-512/256. Actual support depends on both endpoints and their software versions. A legacy handset may have limitations that a current PBX configuration exposes.
Prefer a compatible modern configuration rather than silently downgrading policy to make an old device register. Consult the exact PBX and handset documentation and plan replacement when secure interoperability cannot be maintained.
Diagnose without exposing secrets
Compare the username, realm, request destination and supported algorithms using sanitized records. Verify the secret locally through the authorized administration path. A digest exchange is not a reason to publish a raw capture; metadata and authentication material remain sensitive.
Separate an account lock or disabled service from a typing mistake. Provider-side policy can reject otherwise correctly formed requests.
Authentication is not call authorization
A registered extension may still be forbidden from particular destinations. Keep route permissions and carrier account limits in the investigation. Successful authentication does not justify allowing unrestricted outbound calling or management access.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.