VoIP.infoThe independent guide to business communications.
VoIP.info Protocol reference

SIP authentication: challenges and modern digest support

Understand the difference between a normal challenge, failed credentials and an unsupported algorithm.

Reviewed 2026-10-24Foundational

A challenge is part of the protocol

A SIP server can challenge a request before accepting it. The client responds using its configured identity and secret under the requested authentication scheme. A challenge followed by success is expected behavior; repeated challenges need closer inspection.

401 challenges concern the receiving server, while 407 is associated with proxy authentication. The relevant authorization header and realm must match the challenge. Do not assume the public extension number is always the carrier's authentication username.

Registration: isolate transport from authentication
If REGISTER never reaches the server, check DNS, transport and firewall. If the server challenges, inspect the authenticated retry. A 200 response confirms registration, after which calls need separate testing.

A first 401 challenge can be normal. Read the response to the authenticated retry before changing credentials.

Check algorithm compatibility

RFC 8760 updates SIP digest authentication to support stronger algorithms including SHA-256 and SHA-512/256. Actual support depends on both endpoints and their software versions. A legacy handset may have limitations that a current PBX configuration exposes.

Prefer a compatible modern configuration rather than silently downgrading policy to make an old device register. Consult the exact PBX and handset documentation and plan replacement when secure interoperability cannot be maintained.

Diagnose without exposing secrets

Compare the username, realm, request destination and supported algorithms using sanitized records. Verify the secret locally through the authorized administration path. A digest exchange is not a reason to publish a raw capture; metadata and authentication material remain sensitive.

Separate an account lock or disabled service from a typing mistake. Provider-side policy can reject otherwise correctly formed requests.

Authentication is not call authorization

A registered extension may still be forbidden from particular destinations. Keep route permissions and carrier account limits in the investigation. Successful authentication does not justify allowing unrestricted outbound calling or management access.

Locate the Twilio 403 before changing authentication

A Twilio 403 on the first digest-less INVITE and a 403 on the authenticated retry after 407 point to different policy stages. Follow the termination diagnostic before rotating credentials or widening an ACL.

Keep DIDforSale credentials separate from source authorization

The DIDforSale guide distinguishes SIP-account activation and digest credentials from a portal-approved IP or FQDN record.

Keep Zadarma credentials separate from confirmed-source authorization

The Zadarma guide distinguishes SIP-login credentials from a portal-confirmed static public address.

Use the observed Voxbeam public source as authorization evidence

The Voxbeam diagnostic compares the portal value with the translated source observed on one transaction.

Use the selected GoTrunk endpoint model as the identity boundary

The GoTrunk diagnostic compares the saved source or credential identity with one observed transaction.

Separate DIDWW authentication from Caller ID and destination authorization

The DIDWW guide does not turn an authenticated INVITE into proof that the requested CLI or destination is permitted.

Do not blend Exotel API, SIP digest and registration

The Exotel guide separates API Basic Auth from SIP ACL or digest and records that the current India trunk interface does not use REGISTER.

Keep Voximplant application users and saved registrations distinct

The Voximplant guide assigns separate credential owners and state to endpoint users and platform-to-provider registrations.

Keep registered and IP-authenticated FreeSWITCH gateways distinct

The FreeSWITCH profiles and gateways guide separates REGED, intentional NOREG, OPTIONS reachability and provider acceptance.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.

Continue your research

Hub

SIP reference

Understand registration, call setup and response codes in the context of the request and call leg.

Explore topic →
Guide

How VoIP works

Follow call setup and audio separately to understand why a ringing phone can still have no sound.

Read guide →
Hub

VoIP troubleshooting

Use symptoms and evidence to isolate registration, routing, media and device faults.

Explore topic →
Troubleshooting · Current Twilio Elastic SIP Trunking configuration, troubleshooting, sending-SIP, CredentialList, Trunk-resource and error-32201 documentation reviewed October 14, 2026; the sources distinguish Termination URI identification, DNS and edge selection, IP ACL and credential authentication, 407 challenge flow, E.164 addressing, caller identity and later account policy, but do not prove one account, trunk, ACL, credential list, source address, DNS answer, route, caller identity, permission, capacity state, packet, media stream or completed call, and none was inspected or tested

Twilio termination call gets no response or 403 Forbidden

Separate Termination URI and DNS reachability from initial-INVITE ACL rejection, post-407 credential failure, E.164 addressing, caller identity, geographic permission and capacity policy.

Read guide →
Provider research · Current DIDforSale IP-interconnection, SIP-account, FreePBX PJSIP, product and customer-agreement pages plus the current Asterisk chan_sip status page were reviewed October 22, 2026. The current account, portal worksheet, order and installed PBX documentation govern where a public example differs. No DIDforSale account, portal role, IP or FQDN record, termination flag, SIP account, credential, registration, DNS answer, gateway, DID route, source packet, international-calling setting, limit, PBX, firewall, call, media stream, emergency call, bill, price, availability, compatibility or support response was inspected or tested

DIDforSale SIP trunking: IP authorization, registration, gateways and DID routing evidence

Separate portal-approved IP or FQDN interconnection, SIP-account registration, outbound termination enablement, multiple inbound gateway sources, DID format and PBX routing.

Read guide →
Troubleshooting · Current DIDforSale IP-interconnection, SIP-account, FreePBX PJSIP, product and customer-agreement pages plus the current Asterisk chan_sip status page were reviewed October 22, 2026. The current account, portal worksheet, order and installed PBX documentation govern where a public example differs. No DIDforSale account, portal role, IP or FQDN record, termination flag, SIP account, credential, registration, DNS answer, gateway, DID route, source packet, international-calling setting, limit, PBX, firewall, call, media stream, emergency call, bill, price, availability, compatibility or support response was inspected or tested

DIDforSale has split inbound calls, no outbound calls or the wrong registration route

Trace one DIDforSale failure through interconnection model, portal state, registration or source authorization, gateway receipt, DID format, PBX route and media.

Read guide →
Provider research · Current Zadarma SIP-trunk, IP-authorization, SIP-URI, caller-ID, FreePBX PJSIP, Asterisk and echo-test pages were reviewed October 22, 2026. The current account, number order, portal state and installed PBX documentation govern where a public example differs. No Zadarma account, SIP login, credential, static address, address confirmation, registration, number, SIP URI, caller-ID authorization, provider source, PBX, firewall, certificate, packet, media stream, call, echo test, emergency call, bill, price, availability, compatibility or support response was inspected or tested

Zadarma SIP trunking: registration, IP authorization, SIP URI and caller-ID evidence

Separate credential registration, confirmed static-IP authorization, inbound SIP-URI delivery, caller-ID ownership, PBX routing and media evidence.

Read guide →
Troubleshooting · Current Zadarma SIP-trunk, IP-authorization, SIP-URI, caller-ID, FreePBX PJSIP, Asterisk and echo-test pages were reviewed October 22, 2026. The current account, number order, portal state and installed PBX documentation govern where a public example differs. No Zadarma account, SIP login, credential, static address, address confirmation, registration, number, SIP URI, caller-ID authorization, provider source, PBX, firewall, certificate, packet, media stream, call, echo test, emergency call, bill, price, availability, compatibility or support response was inspected or tested

Zadarma registration, IP authorization, SIP URI or caller ID is wrong

Trace one Zadarma failure through connection model, address confirmation or registration, number destination, signaling identity, PBX route and media.

Read guide →
Provider research · Current Voxbeam help, FAQ, DID, service, network and codec pages plus the provider Asterisk example and current Asterisk driver guidance were reviewed October 22, 2026. The account portal, current rate deck, active DID records and installed PBX documentation govern where a public example differs. No Voxbeam account, authorized source address, trunk, route class, prefix, DID, endpoint URI, channel setting, caller identity, PBX, module, firewall, packet, call, codec, fax, media stream, emergency call, bill, price, availability, compatibility or support response was inspected or tested

Voxbeam SIP trunking: source-IP authorization, route prefixes, DID endpoints and Asterisk boundaries

Separate outbound source authorization, route-class prefixing, trunk and DID destinations, channel limits, PBX driver translation and media evidence.

Read guide →
Troubleshooting · Current Voxbeam help, FAQ, DID, service, network and codec pages plus the provider Asterisk example and current Asterisk driver guidance were reviewed October 22, 2026. The account portal, current rate deck, active DID records and installed PBX documentation govern where a public example differs. No Voxbeam account, authorized source address, trunk, route class, prefix, DID, endpoint URI, channel setting, caller identity, PBX, module, firewall, packet, call, codec, fax, media stream, emergency call, bill, price, availability, compatibility or support response was inspected or tested

Voxbeam source IP, route prefix, DID endpoint or Asterisk driver is wrong

Trace one Voxbeam symptom through public-source authorization, route prefix, DID override, ingress acceptance, loaded PBX objects and media.

Read guide →
Provider research · Current GoTrunk endpoint, PBX, setup, location, CDR, rate and support pages plus current Asterisk PJSIP and FreePBX 17 migration guidance were reviewed October 23, 2026. The selected account, portal values, installed PBX release and loaded objects remain authoritative where examples differ. No GoTrunk account, endpoint, credential, authorized address, registration, point of presence, number, location, route, PBX, module, firewall, packet, CDR, call trace, media stream, emergency call, rate, invoice, availability, compatibility or support response was inspected or tested

GoTrunk SIP trunking: static-IP, registration, point-of-presence, DID routing and current-PBX boundaries

Separate static-source authorization, credential registration, POP selection, telephone-number assignment, loaded FreePBX or Asterisk objects and call evidence.

Read guide →
Troubleshooting · Current GoTrunk endpoint, PBX, setup, location, CDR, rate and support pages plus current Asterisk PJSIP and FreePBX 17 migration guidance were reviewed October 23, 2026. The selected account, portal values, installed PBX release and loaded objects remain authoritative where examples differ. No GoTrunk account, endpoint, credential, authorized address, registration, point of presence, number, location, route, PBX, module, firewall, packet, CDR, call trace, media stream, emergency call, rate, invoice, availability, compatibility or support response was inspected or tested

GoTrunk static IP, registration, POP, DID route or FreePBX driver is wrong

Trace one GoTrunk failure through endpoint identity, registration Contact, POP selection, number assignment, loaded PBX objects, CDR evidence and media.

Read guide →
Provider research · Current DIDWW inbound routing, registration, connectivity, failover, call-log, outbound authentication, Caller ID and emergency documentation was reviewed October 23, 2026. Account configuration, current DNS answers, selected Points of Presence, installed PBX objects, assigned numbers, eligibility, limits and commercial terms remain deployment specific. No DIDWW account, trunk, credential, registration, Contact, address, DNS answer, Point of Presence, DID, Caller ID, emergency record, PBX, firewall, packet, CDR, call, media stream, price, availability, compatibility or support response was inspected or tested

DIDWW SIP trunking: inbound routing, registration, outbound authentication and Caller ID evidence

Separate inbound Static Endpoint and Dynamic Registration delivery from outbound source, digest, dialing, Caller ID, encryption and attempt evidence.

Read guide →
Troubleshooting · Current DIDWW inbound routing, registration, connectivity, failover, call-log, outbound authentication, Caller ID and emergency documentation was reviewed October 23, 2026. Account configuration, current DNS answers, selected Points of Presence, installed PBX objects, assigned numbers, eligibility, limits and commercial terms remain deployment specific. No DIDWW account, trunk, credential, registration, Contact, address, DNS answer, Point of Presence, DID, Caller ID, emergency record, PBX, firewall, packet, CDR, call, media stream, price, availability, compatibility or support response was inspected or tested

DIDWW static endpoint, registration, outbound authentication or Caller ID is wrong

Trace one DIDWW failure through direction, inbound destination, Contact, source and digest selection, Caller ID policy, provider attempt and PBX evidence.

Read guide →
Provider research · Current Exotel SIP Trunking developer and docs portals were reviewed October 23, 2026. Account, KYC, region, trunk, number, flow, destination, network, entitlement and commercial state remain deployment specific. No Exotel account, API credential, SIP credential, trunk, Exophone, mapping, flow, applet, destination, address, DNS answer, PBX, SBC, firewall, packet, Call SID, call, media stream, capacity, price, availability, compatibility or support response was inspected or tested

Exotel Dynamic SIP Trunking: object model, call directions and evidence boundaries

Map Exotel product, REST management, trunk, number mode, flow, destination, authorization, signaling, media and rate-limit evidence without treating one state as proof of another.

Read guide →
Troubleshooting · Current Exotel SIP Trunking developer and docs portals were reviewed October 23, 2026. Account, KYC, region, trunk, number, flow, destination, network, entitlement and commercial state remain deployment specific. No Exotel account, API credential, SIP credential, trunk, Exophone, mapping, flow, applet, destination, address, DNS answer, PBX, SBC, firewall, packet, Call SID, call, media stream, capacity, price, availability, compatibility or support response was inspected or tested

Exotel trunk is active but inbound, outbound or audio fails

Trace one failed Exotel transaction through direction, trunk state, number mode, Flow, destination, source or digest authorization, signaling and media.

Read guide →
Provider research · Current Voximplant SIP, application, routing-rule, scenario, call-event, application-event, SIP-registration API and VoxEngine-limit documentation was reviewed October 23, 2026. Account configuration, current DNS answers, selected proxies, registration state, application and rule order, deployed scenario version, phone numbers, PSTN or external-SIP routes, limits, pricing, availability and commercial terms remain deployment specific. No Voximplant account, application, rule, scenario, registration, credential, proxy, allowlist, DNS answer, PBX, firewall, packet, call, event stream, media stream, price, availability, compatibility or support response was inspected or tested

Voximplant SIP: registration, routing-rule, call-leg and media-event evidence

Trace PBX ingress or a saved SIP registration through the matched application rule, deployed scenario, created call leg and explicit media evidence.

Read guide →
Troubleshooting · Current Voximplant SIP, application, routing-rule, scenario, call-event, application-event, SIP-registration API and VoxEngine-limit documentation was reviewed October 23, 2026. Account configuration, current DNS answers, selected proxies, registration state, application and rule order, deployed scenario version, phone numbers, PSTN or external-SIP routes, limits, pricing, availability and commercial terms remain deployment specific. No Voximplant account, application, rule, scenario, registration, credential, proxy, allowlist, DNS answer, PBX, firewall, packet, call, event stream, media stream, price, availability, compatibility or support response was inspected or tested

Voximplant SIP registration, routing rule, call leg or media event is wrong

Find the first divergence across registration state, application binding, rule order, scenario execution, created leg, answer and explicit media events.

Read guide →
Guide · Current SignalWire-maintained installation, module, CLI, SIP-profile and diagnostic documentation was reviewed October 24, 2026. The documented package and source paths, vanilla configuration and command examples do not prove a supported operating-system combination, installed build, enabled module, secured listener, capacity, recoverability or accepted call. No host, repository account, token, package, compiler, module, configuration, endpoint, packet, media stream, backup, restore, price, support entitlement or call was inspected or tested.

FreeSWITCH installation: packages, source, modules and first-call proof

Choose one reproducible installation path, record the effective module and configuration baseline, and prove a restricted first call before exposing service.

Read guide →
Guide · Current SignalWire-maintained SIP-profile, gateway, registration, call-setup, diagnostic, trace and CLI documentation was reviewed October 24, 2026. Shipped profile names and defaults are configuration examples, not security guarantees or proof of an installed listener. No profile, socket, certificate, gateway, credential, provider account, registration, dialplan, packet, call, media stream, price, availability, compatibility or support response was inspected or tested.

FreeSWITCH SIP profiles and gateways: listeners, trust and trunk state

Keep Sofia profile listeners, directory identities, gateway definitions, registration, dialplan authority and observed call behavior as separate evidence.

Read guide →
Guide · Current SignalWire-maintained codec, media-handling, channel-variable, SIP-profile, trace and audio-troubleshooting documentation was reviewed October 24, 2026. Codec and media-mode capabilities do not prove module load, negotiation, transcoding, NAT reachability, SRTP protection, audio quality or capacity. No host, module, endpoint, SDP, packet, capture, recording, conference, benchmark, media stream, price, compatibility or call was inspected or tested.

FreeSWITCH media and codecs: prove each negotiated RTP path

Compare full media, proxy media and bypass media while retaining per-leg codec, SDP, address, security and packet evidence.

Read guide →
Guide · Current SignalWire-maintained SIP-profile, TLS, Event Socket, CLI, diagnostic, registration and trace documentation was reviewed October 24, 2026. Shipped bindings, credentials and verification defaults are documentation values, not a secure deployment baseline. No host, firewall, ACL, listener, certificate, private key, credential, module, Event Socket, endpoint, provider account, packet, backup, restore, penetration test, price, compatibility or call was inspected or tested.

FreeSWITCH security: bound listeners, trust, control and recovery

Secure Sofia, dialplan, TLS, Event Socket, modules and restore paths as separate control boundaries with runtime evidence.

Read guide →
Troubleshooting · Current SignalWire-maintained gateway, Sofia-profile, diagnostic, call-setup, trace and events documentation was reviewed October 24, 2026. Gateway state names and command examples require verification on the installed build and profile. No switch, profile, gateway, credential, provider account, DNS answer, firewall, registration, OPTIONS exchange, packet, call, media stream, failover event, price, availability, compatibility or support response was inspected or tested.

FreeSWITCH gateway down: registration, ping, route or upstream failure

Separate Sofia gateway lifecycle, OPTIONS reachability, dialplan selection, SIP response, hangup cause and media evidence before changing a trunk.

Read guide →