Hi, I can't find out why i get a 401 Unauthorized. How can you help me to resolve and allow inbound calls ?

Hi there! 👋 I'd be happy to help you troubleshoot that 401 Unauthorized error with your BYO SIP Trunk. I don't have specific details about your particular setup, but I can definitely provide some general troubleshooting guidance for this common issue. Based on the information I have, a 401 Unauthorized error typically indicates an authentication problem with your SIP trunk. Here are some key troubleshooting steps: ## Understanding the Error A 401 Unauthorized error means that the initial request was missing valid authentication credentials. Vapi expects proper authentication for SIP connections, where the username must be your SIP username, and the password can be anything except the keyword "test" [according to documentation](https://discord.com/channels/1211482211119796234/1211483291191083018/threads/1334238882660618250). ## Troubleshooting Steps ### 1. Check Your SIP URI Format Make sure your SIP URI is correctly formatted. If you're seeing "invalid credentials," it could mean the SIP address wasn't set up correctly. Use the SIP-URI username instead of arbitrary ones. For example, if your SIP URI is sip:1111212@sip.vapi.ai, use 1111212 as the username [as mentioned in the documentation](https://discord.com/channels/1211482211119796234/1211483291191083018/threads/1329143416386355270). ### 2. Verify Authentication Credentials Double-check that the credentials provided to Vapi are correct if your SIP endpoint requires authentication. You can pass credentials by setting the

outboundAuthenticationPlan

while setting up the credentials [according to this source](https://discord.com/channels/1211482211119796234/1211483291191083018/threads/1338421915483897856). ### 3. Check Network Configuration

where can i get full api documentation for credential ?

@Zaji A 401 error from the provider can mean various things. What carrier are you trying to connect to ?

Mine 🙂

Hey Zaji, for inbound calls, VAPI requires an authorization header. You need to pass the username and password here. The username has to be your SIP username, and the password can be anything except empty whitespace.

Thanks @Nir Simionovich (CEO@Cloudonix) for helping @Zaji

I got the same behavior when i try with an ASTERISK server

@Zaji did you manage to solve your issue?

now on ASTERISK i get the 401, challenge response but after i get 403 Forbidden. Nowhere inside the VAPI Documentation i find out exact information about what do you need to be inside the SIP Header to authenticate inbound call.

Has nothing to do with SIP headers. Are you dialing into VAPI or out of VAPI?

into

Ok

22

Walking on the cutting edge i see. How did you configure your SIP trunk ?

What a mess. Your pjsip config files would greatly help. However, as far as I can recall, VAPI's inbound/outbound configurations are non-symmetrical, while Asterisk expects pjsip endpoints to be symmetrical. Ping me via DM and maybe I can help you. Although, i still think your going the wrong path.

Having a similar issue, is there a reason why VAPI requests authorisation on inbound calls? Should it not implicitly trust the IP if it matches the regsitration address? This sort of thing used to be a bug on Asterisk/chansip devices

@Zaji Checking if this is resolved for you?

still not resolved

Hey Zaji, we are working on it. Will provide you the details once it is fixed.

@Sahil This issue was already resolved via our SBC. Generally speaking, the way @Zaji has things setup requires that VAPI Register to his system - which VAPI doesn't do, nor should it.

@Nir Simionovich (CEO@Cloudonix) would love to learn more about it like how fixed it cause there are other people who are facing the same issue.

@Sahil Well, here is the issue with SIP trunking in general - it's not a "standard", in general, SIP isn't a standard, it's a collection of RFC documents, that are very open to a business interpretation.

Thank you, Nir. Will go through these documentation and if I got stuck can I message you?

sure, have fun

I'm still not really understanding how any of this solves the issue aside from pushing us down the route of a third party service? I mean no offense but we have our own SBCs and like Sahil I'm from a carriage service provider (Australia based though). I've spoken to some other carriers here and for the end platform to reverse the registration for the inbound leg of the call is generally unheard of. The only other example which comes to mind is Bandwidth (previously Voxbone) but that is for use with their call termination services product (e.g. you generally have one set of credentials for ALL clients/calls). I will probably end up having my team develop a workaround for this as we have a client who is interested in a POC with Vapi but I think if Vapi want to stay competitive then it might be wise to address this issue and have a more 'standard' way of allowing inbound calls from carrier platforms. Either by making phone numbers unique across the platform, using the pre-shared unique hash (e.g. FQDN, Genesys, 3CX etc do this), or some sort of custom header line (similar to the prefix method mentioned above) any of these would be easier to integrate with rather than a challenge response.

In general, I agree with what you said - however, you need to understand that VAPI is not a telecom company, it's an AI company, there product is an AI product. As such, their focus is on the AI product, starting to build a telephony agnostic product, that caters to all cases is de-focusing. I totally get what you said, you can go into source codes like Asterisk, Kamailio and even GnuGK (God forbid), and you'll find my name of various patches. But even I know that focus is critical, specifically for companies that roam between multiple disciplines. That is why their default is Twilio, Telnyx and such.

Ben, check DM.